SEO TITLE: wp_kses HTML API: 7 Best Proven Changes Developers Must Test
META DESCRIPTION: The wp_kses HTML API rewrite replaces WordPress’s regex sanitizer with a spec-based parser for 7.2 or 7.3. What changes, what breaks, and how to test now.
FOCUS KEYWORD: wp_kses html api

WordPress Is Overhauling wp_kses() with a New HTML API-Based Implementation

WordPress Core is replacing the sanitization logic behind wp_kses() — the function developers rely on to clean untrusted HTML — with a new parser-based implementation built on the HTML API. The “Progress Report: wp_kses()” published October 7, 2026 on Make WordPress Core (tracked in Trac ticket #66208, implemented in PR #13271) describes an in-place upgrade targeting WordPress 7.2 or 7.3, with no function-signature changes. Because the wp_kses HTML API rewrite changes the exact bytes the function outputs, theme and plugin developers are being asked to test now — before the beta window closes.

What Happened: The wp_kses HTML API Rewrite Explained

In plain English, wp_kses() is WordPress’s HTML bouncer: you hand it untrusted markup and a list of allowed tags, and it strips everything else. The original KSES subsystem was written before HTML5 formalized how browsers parse markup, and it works as a chain of regex and string processing — clever, but fundamentally guessing at structure. The wp_kses HTML API rewrite replaces that chain with a real structural parser built on WordPress’s HTML API. The new parser is described as more robust, faster, and less memory-intensive, and the legacy implementation is kept “for now” — it could disappear in a future release, possibly as early as WordPress 7.2.0 if testing goes well.

Here are the seven behavioral changes developers need to know about the wp_kses HTML API implementation:

1. Output is a fresh serialization. Text nodes and syntax tokens are normalized: tags lowercased, attributes double-quoted, character references fully un-escaped and deterministically re-escaped, and no ignored self-closing flags on void elements. Sanitization output becomes predictable at the byte level — which is the point, and also the compatibility risk.

2. Ambiguous ampersands resolve like browsers. &section in a text node now decodes to §ion, exactly as a browser would. Authors should escape & and use semicolons — sloppy entities will render differently than before.

3. Script and style contents are removed with their tags. The legacy implementation removed only the tags, leaving JavaScript and CSS visible as text on the page. The new parser removes the contents of “special atomic elements” too — a genuine security improvement, since leftover script text was a long-standing wart.

4. Incomplete inputs are truncated before ambiguity. Where the legacy parser escaped the tail of a truncated document, the new one discards it. Unmatched atomic elements are removed entirely if incomplete.

5. Malformed SVG and MathML are rejected. The parser goes as far as it can with certainty, then aborts and returns the input up to where the SVG or MathML begins — rather than guessing through markup it cannot verify.

6. Hard limits on hostile constructs. Malformed HTML comments, documents containing NOSCRIPT, and elements with confusable content are rejected; CDATA sections and PLAINTEXT contents are transformed into escaped text.

7. Legacy patterns that must keep working are preserved. Notably, “unbalanced tags” passed through wp_kses() remain unbalanced — unchanged — because established code concatenates separately-sanitized chunks. The team deliberately kept that behavior so common plugin patterns do not break.

There is also an escape hatch: the temporary filter wp_kses_force_legacy_parser restores legacy behavior (add_filter( 'wp_kses_force_legacy_parser', '__return_true' );). The progress report is explicit that this is a stopgap, not a fix — report breakages on Trac ticket #66208 instead of hiding behind the filter.

Who Is Affected by the wp_kses HTML API Change

Plugin and theme developers are the front line. If your code sanitizes HTML and then compares, stores, hashes, caches, snapshot-tests, or otherwise depends on the exact output bytes, the wp_kses HTML API rewrite will change your results — normalization is byte-level. Core published a tool for checking whether the new parser affects a site’s HTML; use it. Site owners are affected indirectly: a plugin that snapshot-tests sanitized output could start failing after the core update, so the update deserves a staging pass, not a one-click deploy. Security teams get the upside: a real parser closes whole classes of sanitization bypasses that regex-based KSES could never fully kill.

Why the wp_kses HTML API Overhaul Matters

Sanitization is one of those things that is either exactly right or dangerously wrong, and regex was never the right tool for HTML. The wp_kses HTML API rewrite matters for two reasons. First, security: browsers parse HTML by spec, attackers craft markup by spec, and now WordPress sanitizes by spec too — closing the gap where bypasses lived. Removing script and style contents with their tags, rejecting malformed SVG/MathML, and resolving ampersands like browsers do are all moves toward “what the browser sees is what was sanitized.” Second, performance: the new parser is faster and less memory-intensive than the string-processing chain it replaces, which matters on high-traffic sites that sanitize on every request. This is core infrastructure getting quietly, correctly rebuilt.

What to Do Now: 5 Steps for Developers and Site Owners

1. Developers: run the HTML-checker tool now. Core published a tool that shows whether the new parser changes your HTML. Run your plugin and theme output through it during the beta window — WordPress 7.2 beta 1 lands October 20, 2026, with final planned December 8.
2. Audit byte-dependent code. Search your codebase for anything that compares, hashes, caches, or snapshot-tests wp_kses() output. Those are the exact patterns the progress report flags. Fix the assumption, not the output.
3. Do not ship with the legacy filter. wp_kses_force_legacy_parser is a temporary stopgap for emergencies. If you need it, you have found a bug — report it on Trac ticket #66208 so the parser improves before release.
4. Site owners: stage the 7.2 update. When 7.2 (or 7.3) ships the wp_kses HTML API implementation, update on staging first and watch for plugins that behave differently around sanitized content — comment systems, importers, and form builders are the usual suspects.
5. Escape your ampersands. The browser-like ampersand handling is the change most likely to surprise content authors: &section becomes §ion. If your content contains bare ampersands, clean them up now.

FAQ

When will the wp_kses HTML API rewrite ship?
It is targeting WordPress 7.2 or 7.3, depending on what the testing period turns up. The legacy implementation is kept for now and could disappear as early as 7.2.0 if testing goes well.

Will the wp_kses HTML API change break my plugin?
It changes output bytes, not function signatures. If your code depends on the exact bytes of sanitized output — comparisons, hashes, caches, snapshot tests — test it now and report issues on Trac ticket #66208.

Is there a way to keep the old wp_kses behavior?
Temporarily: the wp_kses_force_legacy_parser filter restores legacy parsing. Core says to treat it as a stopgap and report breakages rather than relying on it.

Does the new wp_kses HTML API improve security?
Yes. A spec-based parser removes whole classes of sanitization bypasses, and the new implementation also removes script and style contents along with their tags instead of leaving the code visible as text.

Conclusion

The wp_kses HTML API overhaul is the kind of change that rarely makes headlines and quietly makes WordPress safer: a regex-and-string sanitizer written before HTML5, rebuilt on a real parser that thinks like a browser. Targeting WordPress 7.2 or 7.3, it normalizes output at the byte level, kills leftover script text, rejects markup it cannot verify, and runs faster doing it. The cost is a testing burden that falls squarely on developers — anyone whose code depends on exact sanitizer output needs to run the checker tool and report issues before the beta window closes. For site owners, the action is simpler: stage major updates, keep plugins current, and let professionals handle the compatibility work. Our website care plans cover exactly that — updates tested, security monitored, and compatibility handled — and if your site needs a modern, well-built foundation, our professional web design team delivers it. Questions? contact us — Qamar Digital Ventures LLC keeps WordPress sites secure through every core change.

Sources

• Make WordPress Core — “Progress Report: wp_kses()” (October 7, 2026): https://make.wordpress.org/core/2026/10/07/progress-report-wp_kses/
• WordPress Developer Blog — “What’s new for developers, October 2026”: https://developer.wordpress.org/news/2026/10/whats-new-for-developers-october-2026/
• WPTips — “WordPress 7.2 rebuilds wp_kses on the HTML API”: https://wptips.com/wordpress/wordpress-7-2-rebuilds-wp_kses-on-the-html-api/