';
+ $svg_icon = function( string $name, string $path ) use ( &$html ) {
+ // Render each social icon as an with an inline SVG data URI.
+ // Using instead of inline
';
- // wp_kses_post() strips by default (the 'post' context doesn't allow it).
- // Extend the allowed list to keep SVG markup intact so the icons render.
+ // wp_kses_post() strips tags by default (the 'post' context doesn't
+ // allow them), and would also strip data: URIs we use as a fallback.
+ // Extend the allowed list to keep both forms intact so the icons render.
$allowed = wp_kses_allowed_html( 'post' );
+ $allowed['img'] = array(
+ 'src' => true,
+ 'alt' => true,
+ 'width' => true,
+ 'height' => true,
+ 'style' => true,
+ 'aria-hidden' => true,
+ );
$allowed['svg'] = array(
'xmlns' => true,
'class' => true,