# WordPress rewrites wp_kses around the HTML API — plugin sanitisation output can change

WordPress trunk is replacing its long-standing regex-heavy HTML sanitiser with structural parsing. The public function remains, but normalisation, stripped script/style content and incomplete markup behaviour can change for plugins and themes; final release timing is still under discussion.

A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.

- Status: Active
- Published: 2026-10-14T19:44:59+13:00
- Updated: 2026-10-14T19:44:59+13:00
- Categories: Web Development, PHP, WordPress
- Tags: compatibility, HTML sanitisation, security
- Canonical HTML: https://beyondthe.news/dossiers/wordpress-wp-kses-html-api-sanitizer-rewrite-compatibility-2026

## What changed

WordPress core contributor Dennis Snell's October 7 progress report details an HTML API-based reimplementation of wp_kses(), the longstanding HTML filtering and sanitisation function used by WordPress and its plugin ecosystem. Instead of manipulating HTML-like strings through regex and legacy token handling, the replacement structurally parses input and serialises allowed output. The public wp_kses() interface stays the same, but it can lowercase tags, normalise attributes and character references, remove disallowed script/style elements together with their contents, and discard ambiguous truncated input. A temporary wp_kses_force_legacy_parser filter allows opting back into legacy behaviour while compatibility testing continues. The change is in trunk; whether it lands in WordPress 7.2 or slips to 7.3 remains contingent on testing.

## Why it matters

Plugins, themes and publishing integrations routinely pass user-provided markup through wp_kses(). An unchanged PHP function signature does not guarantee unchanged output bytes. Content filters, snapshots, sanitiser unit tests and workflows that inspect sanitised markup can behave differently even where the resulting output is safe. Structural parsing also targets longstanding mismatch risks between server-side filtering and browsers' HTML parsing. For the WordPress plugin ecosystem, that is a meaningful compatibility and security-hardening migration rather than a cosmetic refactor.

## Normalisation changes observable HTML

The replacement serialises parsed markup consistently: tag names can become lowercase, attributes double-quoted and entities decoded then re-escaped. Developers comparing raw HTML strings or expecting legacy malformed-markup repairs should test with representative content, not only valid HTML.

## Disallowed script and style contents now disappear

Under the old default post-context filter, stripping a disallowed script element could leave its text content visible; the new parser removes both element and contents. Incomplete tags at the end of input can be dropped rather than rendered as escaped text. These differences can affect saved content previews, import pipelines and plugin tests without indicating a new vulnerability.

## A temporary compatibility switch exists

The core progress report documents add_filter('wp_kses_force_legacy_parser','__return_true') to select the old implementation temporarily. Maintainers warn the old path can disappear in a future release or even before WordPress 7.2 final, so this should be a diagnostic fallback, not a permanent compatibility strategy.

## Trunk is not a guaranteed shipping release

WordPress Trac ticket #66208 and the upstream pull request track implementation and tests. The current branch milestone and third-party coverage point toward 7.2, but final inclusion is still under consideration. Test against a current development build and recheck beta/RC notes before making release-specific assertions.

## Key details

- Primary developer progress report: October 7, 2026.
- Core Trac ticket #66208; upstream implementation PR #13271.
- wp_kses() public interface unchanged, internal parsing and output serialisation replaced.
- Character references, tag case, attribute quoting and malformed fragments may produce different strings.
- Disallowed script/style content is removed along with its tags, unlike some legacy behaviour.
- Temporary wp_kses_force_legacy_parser opt-out is documented but not guaranteed long term.
- 7.2 versus 7.3 inclusion is not yet final.

## Builder takeaways

- Test plugins/themes that filter or compare wp_kses() output, especially imports, HTML transforms and snapshot assertions.
- Include malformed HTML, unescaped ampersands, scripts/styles, inline SVG/MathML and truncated fragments in compatibility tests.
- Avoid depending on exact raw sanitised markup where semantic equivalence is sufficient.
- Use the legacy filter only as a temporary diagnostic while reporting regressions upstream.
- Treat 7.2 release inclusion as conditional until beta and release-candidate confirmation.

## What to watch

- Final merge and WordPress 7.2 beta/RC decision for Trac #66208.
- Behavioural test failures and downstream plugin/theme regressions.
- Whether the temporary legacy-parser filter is retained for a transition period.
- Measured security and performance results on representative real-world content.

## Uncertainties

- The exact release version is not locked.
- Compatibility impact varies with how each plugin handles sanitised output.
- The developer describes performance and safety improvements but independent cross-plugin performance data is not yet established.

## Sources

- [Progress Report: wp_kses()](https://make.wordpress.org/core/2026/10/07/progress-report-wp_kses/) — Make WordPress Core · primary · 2026-10-07T00:00:00+13:00. Developer's exact output examples, opt-out filter and release uncertainty.
- [WordPress Trac #66208 KSES reimplement using HTML API](https://core.trac.wordpress.org/ticket/66208) — WordPress Core Trac · primary · 2026-10-07T00:00:00+13:00. Implementation issue and proposed milestone.
- [Within WordPress ecosystem roundup](https://withinwp.com/newsletter/official-mcp-is-here-finally-an-overhaul-for-kses-jpeg-xl-cloudflare-beacon-and-more/) — Within WordPress · independent · 2026-10-10T00:00:00+13:00. Independent plugin/theme developer compatibility context; not independent performance validation.