v1.4.2: preserve data-* and module attributes on snippet tags

wp_kses was stripping data-website-id, data-id, async, defer, nomodule,
and other valid attributes from script/style/link tags in Header & Footer
snippets for non-admin users. Unified the two separate allowed-tags lists
(output and save) into a single snippet_allowed_tags() method.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: wpgaurav

README.md

@@ -2,7 +2,7 @@
 
 All-in-one WordPress optimization toolkit with 15+ modules for performance, security, SEO, and content management. Built with modern WordPress coding standards and a clean module-based dashboard. Optimized for performance with lazy-loading, static property caching, and intelligent transients.
 
-**Version:** 1.4.0
+**Version:** 1.4.2
 **License:** GPL-2.0-or-later
 **Text Domain:** `functionalities`
 **Pricing:** Free
@@ -427,6 +427,17 @@ Example module definition:
 
 ## Changelog
 
+### 1.4.2
+- **Fixed**: `wp_kses` now preserves `data-*` attributes on `<script>`, `<style>`, and `<link>` tags in Header & Footer snippets.
+- **Fixed**: `async`, `defer`, `nomodule`, `id`, `nonce`, `crossorigin`, and `as` attributes no longer stripped from snippet tags for non-admin users.
+- **Fixed**: Unified allowed-tags list between snippet output and save sanitization to prevent attribute drift.
+
+### 1.4.1
+- **Added**: Opt-in "Delete all plugin data when uninstalling" checkbox on the dashboard.
+- **Fixed**: Replaced all direct `file_put_contents` calls with `WP_Filesystem` API.
+- **Fixed**: Extracted duplicate CSS sanitization into a shared trait.
+- **Fixed**: Removed `sslverify => false` from loopback HTTP requests.
+
 ### 1.4.0
 - **Added**: Bricks Builder font integration — custom fonts appear in Bricks typography picker and load inside the builder canvas.
 - **Added**: PWA module prefills app name, short name, description, and icons from WordPress Settings and Site Icon.

functionalities.php

@@ -3,7 +3,7 @@
  * Plugin Name:       Dynamic Functionalities
  * Plugin URI:        https://functionalities.dev
  * Description:       All-in-one WordPress optimization toolkit. 15+ modules for performance, security, SEO, and content management.
- * Version:           1.4.1
+ * Version:           1.4.2
  * Author:            Gaurav Tiwari
  * Author URI:        https://gauravtiwari.org
  * License:           GPL-2.0-or-later
@@ -19,7 +19,7 @@
 
 // Define constants.
 if (!defined('FUNCTIONALITIES_VERSION')) {
-	define('FUNCTIONALITIES_VERSION', '1.4.1');
+	define('FUNCTIONALITIES_VERSION', '1.4.2');
 }
 if (!defined('FUNCTIONALITIES_FILE')) {
 	define('FUNCTIONALITIES_FILE', __FILE__);

includes/admin/trait-admin-sanitizers.php

@@ -152,15 +152,7 @@ public static function sanitize_snippets( $input ) : array {
 			$out['ga4_id'] = $ga4;
 		}
 
-		$allowed_tags = array(
-			'script'   => array( 'src' => true, 'type' => true, 'async' => true, 'defer' => true, 'crossorigin' => true, 'integrity' => true, 'data-*' => true ),
-			'style'    => array( 'type' => true, 'media' => true ),
-			'link'     => array( 'rel' => true, 'href' => true, 'as' => true, 'crossorigin' => true, 'media' => true, 'type' => true ),
-			'meta'     => array( 'name' => true, 'content' => true, 'property' => true, 'http-equiv' => true ),
-			'noscript' => array(),
-			'div'      => array( 'id' => true, 'class' => true, 'style' => true ),
-			'span'     => array( 'id' => true, 'class' => true, 'style' => true ),
-		);
+		$allowed_tags = \Functionalities\Features\Snippets::snippet_allowed_tags();
 
 		foreach ( array( 'header', 'body_open', 'footer' ) as $location ) {
 			if ( empty( $input[ $location ] ) || ! \is_array( $input[ $location ] ) ) {

includes/features/class-snippets.php

@@ -9,7 +9,7 @@
  * @package    Functionalities
  * @subpackage Features
  * @since      0.2.0
- * @version    1.4.0
+ * @version    1.4.2
  */
 
 namespace Functionalities\Features;
@@ -373,6 +373,75 @@ public static function output_body_open() : void {
 		self::output_snippets( 'body_open', 'functionalities_snippets_body_open_code', 'Custom Body Open Code' );
 	}
 
+	/**
+	 * Allowed HTML tags and attributes for code snippets.
+	 *
+	 * Single source of truth used by both escape_snippet() (output) and
+	 * sanitize_snippets() (save) to ensure consistent filtering.
+	 *
+	 * @since 1.4.2
+	 *
+	 * @return array Allowed tags array for wp_kses().
+	 */
+	public static function snippet_allowed_tags(): array {
+		return array(
+			'script'   => array(
+				'type'        => true,
+				'src'         => true,
+				'async'       => true,
+				'defer'       => true,
+				'id'          => true,
+				'crossorigin' => true,
+				'integrity'   => true,
+				'nonce'       => true,
+				'nomodule'    => true,
+				'data-*'      => true,
+			),
+			'noscript' => array(),
+			'style'    => array(
+				'type'  => true,
+				'media' => true,
+				'id'    => true,
+				'nonce' => true,
+				'data-*' => true,
+			),
+			'link'     => array(
+				'rel'         => true,
+				'href'        => true,
+				'type'        => true,
+				'media'       => true,
+				'as'          => true,
+				'crossorigin' => true,
+				'id'          => true,
+				'data-*'      => true,
+			),
+			'meta'     => array(
+				'name'       => true,
+				'content'    => true,
+				'charset'    => true,
+				'http-equiv' => true,
+				'property'   => true,
+			),
+			'img'      => array(
+				'src'     => true,
+				'alt'     => true,
+				'width'   => true,
+				'height'  => true,
+				'loading' => true,
+			),
+			'iframe'   => array(
+				'src'             => true,
+				'width'           => true,
+				'height'          => true,
+				'frameborder'     => true,
+				'allow'           => true,
+				'allowfullscreen' => true,
+				'loading'         => true,
+				'style'           => true,
+			),
+		);
+	}
+
 	/**
 	 * Escape a code snippet for safe output.
 	 *
@@ -391,56 +460,7 @@ private static function escape_snippet( string $code ): string {
 			return $code;
 		}
 
-		return self::kses_with_styles(
-			$code,
-			array(
-				'script'   => array(
-					'type'        => true,
-					'src'         => true,
-					'async'       => true,
-					'defer'       => true,
-					'id'          => true,
-					'crossorigin' => true,
-					'integrity'   => true,
-					'nonce'       => true,
-				),
-				'noscript' => array(),
-				'style'    => array(
-					'type'  => true,
-					'media' => true,
-				),
-				'link'     => array(
-					'rel'   => true,
-					'href'  => true,
-					'type'  => true,
-					'media' => true,
-				),
-				'meta'     => array(
-					'name'       => true,
-					'content'    => true,
-					'charset'    => true,
-					'http-equiv' => true,
-					'property'   => true,
-				),
-				'img'      => array(
-					'src'     => true,
-					'alt'     => true,
-					'width'   => true,
-					'height'  => true,
-					'loading' => true,
-				),
-				'iframe'   => array(
-					'src'             => true,
-					'width'           => true,
-					'height'          => true,
-					'frameborder'     => true,
-					'allow'           => true,
-					'allowfullscreen' => true,
-					'loading'         => true,
-					'style'           => true,
-				),
-			)
-		);
+		return self::kses_with_styles( $code, self::snippet_allowed_tags() );
 	}
 
 	/**

readme.txt

@@ -5,7 +5,7 @@ Tags: performance, security, seo, redirection, cleanup
 Requires at least: 5.8
 Tested up to: 7.0
 Requires PHP: 7.4
-Stable tag: 1.4.1
+Stable tag: 1.4.2
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -134,6 +134,12 @@ Before uninstalling, go to the Functionalities dashboard and check **"Delete all
 
 == Changelog ==
 
+= 1.4.2 =
+* Fixed: `wp_kses` now preserves `data-*` attributes on `<script>`, `<style>`, and `<link>` tags in Header & Footer snippets
+* Fixed: `async`, `defer`, `nomodule`, `id`, `nonce`, `crossorigin`, and `as` attributes no longer stripped from snippet tags for non-admin users
+* Fixed: Unified allowed-tags list between snippet output and save sanitization to prevent attribute drift
+* Fixed: README.md version was outdated (still showed 1.4.0)
+
 = 1.4.1 =
 * Added: Opt-in "Delete all plugin data when uninstalling" checkbox on the dashboard — removes all options, post metadata, transients, and files on uninstall
 * Fixed: Replaced all direct file_put_contents calls with WP_Filesystem API across Task Manager, Redirect Manager, and JSON file creation
@@ -253,6 +259,9 @@ Before uninstalling, go to the Functionalities dashboard and check **"Delete all
 
 == Upgrade Notice ==
 
+= 1.4.2 =
+Fixes `data-*` and other attributes being stripped from script/style/link tags in Header & Footer snippets for non-admin users.
+
 = 1.4.1 =
 Code quality and plugin review compliance: WP_Filesystem for all file writes, comprehensive uninstall cleanup (opt-in), shared CSS sanitization trait, and minor fixes.