From c553ebb8ad33d63a429c7b7c3e58c8829d8b3a64 Mon Sep 17 00:00:00 2001
From: haritpanchal <panchalharit007@gmail.com>
Date: Fri, 11 Sep 2026 15:05:40 +0530
Subject: [PATCH] Upgrade/Install: Use wp_print_inline_script_tag() in
 Bulk_Upgrader_Skin.

Continuing the migration away from manually constructed SCRIPT markup,
the four raw one-liner script tags in Bulk_Upgrader_Skin::error(),
::before(), and ::after() now print through wp_print_inline_script_tag(),
so wp_inline_script_attributes can attach a per-request nonce to these
as in the other admin screens already migrated.

The dynamic jQuery selector is now passed through wp_json_encode() with
JSON_HEX_TAG | JSON_UNESCAPED_SLASHES instead of esc_js() string
concatenation, consistent with the fix applied to similar call sites in
[63481]: esc_js() runs the value through _wp_specialchars(), which is
unnecessary here since the value is placed inside a JS string literal
rather than HTML attribute context.

See #59446.
---
 .../includes/class-bulk-upgrader-skin.php     | 28 ++++++++++++++++---
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/src/wp-admin/includes/class-bulk-upgrader-skin.php b/src/wp-admin/includes/class-bulk-upgrader-skin.php
index f406d160e4a57..9845f1191c517 100644
--- a/src/wp-admin/includes/class-bulk-upgrader-skin.php
+++ b/src/wp-admin/includes/class-bulk-upgrader-skin.php
@@ -141,7 +141,12 @@ public function error( $errors ) {
 			}
 			$this->error = implode( ', ', $messages );
 		}
-		echo '<script>jQuery(\'.waiting-' . esc_js( $this->upgrader->update_current ) . '\').hide();</script>';
+		wp_print_inline_script_tag(
+			sprintf(
+				'jQuery( %s ).hide();',
+				wp_json_encode( '.waiting-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+			)
+		);
 	}
 
 	/**
@@ -172,7 +177,12 @@ public function bulk_footer() {
 	public function before( $title = '' ) {
 		$this->in_loop = true;
 		printf( '<h2>' . $this->upgrader->strings['skin_before_update_header'] . ' <span class="spinner waiting-' . $this->upgrader->update_current . '"></span></h2>', $title, $this->upgrader->update_current, $this->upgrader->update_count );
-		echo '<script>jQuery(\'.waiting-' . esc_js( $this->upgrader->update_current ) . '\').css("display", "inline-block");</script>';
+		wp_print_inline_script_tag(
+			sprintf(
+				'jQuery( %s ).css( "display", "inline-block" );',
+				wp_json_encode( '.waiting-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+			)
+		);
 		// This progress messages div gets moved via JavaScript when clicking on "More details.".
 		echo '<div class="update-messages hide-if-js" id="progress-' . esc_attr( $this->upgrader->update_current ) . '"><p>';
 		$this->flush_output();
@@ -200,7 +210,12 @@ public function after( $title = '' ) {
 				)
 			);
 
-			echo '<script>jQuery(\'#progress-' . esc_js( $this->upgrader->update_current ) . '\').show();</script>';
+			wp_print_inline_script_tag(
+				sprintf(
+					'jQuery( %s ).show();',
+					wp_json_encode( '#progress-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+				)
+			);
 		}
 		if ( $this->result && ! is_wp_error( $this->result ) ) {
 			if ( ! $this->error ) {
@@ -210,7 +225,12 @@ public function after( $title = '' ) {
 					'</p></div>';
 			}
 
-			echo '<script>jQuery(\'.waiting-' . esc_js( $this->upgrader->update_current ) . '\').hide();</script>';
+			wp_print_inline_script_tag(
+				sprintf(
+					'jQuery( %s ).hide();',
+					wp_json_encode( '.waiting-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+				)
+			);
 		}
 
 		$this->reset();