From 457a42ed14fb5839ae2f22769957f703b7bea4f1 Mon Sep 17 00:00:00 2001
From: Himadree Shekhar Halder <himadree12@gmail.com>
Date: Thu, 15 Feb 2024 13:08:53 +0600
Subject: [PATCH 01/22] Post Grid: Fix post term show issue

---
 includes/Template/Post-Grid/default.php | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/includes/Template/Post-Grid/default.php b/includes/Template/Post-Grid/default.php
index d018a8dc8..6b52c4040 100644
--- a/includes/Template/Post-Grid/default.php
+++ b/includes/Template/Post-Grid/default.php
@@ -126,12 +126,12 @@ class="eael-post-elements-readmore-btn"' . $link_settings['read_more_link_nofoll
                                 if ($settings['eael_post_terms'] === 'tags') {
                                     $terms = get_the_tags();
                                 }
-
+                                
                                 //For custom post type
-                                $get_custom_post_type = get_post_type( get_the_ID() );
-                                $get_custom_taxonomy  = $settings["eael_{$get_custom_post_type}_terms"];
+                                $get_custom_post_type = get_post_type( get_the_ID() ); //post
+                                $get_custom_taxonomy  = $settings["eael_{$get_custom_post_type}_terms"]; //tags
 
-                                if ( $settings[ 'eael_post_terms' ] === $get_custom_taxonomy ) {
+                                if( 'post' !== $get_custom_post_type && $settings[ 'eael_post_terms' ] === $get_custom_taxonomy ) {
                                     $terms = wp_get_post_terms( get_the_ID(), $get_custom_taxonomy );
                                 }
 
@@ -139,7 +139,6 @@ class="eael-post-elements-readmore-btn"' . $link_settings['read_more_link_nofoll
                                     $html = '<ul class="post-meta-categories">';
                                     $count = 0;
                                     
-                                    $eael_post_terms_separator = ! empty( $settings['eael_post_terms_separator'] ) ? wp_strip_all_tags( $settings['eael_post_terms_separator'] ) : '';
                                     foreach ($terms as $term) {
                                         if ($count === intval($settings['eael_post_terms_max_length'])) {
                                             break;
@@ -147,9 +146,13 @@ class="eael-post-elements-readmore-btn"' . $link_settings['read_more_link_nofoll
                                         if ($count === 0) {
                                             $html .= '<li class="meta-cat-icon"><i class="far fa-folder-open"></i></li>';
                                         }
-
-                                        $is_last_item = $count + 1 === intval($settings['eael_post_terms_max_length']) || $count + 1 === count($terms);
-                                        $eael_post_terms_separator = $is_last_item  ? '' : $eael_post_terms_separator; 
+                                        
+                                        $is_last_item = $count + 1 === intval($settings['eael_post_terms_max_length']) || $count + 1 === count( (array) $terms);
+                                        
+                                        if (  ! empty( $term->name ) ) {
+                                            $eael_post_terms_separator = ! empty( $settings['eael_post_terms_separator'] ) ? wp_strip_all_tags( $settings['eael_post_terms_separator'] ) : '';
+                                            $eael_post_terms_separator = $is_last_item  ? '' : $eael_post_terms_separator; 
+                                        }
                                     
                                         $link = ($settings['eael_post_terms'] === 'category') ? get_category_link($term->term_id) : get_tag_link($term->term_id);
                                         $html .= '<li>';

From 9180e0c1ce5fe34c2d33f1823307389dac84d8c0 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 08:48:07 +0600
Subject: [PATCH 02/22] escape event calendar first day of week

---
 includes/Elements/Event_Calendar.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Event_Calendar.php b/includes/Elements/Event_Calendar.php
index ec8dab869..1f90dfc3b 100644
--- a/includes/Elements/Event_Calendar.php
+++ b/includes/Elements/Event_Calendar.php
@@ -3040,7 +3040,7 @@ protected function render() {
             data-hideDetailsLink= "' . $settings['eael_event_details_link_hide'] . '"
             data-detailsButtonText = "' . Helper::eael_wp_kses( $settings['eael_event_details_text'] ) . '"
             data-events="' . htmlspecialchars( json_encode( $data ), ENT_QUOTES, 'UTF-8' ) . '"
-            data-first_day="' . $settings['eael_event_calendar_first_day'] . '"></div>
+            data-first_day="' . esc_attr( $settings['eael_event_calendar_first_day'] ) . '"></div>
             ' . $this->eaelec_load_event_details();
 	    } else {
 		    $this->eaelec_display_table( $data, $settings );

From ce09396eeb1bfa300950e4264a6c269c7c33c528 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 09:15:23 +0600
Subject: [PATCH 03/22] escape data table header svg icon src

---
 includes/Elements/Data_Table.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Data_Table.php b/includes/Elements/Data_Table.php
index edf3ce95a..6fe7549b1 100755
--- a/includes/Elements/Data_Table.php
+++ b/includes/Elements/Data_Table.php
@@ -1380,7 +1380,7 @@ protected function render( ) {
 							<?php if( $header_title['eael_data_table_header_col_icon_enabled'] == 'true' && $header_title['eael_data_table_header_icon_type'] == 'icon' ) : ?>
 								<?php if (empty($header_title['eael_data_table_header_col_icon']) || isset($header_title['__fa4_migrated']['eael_data_table_header_col_icon_new'])) { ?>
 									<?php if( isset($header_title['eael_data_table_header_col_icon_new']['value']['url']) ) : ?>
-										<img class="data-header-icon data-table-header-svg-icon" src="<?php echo $header_title['eael_data_table_header_col_icon_new']['value']['url'] ?>" alt="<?php echo esc_attr(get_post_meta($header_title['eael_data_table_header_col_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
+										<img class="data-header-icon data-table-header-svg-icon" src="<?php echo esc_url( $header_title['eael_data_table_header_col_icon_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($header_title['eael_data_table_header_col_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
 									<?php else : ?>
 										<i class="<?php echo $header_title['eael_data_table_header_col_icon_new']['value'] ?> data-header-icon"></i>
 									<?php endif; ?>

From 6353dfdf171ebe86bbd403fb85bfd2e22d59f1cf Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 09:29:11 +0600
Subject: [PATCH 04/22] escape Event Calendar

---
 includes/Elements/Event_Calendar.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/includes/Elements/Event_Calendar.php b/includes/Elements/Event_Calendar.php
index 1f90dfc3b..4a2e4e0f7 100644
--- a/includes/Elements/Event_Calendar.php
+++ b/includes/Elements/Event_Calendar.php
@@ -3029,15 +3029,15 @@ protected function render() {
 
 		    echo '<div id="eael-event-calendar-' . $this->get_id() . '" class="eael-event-calendar-cls"
             data-cal_id = "' . $this->get_id() . '"
-            data-locale = "' . $local . '"
+            data-locale = "' . esc_attr( $local ) . '"
             data-translate = "' . htmlspecialchars( json_encode( $translate_date ), ENT_QUOTES, 'UTF-8' ) . '"
-            data-defaultview = "' . $default_view . '"
-            data-defaultdate = "' . $default_date . '"
-            data-time_format = "' . $time_format . '"
+            data-defaultview = "' . esc_attr( $default_view ) . '"
+            data-defaultdate = "' . esc_attr( $default_date ) . '"
+            data-time_format = "' . esc_attr( $time_format ) . '"
             data-event_limit = "' . $event_limit . '"
             data-popup_date_formate = "' . esc_attr( $settings['eael_event_popup_date_formate'] ) . '"
             data-multidays_event_day_count= "' . $multi_days_event_day_count . '"
-            data-hideDetailsLink= "' . $settings['eael_event_details_link_hide'] . '"
+            data-hideDetailsLink= "' . esc_attr( $settings['eael_event_details_link_hide'] ) . '"
             data-detailsButtonText = "' . Helper::eael_wp_kses( $settings['eael_event_details_text'] ) . '"
             data-events="' . htmlspecialchars( json_encode( $data ), ENT_QUOTES, 'UTF-8' ) . '"
             data-first_day="' . esc_attr( $settings['eael_event_calendar_first_day'] ) . '"></div>
@@ -3060,7 +3060,7 @@ public function eaelec_display_table($data, $settings){
 		$item_per_page = $is_paginated && !empty( $settings['eael_ec_item_per_page'] ) ? intval( $settings['eael_ec_item_per_page'] ) : 1;
 
 		?>
-		<table class="eael-event-calendar-table <?php  echo $is_paginated ? 'ea-ec-table-paginated' : '' ?> ea-ec-table-sortable" data-items-per-page="<?php esc_attr_e( $item_per_page );?>">
+		<table class="eael-event-calendar-table <?php  echo $is_paginated ? 'ea-ec-table-paginated' : '' ?> ea-ec-table-sortable" data-items-per-page="<?php echo esc_attr( $item_per_page ); ?>">
 			<thead>
 			<tr style="display: table-row;">
 				<?php

From 43f6498c66b4e4eb0bed6cda34913d1b15592669 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 10:57:45 +0600
Subject: [PATCH 05/22] escape data table

---
 includes/Elements/Data_Table.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/Elements/Data_Table.php b/includes/Elements/Data_Table.php
index 6fe7549b1..61e0852ba 100755
--- a/includes/Elements/Data_Table.php
+++ b/includes/Elements/Data_Table.php
@@ -1382,10 +1382,10 @@ protected function render( ) {
 									<?php if( isset($header_title['eael_data_table_header_col_icon_new']['value']['url']) ) : ?>
 										<img class="data-header-icon data-table-header-svg-icon" src="<?php echo esc_url( $header_title['eael_data_table_header_col_icon_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($header_title['eael_data_table_header_col_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
 									<?php else : ?>
-										<i class="<?php echo $header_title['eael_data_table_header_col_icon_new']['value'] ?> data-header-icon"></i>
+										<i class="<?php echo esc_attr( $header_title['eael_data_table_header_col_icon_new']['value'] ); ?> data-header-icon"></i>
 									<?php endif; ?>
 								<?php } else { ?>
-									<i class="<?php echo $header_title['eael_data_table_header_col_icon'] ?> data-header-icon"></i>
+									<i class="<?php echo esc_attr( $header_title['eael_data_table_header_col_icon'] ); ?> data-header-icon"></i>
 								<?php } ?>
 			            	<?php endif; ?>
 							<?php
@@ -1425,7 +1425,7 @@ protected function render( ) {
                                                         </div>
                                                    <?php } else { ?>
                                                         <div class="td-content">
-                                                            <span class="<?php echo $table_td[ $j ]['icon_content'] ?>" aria-hidden="true"></span>
+                                                            <span class="<?php echo esc_attr( $table_td[ $j ]['icon_content'] ); ?>" aria-hidden="true"></span>
                                                         </div>
                                                     <?php } ?>
 												</div>

From c4e1c6d0c7031169dc144a2fe8ed861b20c37535 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:30:05 +0600
Subject: [PATCH 06/22] escape all src link attribute -- adv tabs

---
 includes/Elements/Adv_Tabs.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Adv_Tabs.php b/includes/Elements/Adv_Tabs.php
index 17a112b53..ee340972f 100644
--- a/includes/Elements/Adv_Tabs.php
+++ b/includes/Elements/Adv_Tabs.php
@@ -1053,7 +1053,7 @@ protected function render()
                                         echo '<i class="' . esc_attr( $tab['eael_adv_tabs_tab_title_icon'] ) . '"></i>';
                                     } ?>
                                 <?php elseif ($tab['eael_adv_tabs_icon_type'] === 'image') : ?>
-                                    <img src="<?php echo esc_attr($tab['eael_adv_tabs_tab_title_image']['url']); ?>" alt="<?php echo esc_attr(get_post_meta($tab['eael_adv_tabs_tab_title_image']['id'], '_wp_attachment_image_alt', true)); ?>">
+                                    <img src="<?php echo esc_url( $tab['eael_adv_tabs_tab_title_image']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($tab['eael_adv_tabs_tab_title_image']['id'], '_wp_attachment_image_alt', true)); ?>">
                                 <?php endif; ?>
                             <?php endif; ?>
 

From 0bcd35a7c9801014eeb65bc93762bfe562028d77 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:30:15 +0600
Subject: [PATCH 07/22] escape all src link attribute -- cta box

---
 includes/Elements/Cta_Box.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Cta_Box.php b/includes/Elements/Cta_Box.php
index 0573df2e7..4a5ed72ea 100755
--- a/includes/Elements/Cta_Box.php
+++ b/includes/Elements/Cta_Box.php
@@ -1543,7 +1543,7 @@ protected function render()
 	    <div class="icon">
 			<?php if ($icon_is_new || $icon_migrated) {?>
 				<?php if (isset($settings['eael_cta_flex_grid_icon_new']['value']['url'])): ?>
-					<img src="<?php echo esc_attr($settings['eael_cta_flex_grid_icon_new']['value']['url']); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_cta_flex_grid_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
+					<img src="<?php echo esc_url( $settings['eael_cta_flex_grid_icon_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_cta_flex_grid_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
 				<?php else:
                     Icons_Manager::render_icon( $settings['eael_cta_flex_grid_icon_new'] );
 

From f16301c82e0d0e0c1616ea1918d0666f907b1af1 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:31:07 +0600
Subject: [PATCH 08/22] escape all src link attribute -- info box

---
 includes/Elements/Info_Box.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/Elements/Info_Box.php b/includes/Elements/Info_Box.php
index 6b0377d36..be8c3b411 100644
--- a/includes/Elements/Info_Box.php
+++ b/includes/Elements/Info_Box.php
@@ -1713,7 +1713,7 @@ protected function render_infobox_button()
                 <?php if ('left' == $settings['eael_infobox_button_icon_alignment']): ?>
                     <?php if ($button_icon_is_new || $button_icon_migrated) {?>
                         <?php if (isset($settings['eael_infobox_button_icon_new']['value']['url'])) {?>
-                            <img class="eael_infobox_button_icon_left" src="<?php echo esc_attr($settings['eael_infobox_button_icon_new']['value']['url']); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_infobox_button_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
+                            <img class="eael_infobox_button_icon_left" src="<?php echo esc_url( $settings['eael_infobox_button_icon_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_infobox_button_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
                         <?php } else {
                             Icons_Manager::render_icon( $settings['eael_infobox_button_icon_new'], [ 'aria-hidden' => 'true', 'class' => 'eael_infobox_button_icon_left' ] );
                         }?>
@@ -1725,7 +1725,7 @@ protected function render_infobox_button()
                 <?php if ('right' == $settings['eael_infobox_button_icon_alignment']): ?>
                     <?php if ($button_icon_is_new || $button_icon_migrated) {?>
                         <?php if (isset($settings['eael_infobox_button_icon_new']['value']['url'])) {?>
-                            <img class="eael_infobox_button_icon_right" src="<?php echo esc_attr($settings['eael_infobox_button_icon_new']['value']['url']); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_infobox_button_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
+                            <img class="eael_infobox_button_icon_right" src="<?php echo esc_url( $settings['eael_infobox_button_icon_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_infobox_button_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
                         <?php } else {
                             Icons_Manager::render_icon( $settings['eael_infobox_button_icon_new'], [ 'aria-hidden' => 'true', 'class' => 'eael_infobox_button_icon_right' ] );
                         }?>

From 8c58bcae1bf9626e7a77014ca1d09204f631d1a8 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:31:28 +0600
Subject: [PATCH 09/22] escape all src link attribute -- login register

---
 includes/Elements/Login_Register.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Login_Register.php b/includes/Elements/Login_Register.php
index df008eb3f..9a352718a 100644
--- a/includes/Elements/Login_Register.php
+++ b/includes/Elements/Login_Register.php
@@ -6500,7 +6500,7 @@ protected function print_form_header( $form_type = 'login' ) {
         <div class="lr-form-header header-<?php echo esc_attr( $this->form_logo_pos ); ?>">
 			<?php if ( ! empty( $this->form_logo ) ) { ?>
                 <div class="form-logo <?php echo esc_attr( $show_form_logo_class ); ?>">
-                    <img src="<?php echo esc_attr( esc_url( $this->form_logo ) ); ?>"
+                    <img src="<?php echo esc_url( $this->form_logo ); ?>"
                          alt="<?php esc_attr_e( 'Form Logo Image', 'essential-addons-for-elementor-lite' ); ?>">
                 </div>
 			<?php } ?>

From b7c739f610fa1ea3f6d1968c6abd12eeff5d0c83 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:31:43 +0600
Subject: [PATCH 10/22] escape all src link attribute -- team member

---
 includes/Elements/Team_Member.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Team_Member.php b/includes/Elements/Team_Member.php
index bf851b99f..432ad375f 100644
--- a/includes/Elements/Team_Member.php
+++ b/includes/Elements/Team_Member.php
@@ -943,7 +943,7 @@ protected function render( ) {
 										<a <?php $this->print_render_attribute_string( 'social_link_' . $index ); ?>>
 											<?php if ($icon_is_new || $icon_migrated) { ?>
 												<?php if( isset( $item['social_new']['value']['url'] ) ) : ?>
-													<img src="<?php echo esc_attr($item['social_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($item['social_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
+													<img src="<?php echo esc_url( $item['social_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($item['social_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
 												<?php else :
                                                     \Elementor\Icons_Manager::render_icon( $item['social_new'], [ 'aria-hidden' => 'true' ] );
                                                 endif; ?>

From 1888752bb357ebb84ab9405537f803a494cc014c Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:33:12 +0600
Subject: [PATCH 11/22] escape all src link attribute -- tooltips

---
 includes/Elements/Tooltip.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Tooltip.php b/includes/Elements/Tooltip.php
index 88d80a18a..23bc0ebab 100755
--- a/includes/Elements/Tooltip.php
+++ b/includes/Elements/Tooltip.php
@@ -728,7 +728,7 @@ protected function render( ) {
 			<span class="eael-tooltip-content" tabindex="0" aria-describedby="tooltip-text-<?php echo esc_attr( $this->get_id() ); ?>"><?php if( $settings['eael_tooltip_enable_link'] === 'yes' ) : ?><a <?php $this->print_render_attribute_string( 'eael_tooltip_link' ); ?>><?php endif; ?>
 			<?php if ($icon_is_new || $icon_migrated) { ?>
 				<?php if( isset($settings['eael_tooltip_icon_content_new']['value']['url']) ) : ?>
-					<img class="ea-tooltip-svg-trigger" src="<?php echo esc_attr( $settings['eael_tooltip_icon_content_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_tooltip_icon_content_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
+					<img class="ea-tooltip-svg-trigger" src="<?php echo esc_url( $settings['eael_tooltip_icon_content_new']['value']['url'] ); ?>" alt="<?php echo esc_attr(get_post_meta($settings['eael_tooltip_icon_content_new']['value']['id'], '_wp_attachment_image_alt', true)); ?>" />
 				<?php else :
                     Icons_Manager::render_icon( $settings['eael_tooltip_icon_content_new'], [ 'aria-hidden' => 'true' ] );
                   endif;

From 0beb70b7170a4520a9a36f0b419ab03560b3846f Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:34:08 +0600
Subject: [PATCH 12/22] escape all src link attribute -- woo product gallery

---
 includes/Template/Woo-Product-Gallery/default.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/Template/Woo-Product-Gallery/default.php b/includes/Template/Woo-Product-Gallery/default.php
index 63b91140b..9d07fd407 100644
--- a/includes/Template/Woo-Product-Gallery/default.php
+++ b/includes/Template/Woo-Product-Gallery/default.php
@@ -64,7 +64,7 @@
             }
 
             ?>
-            <div class="eael-product-wrap" data-src="<?php echo esc_attr( $image_sources['src'] ) ?>" data-src-hover="<?php echo esc_attr( $image_sources['src_hover'] ) ?>" >
+            <div class="eael-product-wrap" data-src="<?php echo esc_url( $image_sources['src'] ); ?>" data-src-hover="<?php echo esc_url( $image_sources['src_hover'] ) ?>" >
 	        <?php
 	        do_action( 'eael_woocommerce_before_shop_loop_item' );
 	        if ( $settings['eael_wc_loop_hooks'] === 'yes' ){
@@ -111,7 +111,7 @@
             }
             
             ?>
-            <div class="eael-product-wrap" data-src="<?php echo esc_attr( $image_sources['src'] ) ?>" data-src-hover="<?php echo esc_attr( $image_sources['src_hover'] ) ?>" >
+            <div class="eael-product-wrap" data-src="<?php echo esc_url( $image_sources['src'] ); ?>" data-src-hover="<?php echo esc_url( $image_sources['src_hover'] ); ?>" >
 	            <?php
 	            do_action( 'eael_woocommerce_before_shop_loop_item' );
 	            if ( $settings['eael_wc_loop_hooks'] === 'yes' ) {
@@ -210,7 +210,7 @@ class="eael-product-gallery-open-popup open-popup-link">
                 $image_sources = Helper::eael_get_woo_product_gallery_image_srcs( $product, $settings['eael_product_gallery_image_size_size'] );
             }
             ?>
-            <div class="eael-product-wrap" data-src="<?php echo esc_attr( $image_sources['src'] ) ?>" data-src-hover="<?php echo esc_attr( $image_sources['src_hover'] ) ?>" >
+            <div class="eael-product-wrap" data-src="<?php echo esc_url( $image_sources['src'] ); ?>" data-src-hover="<?php echo esc_url( $image_sources['src_hover'] ); ?>" >
 	            <?php
 	            do_action( 'eael_woocommerce_before_shop_loop_item' );
 	            if ( $settings['eael_wc_loop_hooks'] === 'yes' ) {

From c29f0a169dfb16e543fdc44afb4d6fb45bbdee3c Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:56:50 +0600
Subject: [PATCH 13/22] escape contact form id in shortcode -- caldera form

---
 includes/Elements/Caldera_Forms.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Caldera_Forms.php b/includes/Elements/Caldera_Forms.php
index 578a67dcf..a51ace2e6 100755
--- a/includes/Elements/Caldera_Forms.php
+++ b/includes/Elements/Caldera_Forms.php
@@ -1533,7 +1533,7 @@ protected function render()
                         <?php }?>
                     </div>
                 <?php }?>
-                <?php echo do_shortcode('[caldera_form id="' . $settings['contact_form_list'] . '" ]'); ?>
+                <?php echo do_shortcode('[caldera_form id="' . esc_attr( $settings['contact_form_list'] ) . '" ]'); ?>
             </div>
             <?php
         }

From 7baa2f6a6657712e4175897fcca40a63b6635c03 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:57:02 +0600
Subject: [PATCH 14/22] escape contact form id in shortcode -- contact form 7

---
 includes/Elements/Contact_Form_7.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/Contact_Form_7.php b/includes/Elements/Contact_Form_7.php
index db3c2ccd4..39f80fdcb 100755
--- a/includes/Elements/Contact_Form_7.php
+++ b/includes/Elements/Contact_Form_7.php
@@ -1752,7 +1752,7 @@ protected function render()
                 }
                 echo '</div>';
             }
-            echo do_shortcode('[contact-form-7 id="' . $settings['contact_form_list'] . '" ]');
+            echo do_shortcode('[contact-form-7 id="' . esc_attr( $settings['contact_form_list'] ) . '" ]');
             echo '</div>
             </div>';
         }

From 302d49c71a4f6b2ec2dc0836f5f0f3b9f73f5d4a Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:57:20 +0600
Subject: [PATCH 15/22] escape contact form id in shortcode -- we forms

---
 includes/Elements/WeForms.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Elements/WeForms.php b/includes/Elements/WeForms.php
index d5f32f565..3964ed7e7 100755
--- a/includes/Elements/WeForms.php
+++ b/includes/Elements/WeForms.php
@@ -796,7 +796,7 @@ protected function render()
 
         if (!empty($settings['wpuf_contact_form'])) {
             echo '<div class="eael-weform-container">
-			' . do_shortcode('[weforms id="' . $settings['wpuf_contact_form'] . '" ]') . '
+			' . do_shortcode('[weforms id="' . esc_attr( $settings['wpuf_contact_form'] ) . '" ]') . '
 		</div>';
         }
     }

From 74f69a33b619744a67694b957994a1ab6274e6d6 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:57:58 +0600
Subject: [PATCH 16/22] escape attribute -- woo product gallery

---
 includes/Elements/Woo_Product_Gallery.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/Elements/Woo_Product_Gallery.php b/includes/Elements/Woo_Product_Gallery.php
index 151e2605f..dcc15cede 100755
--- a/includes/Elements/Woo_Product_Gallery.php
+++ b/includes/Elements/Woo_Product_Gallery.php
@@ -2490,7 +2490,7 @@ protected function render() {
 					$query                    = new \WP_Query( $args );
 					$show_secondary_image     = isset( $settings['eael_product_gallery_show_secondary_image'] ) && 'yes' === $settings['eael_product_gallery_show_secondary_image'];
 
-					echo '<ul class="products eael-post-appender eael-post-appender-' . $this->get_id() . '" data-layout-mode="' . $settings["eael_product_gallery_items_layout"] . '" data-show-secondary-image="' . intval( $show_secondary_image ) . '" >';
+					echo '<ul class="products eael-post-appender eael-post-appender-' . $this->get_id() . '" data-layout-mode="' . esc_attr( $settings["eael_product_gallery_items_layout"] ) . '" data-show-secondary-image="' . intval( $show_secondary_image ) . '" >';
 					if ( $query->have_posts() ) {
 						$found_posts         = $query->found_posts;
 						$max_page            = ceil( $found_posts / absint( $args['posts_per_page'] ) );
@@ -2743,7 +2743,7 @@ public function eael_product_terms_render( $settings, $args ) {
 		$dir_name       = method_exists( $this, 'get_temp_dir_name' ) ? $this->get_temp_dir_name( $this->get_filename_only( $template ) ) : "pro";
 		$show_cat_thumb = isset( $settings[ 'eael_woo_product_gallery_terms_thumb' ] ) && 'yes' === $settings[ 'eael_woo_product_gallery_terms_thumb' ];
 
-		echo '<ul class="eael-cat-tab" data-layout="' . $settings[ "eael_product_gallery_items_layout" ] . '" data-template=' . json_encode( [ 'dir' => $dir_name, 'file_name' =>
+		echo '<ul class="eael-cat-tab" data-layout="' . esc_attr( $settings[ "eael_product_gallery_items_layout" ] ) . '" data-template=' . json_encode( [ 'dir' => $dir_name, 'file_name' =>
 				$this->get_filename_only( $template ), 'name'                                                                                        => $this->process_directory_name() ], 1 ) . '  data-nonce="' . wp_create_nonce( 'eael_product_gallery' ) . '" data-page-id="' . $this->page_id . '" data-widget-id="' . $this->get_id() . '" data-widget="' . $this->get_id() . '" data-class="' . get_class( $this ) . '" data-args="' . http_build_query( $args ) . '" data-page="1">';
 
 		if ( $settings[ 'eael_woo_product_gallery_terms_show_all' ] == 'yes' ) {

From 2c441eef146f9ec33bc31a185a6c1035632d901a Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:58:20 +0600
Subject: [PATCH 17/22] escape attribute -- pricing table

---
 includes/Elements/Pricing_Table.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/Elements/Pricing_Table.php b/includes/Elements/Pricing_Table.php
index c8a6dba35..00795407c 100644
--- a/includes/Elements/Pricing_Table.php
+++ b/includes/Elements/Pricing_Table.php
@@ -2124,10 +2124,10 @@ public function render_pricing_list_icon( $settings, $item ){
                         <?php Icons_Manager::render_icon( $item['eael_pricing_table_list_icon_new'], [ 'aria-hidden' => 'true' ] ); ?>
 <!--                                    <img src="--><?php //echo $item['eael_pricing_table_list_icon_new']['value']['url']; ?><!--" alt="--><?php //echo esc_attr(get_post_meta($item['eael_pricing_table_list_icon_new']['value']['id'], '_wp_attachment_image_alt', true)); ?><!--" />-->
                     <?php else : ?>
-                        <i class="<?php echo $item['eael_pricing_table_list_icon_new']['value']; ?>"></i>
+                        <i class="<?php echo esc_attr( $item['eael_pricing_table_list_icon_new']['value'] ); ?>"></i>
                     <?php endif; ?>
                 <?php } else { ?>
-                    <i class="<?php echo $item['eael_pricing_table_list_icon']; ?>"></i>
+                    <i class="<?php echo esc_attr( $item['eael_pricing_table_list_icon'] ); ?>"></i>
                 <?php } ?>
             </span>
 

From ff3c692f2deb7c46b6a488992c74c0463f2e275d Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Sun, 18 Feb 2024 14:58:52 +0600
Subject: [PATCH 18/22] escape img src -- betterdocs category grid

---
 includes/Template/Betterdocs-Category-Grid/Layout_2.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Template/Betterdocs-Category-Grid/Layout_2.php b/includes/Template/Betterdocs-Category-Grid/Layout_2.php
index 00fd9d166..024b61b60 100644
--- a/includes/Template/Betterdocs-Category-Grid/Layout_2.php
+++ b/includes/Template/Betterdocs-Category-Grid/Layout_2.php
@@ -48,7 +48,7 @@
 
                     echo '<li>';
                     if (isset($settings['list_icon']['value']['url']) && !empty($settings['list_icon']['value']['url'])) {
-                        echo '<img class="eael-bd-cg-post-list-icon" src="' . $settings['list_icon']['value']['url'] . '" />';
+                        echo '<img class="eael-bd-cg-post-list-icon" src="' . esc_url( $settings['list_icon']['value']['url'] ). '" />';
                     } else {
                         echo '<i class="' . esc_attr( $settings['list_icon']['value'] ) . ' eael-bd-cg-post-list-icon"></i>';
                     }

From 2e51097e13490222cd7b40bacb511044dd5fed7c Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Mon, 19 Feb 2024 11:08:48 +0600
Subject: [PATCH 19/22] url and attribute escaped for all other places

---
 includes/Elements/Advanced_Data_Table.php                   | 4 ++--
 includes/Template/Betterdocs-Category-Box/Layout_2.php      | 2 +-
 .../Template/Betterdocs-Category-Box/Layout_Default.php     | 2 +-
 includes/Template/Betterdocs-Category-Grid/Layout_2.php     | 2 +-
 .../Template/Betterdocs-Category-Grid/Layout_Default.php    | 2 +-
 includes/Traits/Twitter_Feed.php                            | 6 +++---
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/includes/Elements/Advanced_Data_Table.php b/includes/Elements/Advanced_Data_Table.php
index a65855be6..4beff30b9 100644
--- a/includes/Elements/Advanced_Data_Table.php
+++ b/includes/Elements/Advanced_Data_Table.php
@@ -1649,11 +1649,11 @@ public function ninja_integration()
                     }
 
                     if ($th['data_type'] == 'image') {
-                        $html .= '<td>' . (isset($tr[$th['key']]['image_thumb']) ? '<a href="' . $tr[$th['key']]['image_full'] . '"><img src="' . $tr[$th['key']]['image_thumb'] . '"></a>' : '') . '</td>';
+                        $html .= '<td>' . (isset($tr[$th['key']]['image_thumb']) ? '<a href="' . esc_url( $tr[$th['key']]['image_full'] ) . '"><img src="' . esc_url( $tr[$th['key']]['image_thumb'] ) . '"></a>' : '') . '</td>';
                     } elseif ($th['data_type'] == 'selection') {
                         $html .= '<td>' . (!empty($tr[$th['key']]) ? implode((array) $tr[$th['key']], ', ') : '') . '</td>';
                     } elseif ($th['data_type'] == 'button') {
-                        $html .= '<td>' . (!empty($tr[$th['key']]) ? '<a href="' . $tr[$th['key']] . '" class="button" target="' . $th['link_target'] . '">' . $th['button_text'] . '</a>' : '') . '</td>';
+                        $html .= '<td>' . (!empty($tr[$th['key']]) ? '<a href="' . esc_url( $tr[$th['key']] ) . '" class="button" target="' . esc_attr( $th['link_target'] ) . '">' . $th['button_text'] . '</a>' : '') . '</td>';
                     } else {
 	                    $html .= '<td>' . ( isset( $tr[ $th['key'] ] ) ? $tr[ $th['key'] ] : '' ) . '</td>';
                     }
diff --git a/includes/Template/Betterdocs-Category-Box/Layout_2.php b/includes/Template/Betterdocs-Category-Box/Layout_2.php
index e10fa5656..b9f2bcd12 100644
--- a/includes/Template/Betterdocs-Category-Box/Layout_2.php
+++ b/includes/Template/Betterdocs-Category-Box/Layout_2.php
@@ -16,7 +16,7 @@
     $button_link = get_term_link($term->slug, 'doc_category');
 }
 
-echo '<a href="' . $button_link . '" class="eael-better-docs-category-box-post layout__2">';
+echo '<a href="' . esc_url( $button_link ) . '" class="eael-better-docs-category-box-post layout__2">';
 echo '<div class="eael-bd-cb-inner">';
 
 if ($settings['show_icon']) {
diff --git a/includes/Template/Betterdocs-Category-Box/Layout_Default.php b/includes/Template/Betterdocs-Category-Box/Layout_Default.php
index 7092c906e..459456d85 100644
--- a/includes/Template/Betterdocs-Category-Box/Layout_Default.php
+++ b/includes/Template/Betterdocs-Category-Box/Layout_Default.php
@@ -16,7 +16,7 @@
     $button_link = get_term_link($term->slug, 'doc_category');
 }
 
-echo '<a href="' . $button_link . '" class="eael-better-docs-category-box-post">
+echo '<a href="' . esc_url( $button_link ) . '" class="eael-better-docs-category-box-post">
     <div class="eael-bd-cb-inner">';
 
     if ($settings['show_icon']) {
diff --git a/includes/Template/Betterdocs-Category-Grid/Layout_2.php b/includes/Template/Betterdocs-Category-Grid/Layout_2.php
index 024b61b60..6409ae503 100644
--- a/includes/Template/Betterdocs-Category-Grid/Layout_2.php
+++ b/includes/Template/Betterdocs-Category-Grid/Layout_2.php
@@ -143,7 +143,7 @@
                     $button_link = get_term_link($term->slug, 'doc_category');
                 }
 
-                echo '<a class="eael-bd-cg-button" href="' . $button_link . '">';
+                echo '<a class="eael-bd-cg-button" href="' . esc_url( $button_link ) . '">';
 
                 if ($settings['icon_position'] === 'before') {
                     if (isset($settings['button_icon']['value']['url']) && !empty($settings['button_icon']['value']['url'])) {
diff --git a/includes/Template/Betterdocs-Category-Grid/Layout_Default.php b/includes/Template/Betterdocs-Category-Grid/Layout_Default.php
index 42a5534ee..4878e73fb 100644
--- a/includes/Template/Betterdocs-Category-Grid/Layout_Default.php
+++ b/includes/Template/Betterdocs-Category-Grid/Layout_Default.php
@@ -196,7 +196,7 @@
                     $button_link = get_term_link($term->slug, 'doc_category');
                 }
 
-                echo '<a class="eael-bd-cg-button" href="' . $button_link . '">';
+                echo '<a class="eael-bd-cg-button" href="' . esc_url( $button_link ) . '">';
 
                 if ($settings['icon_position'] === 'before') {
                     if (isset($settings['button_icon']['value']['url']) && !empty($settings['button_icon']['value']['url'])) {
diff --git a/includes/Traits/Twitter_Feed.php b/includes/Traits/Twitter_Feed.php
index 99f184ca2..ac8e34ef2 100644
--- a/includes/Traits/Twitter_Feed.php
+++ b/includes/Traits/Twitter_Feed.php
@@ -208,7 +208,7 @@ public function twitter_feed_render_items($id, $settings, $class = '')
                         
                         if ($settings['eael_twitter_feed_show_avatar'] == 'true' && ! empty( $user_profile_image_url_https ) ) {
                             $html .= '<a class="eael-twitter-feed-item-avatar avatar-' . $settings['eael_twitter_feed_avatar_style'] . '" href="//twitter.com/' . $settings['eael_twitter_feed_ac_name'] . '" target="_blank">
-                                <img src="' . $user_profile_image_url_https . '">
+                                <img src="' . esc_url( $user_profile_image_url_https ) . '">
                             </a>';
                         }
 
@@ -262,10 +262,10 @@ public function twitter_feed_render_items($id, $settings, $class = '')
 
                             if ($settings['eael_twitter_feed_show_read_more'] == 'true' && ! empty( $item_user_screen_name ) ) {
 	                        $read_more = !empty( $settings[ 'eael_twitter_feed_show_read_more_text' ] ) ? $settings[ 'eael_twitter_feed_show_read_more_text' ] : __( 'Read More', 'essential-addons-for-elementor-lite' );
-                            $html .= '<a href="//twitter.com/' . $item_user_screen_name . '/status/' . $item['id_str'] . '" target="_blank" class="read-more-link">'.$read_more.' <i class="fas fa-angle-double-right"></i></a>';
+                            $html .= '<a href="//twitter.com/' . esc_attr( $item_user_screen_name ) . '/status/' . esc_attr( $item['id_str'] ) . '" target="_blank" class="read-more-link">'. esc_html( $read_more ).' <i class="fas fa-angle-double-right"></i></a>';
                         }
                     $html .= '</div>
-                    ' . ( isset( $media[0] ) && $settings['eael_twitter_feed_media'] == 'true' ? ( $media[0]['type'] == 'photo' ? '<img src="' . $media[0]['media_url_https'] . '">' : '' ) : '' ) . '
+                    ' . ( isset( $media[0] ) && $settings['eael_twitter_feed_media'] == 'true' ? ( $media[0]['type'] == 'photo' ? '<img src="' . esc_url( $media[0]['media_url_https'] ) . '">' : '' ) : '' ) . '
                 </div>
 			</div>';
         }

From 46cf69577ae2bc9e5df832100b94c0229787b822 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Mon, 19 Feb 2024 11:16:09 +0600
Subject: [PATCH 20/22] rename asset deploy action name

---
 .github/workflows/assets.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/assets.yml b/.github/workflows/assets.yml
index 7166e67d3..0af2797e0 100644
--- a/.github/workflows/assets.yml
+++ b/.github/workflows/assets.yml
@@ -1,5 +1,5 @@
 # Deploy to WP.org
-name: Deploy to WordPress.org
+name: Deploy to WordPress.org readme.txt and assets only
 
 on:
   push:

From b62af198aabda10396258f93582e006c2cb06995 Mon Sep 17 00:00:00 2001
From: Linkon Miyan <rudlinkon@gmail.com>
Date: Mon, 19 Feb 2024 11:19:19 +0600
Subject: [PATCH 21/22] added WordPress archive generator action

---
 .github/workflows/build-archive.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 .github/workflows/build-archive.yml

diff --git a/.github/workflows/build-archive.yml b/.github/workflows/build-archive.yml
new file mode 100644
index 000000000..6d7ff664d
--- /dev/null
+++ b/.github/workflows/build-archive.yml
@@ -0,0 +1,17 @@
+name: Generate WordPress Archive
+on:
+  workflow_dispatch
+
+jobs:
+  generate-archive:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Generating zip
+        uses: rudlinkon/action-wordpress-build-zip@master
+        with:
+          retention-days: 1 # Optional; defaults to 3
+          npm-run-build: true # Optional; defaults to false
+          node-version: 14 # Optional; defaults to 16
\ No newline at end of file

From c6e2af5bd6e2733f5bca33fafa0434336fc7b159 Mon Sep 17 00:00:00 2001
From: Khan-Rafin-Ahmed <khanrafinahmed@gmail.com>
Date: Mon, 19 Feb 2024 14:34:15 +0600
Subject: [PATCH 22/22] Version 5.9.10

---
 essential_adons_elementor.php | 4 ++--
 readme.txt                    | 8 +++++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/essential_adons_elementor.php b/essential_adons_elementor.php
index 0720c85ca..d05de3b9e 100755
--- a/essential_adons_elementor.php
+++ b/essential_adons_elementor.php
@@ -4,7 +4,7 @@
  * Description: The Essential plugin you install after Elementor! Packed with 40+ stunning free elements including Advanced Data Table, Event Calendar, Filterable Gallery, WooCommerce, and many more.
  * Plugin URI: https://essential-addons.com/elementor/
  * Author: WPDeveloper
- * Version: 5.9.9
+ * Version: 5.9.10
  * Author URI: https://wpdeveloper.com/
  * Text Domain: essential-addons-for-elementor-lite
  * Domain Path: /languages
@@ -27,7 +27,7 @@
 define('EAEL_PLUGIN_BASENAME', plugin_basename(__FILE__));
 define('EAEL_PLUGIN_PATH', trailingslashit(plugin_dir_path(__FILE__)));
 define('EAEL_PLUGIN_URL', trailingslashit(plugins_url('/', __FILE__)));
-define('EAEL_PLUGIN_VERSION', '5.9.9');
+define('EAEL_PLUGIN_VERSION', '5.9.10');
 define('EAEL_ASSET_PATH', wp_upload_dir()['basedir'] . '/essential-addons-elementor');
 define('EAEL_ASSET_URL', wp_upload_dir()['baseurl'] . '/essential-addons-elementor');
 /**
diff --git a/readme.txt b/readme.txt
index fae96e030..d98ab5daa 100755
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Tags: elementor, elements, addons, elementor addons, elementor widget, elementor
 Requires at least: 5.0
 Tested up to: 6.4
 Requires PHP: 7.0
-Stable tag: 5.9.9
+Stable tag: 5.9.10
 License: GPLv3
 License URI: https://opensource.org/licenses/GPL-3.0
 
@@ -297,6 +297,12 @@ Your existing elements/content will work with premium version. So you won't lose
 
 == Changelog ==
 
+= 5.9.10 - 19/02/2024 =
+
+- Fixed: EA Post Grid | Show post terms not showing from Tags
+- Improved: Security Enhancement
+- Few minor bug fixes & improvements
+
 = 5.9.9 - 11/02/2024 =
 
 - Improved: Security Enhancement