Skip to main content
GoodFirstPicks
DashboardIssuesReposLeaderboard

GoodFirstPicks by Leaveitblank © 2026

CreatorRequest a RepoPrivacy PolicyTerms of Service
Existing block level custom CSS in a post breaks when the post is edited by user without unfiltered_html | GoodFirstPicks

Existing block level custom CSS in a post breaks when the post is edited by user without unfiltered_html

WordPress/gutenberg 4 comments 18d ago
View on GitHub
mediumopenScope: somewhat clearSkill match: maybeWordPressJavaScriptReact

Why this is a good first issue

CSS encoding issue requires careful handling of user permissions and data serialization.

AI Summary

The issue involves block-level custom CSS breaking when edited by users without unfiltered_html capabilities. Solutions involve either encoding CSS or removing attributes with warnings, but multisite implications complicate the fix. The problem is well-documented but requires careful implementation due to security and compatibility concerns.

Issue Description

Description

https://github.com/WordPress/gutenberg/pull/73959 introduced block level custom CSS.

Everything works as expected unless a user without unfiltered_html edits a page/post with existing block-level custom CSS that includes nested selectors, eg.

color: green;
& p {color: blue}

In these cases, entities like & are encoded and the CSS breaks in the editor and the frontend.

See the discussion on https://github.com/WordPress/wordpress-develop/pull/11104

Core trac ticket: https://core.trac.wordpress.org/ticket/64771

There, @sirreal pointed out that for 7.0 this needs to be fixed in GB by:

  1. Encoding the CSS stored in the serialised attributes as base64, with a prefix to indicate this is the case, eg. data:text/css;base64 OR
  2. Deleting the attribute if a user without unfiltered_html tries to edit/save the post - with a warning to them that this is going to happen

Step-by-step reproduction instructions

  1. Create a test user with the Author role (no unfiltered_html capability)
  2. Create a new post as an admin user
  3. Add a Group block with a nested Paragraph block
  4. Open the block's Advanced panel → Additional CSS textarea
  5. Enter: color: blue; & p { color: red; }
  6. Save the post
  7. Log in as a user without unfiltered_html, eg. author and edit the paragraph, eg. make part of string italic. Note you will not see the custom CSS input box when logged in as this user. Just edit the existing paragraph in the post content and save.
  8. Save again and then log back in as an admin user and CSS shows color: blue; & .child { color: red; } and styles do not show correctly in editor or frontend.

Screenshots, screen recording, code snippet

No response

Environment info

No response

Please confirm that you have searched existing issues in the repo.

  • Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

  • Yes

Please confirm which theme type you used for testing.

GitHub Labels

[Type] Bug[Feature] Blocks[Status] In ProgressCSS Styling

Want to work on this?

Claim this issue to let others know you're working on it. You'll earn 20 points when you complete it!

Risk Flags

  • multisite implications
  • security considerations
Loading labels...

Details

Points20 pts
Difficultymedium
Scopesomewhat clear
Skill Matchmaybe
Test Focusedno
Assigneeramonjd