This issue still exists in v3.4.9.7 and it exists since v3.4.9.6
Reverting back to 3.4.9.5 and the issue is gone.
I’ll do now some code compare to in these 3 versions to have a look deeper.
Edit: here is the compare result with the changes regarding the file “class-wp-members-widget.php” line 467:
v3.4.9.5:
$str = $args['wrapper_before'] . $args['status_text'] . "<a href=\"$logout\">" . $args['link_text'] . '</a>' . $args['wrapper_after'];
v3.4.9.6:
$str = esc_attr( $args['wrapper_before'] ) . esc_html( $args['status_text'] ) . '<a href="' . esc_url_raw( $logout ) . '">' . esc_html( $args['link_text'] ) . '</a>' . esc_attr( $args['wrapper_after'] );
v3.4.9.7
$str = $args['wrapper_before'] . $args['status_text'] . '<a href="' . esc_url_raw( $logout ) . '">' . esc_html( $args['link_text'] ) . '</a>' . $args['wrapper_after'];
-
This reply was modified 3 weeks, 2 days ago by Barcelo. Reason: Added results of code compare