Merge pull request #1044 from Codeinwp/bugfix/1687

Prevent cross site scripting

Author: selul

inc/tag_replacer.php

@@ -504,7 +504,11 @@ public function add_missing_srcset_attributes( $tag, $missing_srcsets, $new_url,
 			$optimized_url = $this->change_url_for_size( $new_url, $width, $height, $dpr );
 
 			if ( $optimized_url ) {
-				$new_srcset_entries[] = $optimized_url . ' ' . $descriptor;
+				$escaped_url = esc_url( $optimized_url );
+				if ( empty( $escaped_url ) ) {
+					continue;
+				}
+				$new_srcset_entries[] = $escaped_url . ' ' . esc_attr( $descriptor );
 
 				// Add sizes attribute entry for responsive breakpoints
 				if ( $breakpoint > 0 ) {