From 3d4c1fa751b65eb5c43247e45eca56ee63db2cfb Mon Sep 17 00:00:00 2001
From: Christopher Ross <122108986+thisismyurl@users.noreply.github.com>
Date: Sun, 7 Jun 2026 18:30:48 +0000
Subject: [PATCH] fix: asset version sync and wp_kses for printf with HTML arg

- Bump asset version constant to 1.6149.0734 to match header
- Replace esc_html__() + printf() pattern (which double-encodes the link
  HTML) with wp_kses( sprintf() ) allowing only the <a> tag with its
  expected attributes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 thisismyurl-external-link-control.php | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/thisismyurl-external-link-control.php b/thisismyurl-external-link-control.php
index 02c312d..356f2db 100644
--- a/thisismyurl-external-link-control.php
+++ b/thisismyurl-external-link-control.php
@@ -136,7 +136,7 @@ public function enqueue_admin_assets( $hook ) {
                 'timu-elc-admin',
                 plugins_url( 'assets/css/admin.css', __FILE__ ),
                 array(),
-                '1.6148'
+                '1.6149.0734'
             );
         }
     }
@@ -341,10 +341,13 @@ public function render_plugin_admin_ui() {
                 <?php esc_html_e( 'External Link Control', 'thisismyurl-external-link-control' ); ?>
                 <span class="timu-elc-byline">
                     <?php
-                    printf(
-                        /* translators: %s: brand name "thisismyurl.com" rendered as a link. */
-                        esc_html__( 'by %s', 'thisismyurl-external-link-control' ),
-                        '<a href="https://thisismyurl.com/" target="_blank" rel="noopener noreferrer" class="timu-elc-byline-link">thisismyurl.com</a>'
+                    echo wp_kses(
+                        sprintf(
+                            /* translators: %s: brand name "thisismyurl.com" rendered as a link. */
+                            __( 'by %s', 'thisismyurl-external-link-control' ),
+                            '<a href="https://thisismyurl.com/" target="_blank" rel="noopener noreferrer" class="timu-elc-byline-link">thisismyurl.com</a>'
+                        ),
+                        array( 'a' => array( 'href' => array(), 'target' => array(), 'rel' => array(), 'class' => array() ) )
                     );
                     ?>
                 </span>