From f343b3c03e66d06c05db5f70cffe15d194d6e6dd Mon Sep 17 00:00:00 2001
From: Boro Sitnikovski <buritomath@gmail.com>
Date: Mon, 24 Aug 2026 17:17:47 +0200
Subject: [PATCH] Media: escape the track label before inserting it into the
 captions menu.

`MediaElementPlayer.addTrackButton()` concatenated a `<track>` element's
`label` into `innerHTML`, so markup in a track label was parsed as HTML.
Escape the label so it is always rendered as text.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../vendor/mediaelement/mediaelement-and-player.js         | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/js/_enqueues/vendor/mediaelement/mediaelement-and-player.js b/src/js/_enqueues/vendor/mediaelement/mediaelement-and-player.js
index 26b951ec72bf5..e52b600dca28a 100644
--- a/src/js/_enqueues/vendor/mediaelement/mediaelement-and-player.js
+++ b/src/js/_enqueues/vendor/mediaelement/mediaelement-and-player.js
@@ -2625,7 +2625,12 @@ Object.assign(_player2.default.prototype, {
 			label = _i18n2.default.t(_mejs2.default.language.codes[lang]) || lang;
 		}
 
-		t.captionsButton.querySelector('ul').innerHTML += '<li class="' + t.options.classPrefix + 'captions-selector-list-item">' + ('<input type="radio" class="' + t.options.classPrefix + 'captions-selector-input" ') + ('name="' + t.id + '_captions" id="' + trackId + '" value="' + trackId + '" disabled>') + ('<label class="' + t.options.classPrefix + 'captions-selector-label"') + ('for="' + trackId + '">' + label + ' (loading)</label>') + '</li>';
+		// The label comes from the track element's `label` attribute and is inserted
+		// as HTML below. Escape it so a label is always rendered as text rather than
+		// parsed as markup.
+		var labelText = ('' + label).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#039;');
+
+		t.captionsButton.querySelector('ul').innerHTML += '<li class="' + t.options.classPrefix + 'captions-selector-list-item">' + ('<input type="radio" class="' + t.options.classPrefix + 'captions-selector-input" ') + ('name="' + t.id + '_captions" id="' + trackId + '" value="' + trackId + '" disabled>') + ('<label class="' + t.options.classPrefix + 'captions-selector-label"') + ('for="' + trackId + '">' + labelText + ' (loading)</label>') + '</li>';
 	},
 	checkForTracks: function checkForTracks() {
 		var t = this;