diff --git a/src/wp-includes/shortcodes.php b/src/wp-includes/shortcodes.php index 8132ebc15a1a3..73cadc6aac9f8 100644 --- a/src/wp-includes/shortcodes.php +++ b/src/wp-includes/shortcodes.php @@ -757,7 +757,9 @@ function strip_shortcodes( $content ) { function strip_shortcode_tag( $m ) { // Allow [[foo]] syntax for escaping a tag. if ( '[' === $m[1] && ']' === $m[6] ) { - return substr( $m[0], 1, -1 ); + // Convert escaped shortcode to HTML entities to prevent unexpected execution + // when do_shortcode() is called later (e.g., in excerpt generation). + return '[' . substr( $m[0], 2, -2 ) . ']'; } return $m[1] . $m[6];