wp_kses (Codex) removes unallowed tags, but it doesn’t remove their content. So, if you have a “{something}”, wp_kses only removes the tags, not the content, returning “{something}”. Thus, this is intended behaviour and your issue doesn’t seem to be a bug.
Related Posts:
- Should I sanitize an email address before passing it to the is_email() function?
- Escaping and sanitizing SVGs in metabox textarea
- What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?
- Reason for Lowercase usernames
- What is the best way to sanitize data?
- Should nonce be sanitized?
- esc_url removes white space. Can I change that to using ‘-‘?
- WP Coding standards – escaping the inescapable?
- What is the difference between strip_tags and wp_filter_nohtml_kses?
- Sanitatizing when using the posts_where hook
- Escape hexadecimals/rgba values
- Must I serialize/sanitize/escape array data before using set_transient?
- Echo JavaScript Safely
- Sanitize array callback for the WordPress Settings API
- How to escape $_GET and check if isset?
- What’s a safe / good way to output HTML safely within WordPress templates?
- Do Not Understand → Rule No. 4: Making Data Safe Is About Context [closed]
- Sanitizing output that contains quotes?
- WP_Customize_Manager: How to get control ID
- How to use wp_filter_oembed_result?
- Sanitization html output itself
- Post text sanitization after publishing/editing – changes are not saved
- wp_set_object_terms() without accents
- Escaping data from database (users table) is necessary?
- Properly sanitize an input field “Name “
- Does it make sense to sanitize the output of an SVG file?
- What is the proper way to sanitize $_POST and $_GET vars?
- Why is sanitize_text_field() selectively trimming data?
- How safe / sanitized is wp_insert_posts()?
- How to get SimplePie fetch_feed without stripping iframe code?
- What’s the difference between esc_* functions?
- Sanitizing integer input for update_post_meta
- Is sanitize_text_field() is enough to save to DB?
- Escaping quotes from shortcode attributes
- how to escape wp_oembed_get for phpcs
- How to sanitize select box values in post meta?
- wp_kses_post only removes tags, but not their content
- Do Cookies Need to be Sanatized Before Being Saved?
- How to allow data:image attribute in src tag during post insert?
- WP Editor strips input placeholder attribute
- Change allowed HTML tags for comments
- I’m confused about URL sanitization in meta boxes
- Coding a plugin on WordPress; when should I sanitize? [duplicate]
- How to save html and text in the database?
- How to allow internal links using wp_kses filtration
- Is default functions like update_post_meta safe to use user inputs?
- Who is responsible for data sanitization in WordPress development?
- Proper use of internationalization
- How to sanitize my cookie name
- Do We Need to Validate, Sanitize, or Filter Simple Numerical Superglobals (Cookies and Post)?
- MITM risk of not sanitizing?
- Which escape function to use when escaping an email or plain text?
- WordPress Settings API – Sanitize Integer
- CSS from textarea in options page to frontend what to do
- How to get rid of shortcodes in post content once and for all
- Make WordPress process admin group comments using $allowedtags
- How can I remove the kses filters when saving a specific post type ? (it breaks my JSON)
- Is it possible to run wp_kses on all posts?
- Why is WordPress Breaking Custom Elements with Hyphens Into Element and Attribute?
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- How to use sanitize_callback?
- Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break
- Are all hooks/functions tied to Kses meant for sanitization?
- sanitize_text_field and apostrophe problem
- Getting error to display radio button value in General Settings page
- Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
- How to allow   with wp_kses()?
- What’s the proper way to sanitize checkbox value sent to the database
- How to escape html generate by a loop
- Inline style HTML attribute is being stripped from all elements of a post
- Can A Post Meta Field Store multiple values that are not in an array?
- esc_attr on get_post_meta [closed]
- Using esc_url_raw with protocols properly
- Trouble creating custom sanitization function for user list dropdown
- Output Sanitation
- How to allow certain PHP functions when using sanitize_callback in the word press customizer
- Display the line breaks in user bio without using html
- Sanitize $_GET variable when comparing
- How can I apply custom sanitization to new usernames?
- How do I sanitize the str_replace function in javascript variables
- Sanitizing textarea for wp_insert_post with TinyMCE enabled or disabled
- Safely store code(html/js..) into database
- Sanitaizing Select Optin For Custom Post Type Metabox in WP
- How to handle complex data with Settings API
- settings api and the data passed in the parameter
- HTML Img with data:image src gets sanitized in admin?
- Sanitizing URL in a WordPress plugin
- Where is the HTML-handler part in the wpdb class?
- WordPress post_content gets deleted in cron after wp_update_post
- Form Sanitization and Validation
- Can we validate data from jquery
- Sanitize html, where to sanitize
- Any ideas how to allow CSS input to perfectly work in the text area with wp_kses?
- Custom-Metaboxes-and-Fields text_url field prepending http://
- Data validation for inline javascript
- oneOf two possible objects in WP REST API?
- How to return responsive images from a sanitize_callback?
- Multisite, but wp_kses_allowed_html only for one subsite?
- how to sanitizing $_POST with the correct way?
- sanitize meta input