Double wp_unslash() on options data.

Dan0sz · coderabbitai[bot] · web-flow · commit cd7dbdcf9d6d · 2026-03-26T17:00:04.000+01:00
Co-authored-by: coderabbitai[bot] &lt;136622811+coderabbitai[bot]@users.noreply.github.com&gt;
diff --git a/src/Ajax.php b/src/Ajax.php
@@ -284,7 +284,7 @@ public function bulk_toggle_options() {
 			wp_send_json_error( __( 'Not allowed.', 'plausible-analytics' ), 403 );
 		}
 
-		$options = json_decode( wp_unslash( $post_data['options'] ), true );
+		$options = json_decode( $post_data['options'], true );
 
 		if ( empty( $options ) ) {
 			wp_send_json_error( __( 'No options found.', 'plausible-analytics' ), 400 );

Original file line number	Diff line number	Diff line change
`@@ -284,7 +284,7 @@ public function bulk_toggle_options() {`
`284`	`284`	`wp_send_json_error( __( 'Not allowed.', 'plausible-analytics' ), 403 );`
`285`	`285`	`}`
`286`	`286`
`287`		`- $options = json_decode( wp_unslash( $post_data['options'] ), true );`
	`287`	`+ $options = json_decode( $post_data['options'], true );`
`288`	`288`
`289`	`289`	`if ( empty( $options ) ) {`
`290`	`290`	`wp_send_json_error( __( 'No options found.', 'plausible-analytics' ), 400 );`