Commit 51ddd7fe376 for woocommerce

commit 51ddd7fe37602d3e1400ff344ff3ccdfcf7a732a
Author: Darren Ethier <darren@roughsmootheng.in>
Date:   Sun Aug 23 12:25:58 2026 -0400

    Document legacy product and payment markup contracts (#67947)

    Document legacy markup contracts

diff --git a/plugins/woocommerce/changelog/dev-markup-contract-suppressions b/plugins/woocommerce/changelog/dev-markup-contract-suppressions
new file mode 100644
index 00000000000..d1193ff1207
--- /dev/null
+++ b/plugins/woocommerce/changelog/dev-markup-contract-suppressions
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Document intentional product, order, and payment markup contracts with exact coding-standard annotations.
diff --git a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php
index f2b226dd017..e46cfed6a20 100644
--- a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php
+++ b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php
@@ -240,7 +240,7 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
 	 * Render column: thumb.
 	 */
 	protected function render_thumb_column() {
-		echo '<a href="' . esc_url( get_edit_post_link( $this->object->get_id() ) ) . '">' . $this->object->get_image( 'thumbnail' ) . '</a>'; // WPCS: XSS ok.
+		echo '<a href="' . esc_url( get_edit_post_link( $this->object->get_id() ) ) . '">' . $this->object->get_image( 'thumbnail' ) . '</a>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_image() returns HTML, including output from the public product image filter.
 	}

 	/**
diff --git a/plugins/woocommerce/includes/class-wc-embed.php b/plugins/woocommerce/includes/class-wc-embed.php
index 84bcc1ee09e..aba1de8b921 100644
--- a/plugins/woocommerce/includes/class-wc-embed.php
+++ b/plugins/woocommerce/includes/class-wc-embed.php
@@ -76,7 +76,7 @@ class WC_Embed {

 		// Make sure we're only affecting embedded products.
 		if ( self::is_embedded_product() ) {
-			echo '<p><span class="wc-embed-price">' . $_product->get_price_html() . '</span></p>'; // WPCS: XSS ok.
+			echo '<p><span class="wc-embed-price">' . $_product->get_price_html() . '</span></p>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_price_html() returns HTML, including output from the public product price filter.

 			if ( ! post_password_required( $post ) && ! empty( $post->post_excerpt ) ) {
 				ob_start();
diff --git a/plugins/woocommerce/includes/class-wc-order-item-meta.php b/plugins/woocommerce/includes/class-wc-order-item-meta.php
index badc1ba7d01..3a09742688c 100644
--- a/plugins/woocommerce/includes/class-wc-order-item-meta.php
+++ b/plugins/woocommerce/includes/class-wc-order-item-meta.php
@@ -105,7 +105,7 @@ class WC_Order_Item_Meta {
 		if ( $return ) {
 			return $output;
 		} else {
-			echo $output; // WPCS: XSS ok.
+			echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Base meta values are KSES-sanitized before the public legacy HTML filter.
 		}
 	}

diff --git a/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php b/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php
index 358f8ef7e35..dd2a1c90bd8 100644
--- a/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php
+++ b/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php
@@ -86,7 +86,7 @@ class WC_Payment_Gateway_CC extends WC_Payment_Gateway {
 			<?php do_action( 'woocommerce_credit_card_form_start', $this->id ); ?>
 			<?php
 			foreach ( $fields as $field ) {
-				echo $field; // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
+				echo $field; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- The public gateway field filter intentionally returns HTML; default fields escape dynamic data.
 			}
 			?>
 			<?php do_action( 'woocommerce_credit_card_form_end', $this->id ); ?>
diff --git a/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-echeck.php b/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-echeck.php
index f12ff84cda8..4a8eb5e5993 100644
--- a/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-echeck.php
+++ b/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-echeck.php
@@ -62,7 +62,7 @@ class WC_Payment_Gateway_ECheck extends WC_Payment_Gateway {
 			<?php do_action( 'woocommerce_echeck_form_start', $this->id ); ?>
 			<?php
 			foreach ( $fields as $field ) {
-				echo $field; // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
+				echo $field; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- The public gateway field filter intentionally returns HTML; default fields escape dynamic data.
 			}
 			?>
 			<?php do_action( 'woocommerce_echeck_form_end', $this->id ); ?>