Commit 24a5b2d19f5 for woocommerce
commit 24a5b2d19f5fa962c561637c52b55de7abcf0de4
Author: Karol Manijak <20098064+kmanijak@users.noreply.github.com>
Date: Mon Aug 31 10:19:47 2026 +0200
Properly strip tags from product names in AJAX responses (#68173)
* Properly strip tags from product names in AJAX responses
* Add changelog
* Use hyphen instead of ndash
---------
Co-authored-by: Albert Juhé Lluveras <contact@albertjuhe.com>
diff --git a/plugins/woocommerce/changelog/fix-strip-product-title-tags-select b/plugins/woocommerce/changelog/fix-strip-product-title-tags-select
new file mode 100644
index 00000000000..00961babe96
--- /dev/null
+++ b/plugins/woocommerce/changelog/fix-strip-product-title-tags-select
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Properly strip tags from product names in AJAX responses
diff --git a/plugins/woocommerce/includes/class-wc-ajax.php b/plugins/woocommerce/includes/class-wc-ajax.php
index a3e8cd59bf7..cd8c085b96b 100644
--- a/plugins/woocommerce/includes/class-wc-ajax.php
+++ b/plugins/woocommerce/includes/class-wc-ajax.php
@@ -1921,7 +1921,7 @@ class WC_AJAX {
}
if ( ! empty( $stock_parts ) ) {
- $formatted_name .= ' (' . implode( ' – ', $stock_parts ) . ')';
+ $formatted_name .= ' (' . implode( ' – ', $stock_parts ) . ')';
}
$product_status = $product_object->get_status();
@@ -1932,7 +1932,7 @@ class WC_AJAX {
}
}//end if
- $products[ $product_object->get_id() ] = rawurldecode( wp_strip_all_tags( $formatted_name ) );
+ $products[ $product_object->get_id() ] = esc_html( wp_strip_all_tags( $formatted_name ) );
}
wp_send_json( apply_filters( 'woocommerce_json_search_found_products', $products ) );
@@ -1977,7 +1977,7 @@ class WC_AJAX {
$products = array();
foreach ( $product_objects as $product_object ) {
- $products[ $product_object->get_id() ] = rawurldecode( wp_strip_all_tags( $product_object->get_formatted_name() ) );
+ $products[ $product_object->get_id() ] = esc_html( wp_strip_all_tags( $product_object->get_formatted_name() ) );
}
wp_send_json( $products );