Open
Description
Unescaped output from WordPress translation functions is not being flagged by the full HM standards checks.
The HM-Minimum
standard allows the use of unescaped translation functions (see HM-Minimum/ruleset.xml#L57-L66). The minimum standards are then imported into HM
standards (HM/ruleset.xml#L12-L13), but there are no other rules in the HM
standard that check the output of these functions is escaped.
The following code should pass HM-Minimum
, but fail HM
. Currently, it passes both.
echo __( 'This should error', 'err' );