AST-5003 - Astra Widget Security Issue.

[yssambare12]

• Astra Widget Security Issue.

[Copilot]

Pull request overview

This PR addresses a security vulnerability in the Astra Widgets plugin by implementing proper output escaping and input sanitization across three widget classes. The version is bumped from 1.2.16 to 1.2.17.

• Replaced esc_attr() with esc_url() for URL output in href attributes to prevent XSS attacks
• Added esc_url_raw() sanitization in widget update methods to sanitize user-provided URLs during save
• Changed esc_attr() to esc_html() for text content display to use the appropriate escaping function

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
readme.txt	Updated stable tag to 1.2.17 and added changelog entry for security improvements
package.json	Bumped version to 1.2.17
package-lock.json	Bumped version to 1.2.17
astra-widgets.php	Updated plugin version header to 1.2.17
README.md	Updated stable tag to 1.2.17 and added changelog entry for security improvements
classes/widgets/class-astra-widget-social-profiles.php	Changed link output escaping from esc_attr() to esc_url() and added esc_url_raw() sanitization in the update method for social profile links
classes/widgets/class-astra-widget-list-icons.php	Added esc_url_raw() sanitization in the update method for list icon links after the generic text field sanitization
classes/widgets/class-astra-widget-address.php	Changed address display to use esc_html(), and updated telephone and email href attributes to use esc_url() instead of building with esc_attr(), plus changed fax display to use esc_html()

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.