Escape URL for display.

10up · Nov 5, 2023 · e44d29a · e44d29a
1 parent 90c3ca3
commit e44d29a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/includes/class-simple-local-avatars.php b/includes/class-simple-local-avatars.php
@@ -386,7 +386,7 @@ public function get_simple_local_avatar_url( $id_or_email, $size ) {
 		$url = apply_filters( 'pre_simple_local_avatar_url', null, $user_id, $size, $local_avatars );
 
 		if ( is_string( $url ) ) {
-			return $url;
+			return esc_url( $url );
 		}
 
 		// handle "real" media