From d560b3cfbef4731cb5bf886c8ed8415e181e20ac Mon Sep 17 00:00:00 2001
From: nikitozzzzzzz <nsinelnikov.work@gmail.com>
Date: Mon, 11 Jun 2018 17:17:01 +0300
Subject: [PATCH] - fixed XSS at wp-admin settings screen;

---
 includes/admin/core/class-admin-forms.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/admin/core/class-admin-forms.php b/includes/admin/core/class-admin-forms.php
index 8f38c5d8..61fc263b 100644
--- a/includes/admin/core/class-admin-forms.php
+++ b/includes/admin/core/class-admin-forms.php
@@ -737,9 +737,9 @@ if ( ! class_exists( 'um\admin\core\Admin_Forms' ) ) {
 					if ( ! is_array( $value ) || empty( $value ) )
 						$value = array();
 
-					$options .= '<option value="' . $key . '" ' . selected( in_array( $key, $value ), true, false ) . '>' . $option . '</option>';
+					$options .= '<option value="' . $key . '" ' . selected( in_array( $key, $value ), true, false ) . '>' . esc_html( $option ) . '</option>';
 				} else {
-					$options .= '<option value="' . $key . '" ' . selected( (string)$key == $value, true, false ) . '>' . $option . '</option>';
+					$options .= '<option value="' . $key . '" ' . selected( (string)$key == $value, true, false ) . '>' . esc_html( $option ) . '</option>';
 				}
 			}