From 86ceeead2740c7df9fd55af91728ed80deb08826 Mon Sep 17 00:00:00 2001
From: Sukhendu Sekhar Guria <sukhenduguria2017@gmail.com>
Date: Mon, 24 Aug 2026 16:49:58 +0530
Subject: [PATCH 01/68] feat(styles): filter inline style attributes

---
 src/wp-includes/class-wp-styles.php           |  33 ++--
 src/wp-includes/script-loader.php             |  79 +++++++++-
 tests/phpunit/tests/dependencies/styles.php   | 130 +++++++++++++++
 .../tests/dependencies/wpInlineStyleTag.php   | 149 ++++++++++++++++++
 4 files changed, 367 insertions(+), 24 deletions(-)
 create mode 100644 tests/phpunit/tests/dependencies/wpInlineStyleTag.php

diff --git a/src/wp-includes/class-wp-styles.php b/src/wp-includes/class-wp-styles.php
index 20487ca9b7068..8cd9672c96fdd 100644
--- a/src/wp-includes/class-wp-styles.php
+++ b/src/wp-includes/class-wp-styles.php
@@ -157,16 +157,6 @@ public function do_item( $handle, $group = false ) {
 		$src          = $obj->src;
 		$inline_style = $this->print_inline_style( $handle, false );
 
-		if ( $inline_style ) {
-			$processor = new WP_HTML_Tag_Processor( '<style></style>' );
-			$processor->next_tag();
-			$processor->set_attribute( 'id', "{$handle}-inline-css" );
-			$processor->set_modifiable_text( "\n{$inline_style}\n" );
-			$inline_style_tag = "{$processor->get_updated_html()}\n";
-		} else {
-			$inline_style_tag = '';
-		}
-
 		if ( $this->do_concat ) {
 			if ( is_string( $src ) && $this->in_default_dir( $src ) && ! isset( $obj->extra['alt'] ) ) {
 				$this->concat         .= "$handle,";
@@ -182,7 +172,12 @@ public function do_item( $handle, $group = false ) {
 
 		// A single item may alias a set of items, by having dependencies, but no source.
 		if ( ! $src ) {
-			if ( $inline_style_tag ) {
+			if ( $inline_style ) {
+				$inline_style_tag = wp_get_inline_style_tag(
+					$inline_style,
+					array( 'id' => "{$handle}-inline-css" )
+				);
+
 				if ( $this->do_concat ) {
 					$this->print_html .= $inline_style_tag;
 				} else {
@@ -253,8 +248,11 @@ public function do_item( $handle, $group = false ) {
 
 		if ( $this->do_concat ) {
 			$this->print_html .= $tag;
-			if ( $inline_style_tag ) {
-				$this->print_html .= $inline_style_tag;
+			if ( $inline_style ) {
+				$this->print_html .= wp_get_inline_style_tag(
+					$inline_style,
+					array( 'id' => "{$handle}-inline-css" )
+				);
 			}
 		} else {
 			echo $tag;
@@ -332,11 +330,10 @@ public function print_inline_style( $handle, $display = true ) {
 			return $output;
 		}
 
-		$processor = new WP_HTML_Tag_Processor( '<style></style>' );
-		$processor->next_tag();
-		$processor->set_attribute( 'id', "{$handle}-inline-css" );
-		$processor->set_modifiable_text( "\n{$output}\n" );
-		echo "{$processor->get_updated_html()}\n";
+		wp_print_inline_style_tag(
+			$output,
+			array( 'id' => "{$handle}-inline-css" )
+		);
 
 		return true;
 	}
diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 7d5ba24e5617d..9a4b105ff3048 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -2445,12 +2445,9 @@ function _print_styles() {
 		echo "<link rel='stylesheet' href='" . esc_attr( $href ) . "' media='all' />\n";
 
 		if ( ! empty( $wp_styles->print_code ) ) {
-			$processor = new WP_HTML_Tag_Processor( '<style></style>' );
-			$processor->next_tag();
-			$style_tag_contents = "\n{$wp_styles->print_code}\n"
-				. sprintf( "/*# sourceURL=%s */\n", rawurlencode( $concat_source_url ) );
-			$processor->set_modifiable_text( $style_tag_contents );
-			echo "{$processor->get_updated_html()}\n";
+			$style_tag_contents = $wp_styles->print_code . "\n"
+				. sprintf( '/*# sourceURL=%s */', rawurlencode( $concat_source_url ) );
+			wp_print_inline_style_tag( $style_tag_contents );
 		}
 	}
 
@@ -3080,6 +3077,76 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
 	echo wp_get_inline_script_tag( $data, $attributes );
 }
 
+/**
+ * Constructs an inline style tag.
+ *
+ * It is possible to inject attributes in the `<style>` tag via the {@see 'wp_inline_style_attributes'} filter.
+ *
+ * @since 7.2.0
+ *
+ * @param string                     $data       CSS for the style tag.
+ * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
+ * @return string HTML style tag containing the provided CSS.
+ */
+function wp_get_inline_style_tag( $data, $attributes = array() ) {
+	$data = "\n" . trim( $data, "\n\r " ) . "\n";
+
+	/**
+	 * Filters attributes to be added to an inline style tag.
+	 *
+	 * @since 7.2.0
+	 *
+	 * @param array<string, string|bool> $attributes Key-value pairs representing `<style>` tag attributes.
+	 *                                               Only the attribute name is added to the `<style>` tag for
+	 *                                               entries with a boolean value, and that are true.
+	 * @param string                     $data       Inline CSS.
+	 */
+	$attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $data );
+
+	$processor = new WP_HTML_Tag_Processor( '<style></style>' );
+	$processor->next_tag();
+	foreach ( $attributes as $name => $value ) {
+		/*
+		 * Lexical variations of an attribute name may represent the
+		 * same attribute in HTML, therefore it is possible that the
+		 * input array might contain duplicate attributes even though
+		 * it is keyed on their name. Calling code should rewrite an
+		 * attribute's value rather than sending a duplicate attribute.
+		 *
+		 * Example:
+		 *
+		 *     array( 'id' => 'main', 'ID' => 'nav' )
+		 *
+		 * In this example, there are two keys both describing the `id`
+		 * attribute. PHP array iteration is in key-insertion order so
+		 * the 'id' value will be set in the STYLE tag.
+		 */
+		if ( null !== $processor->get_attribute( $name ) ) {
+			continue;
+		}
+
+		$processor->set_attribute( $name, $value ?? true );
+	}
+
+	$processor->set_modifiable_text( $data );
+
+	return "{$processor->get_updated_html()}\n";
+}
+
+/**
+ * Prints an inline style tag.
+ *
+ * It is possible to inject attributes in the `<style>` tag via the {@see 'wp_inline_style_attributes'} filter.
+ *
+ * @since 7.2.0
+ *
+ * @param string                     $data       CSS for the style tag.
+ * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
+ */
+function wp_print_inline_style_tag( $data, $attributes = array() ) {
+	echo wp_get_inline_style_tag( $data, $attributes );
+}
+
 /**
  * Allows small styles to be inlined.
  *
diff --git a/tests/phpunit/tests/dependencies/styles.php b/tests/phpunit/tests/dependencies/styles.php
index 90c4e59fccdee..20c94201e2af7 100644
--- a/tests/phpunit/tests/dependencies/styles.php
+++ b/tests/phpunit/tests/dependencies/styles.php
@@ -225,6 +225,136 @@ public function test_inline_styles_concat() {
 		$this->assertEqualHTML( $expected, $wp_styles->print_html );
 	}
 
+	/**
+	 * Tests that inline style attributes are filtered during normal style output.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter() {
+		$filter_calls = 0;
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( $attributes ) use ( &$filter_calls ) {
+				++$filter_calls;
+				$attributes['nonce'] = 'test-nonce';
+				return $attributes;
+			}
+		);
+
+		wp_enqueue_style( 'handle', 'http://example.com', array(), 1 );
+		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
+
+		$printed = get_echo( 'wp_print_styles' );
+
+		$this->assertStringContainsString( '<style id="handle-inline-css" nonce="test-nonce">', $printed );
+		$this->assertSame( 1, $filter_calls );
+	}
+
+	/**
+	 * Tests that inline style attributes are filtered when print_inline_style() is called directly.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter_with_direct_call() {
+		global $wp_styles;
+
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( $attributes ) {
+				$attributes['nonce'] = 'test-nonce';
+				return $attributes;
+			}
+		);
+
+		wp_register_style( 'handle', 'http://example.com' );
+		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
+
+		$printed = get_echo( array( $wp_styles, 'print_inline_style' ), array( 'handle' ) );
+
+		$this->assertStringContainsString( '<style id="handle-inline-css" nonce="test-nonce">', $printed );
+	}
+
+	/**
+	 * Tests that inline style attributes are filtered for a concatenated non-core stylesheet.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter_with_non_core_concat() {
+		global $wp_styles;
+
+		$wp_styles->do_concat    = true;
+		$wp_styles->default_dirs = array( '/wp-admin/', '/wp-includes/css/' );
+
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( $attributes ) {
+				$attributes['nonce'] = 'test-nonce';
+				return $attributes;
+			}
+		);
+
+		wp_enqueue_style( 'handle', 'http://example.com', array(), 1 );
+		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
+		wp_print_styles();
+
+		$this->assertStringContainsString(
+			'<style id="handle-inline-css" nonce="test-nonce">',
+			$wp_styles->print_html
+		);
+	}
+
+	/**
+	 * Tests that inline style attributes are filtered for concatenated core styles.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter_with_core_concat() {
+		global $wp_styles;
+
+		$wp_styles->do_concat    = true;
+		$wp_styles->default_dirs = array( '/wp-admin/' );
+
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( $attributes ) {
+				$attributes['nonce'] = 'test-nonce';
+				return $attributes;
+			}
+		);
+
+		wp_enqueue_style( 'handle', '/wp-admin/example.css' );
+		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
+		wp_print_styles();
+
+		$printed = get_echo( '_print_styles' );
+
+		$this->assertStringContainsString( '<style nonce="test-nonce">', $printed );
+	}
+
+	/**
+	 * Tests that inline style attributes are not filtered when style output is suppressed.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter_not_called_when_output_is_suppressed() {
+		$filter_calls = 0;
+
+		add_filter( 'style_loader_src', '__return_false' );
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( $attributes ) use ( &$filter_calls ) {
+				++$filter_calls;
+				return $attributes;
+			}
+		);
+
+		wp_enqueue_style( 'handle', 'http://example.com', array(), 1 );
+		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
+
+		$this->assertSame( '', get_echo( 'wp_print_styles' ) );
+		$this->assertSame( 0, $filter_calls );
+	}
+
 	/**
 	 * Test normalizing relative links in CSS.
 	 *
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
new file mode 100644
index 0000000000000..baf42810e86e6
--- /dev/null
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -0,0 +1,149 @@
+<?php
+
+/**
+ * Test wp_get_inline_style_tag() and wp_print_inline_style_tag().
+ *
+ * @group dependencies
+ * @group styles
+ * @covers ::wp_get_inline_style_tag
+ * @covers ::wp_print_inline_style_tag
+ */
+class Tests_Dependencies_wpInlineStyleTag extends WP_UnitTestCase {
+
+	private $css = 'body { color: #123456; }';
+
+	/**
+	 * @ticket 51325
+	 */
+	public function test_get_inline_style_tag_with_attributes() {
+		$this->assertSame(
+			"<style id=\"test-inline-css\" nonce=\"test-nonce\">\n{$this->css}\n</style>\n",
+			wp_get_inline_style_tag(
+				$this->css,
+				array(
+					'id'    => 'test-inline-css',
+					'nonce' => 'test-nonce',
+				)
+			)
+		);
+	}
+
+	/**
+	 * @ticket 51325
+	 */
+	public function test_print_inline_style_tag_prints_get_inline_style_tag() {
+		$attributes = array( 'id' => 'test-inline-css' );
+
+		$this->assertSame(
+			wp_get_inline_style_tag( $this->css, $attributes ),
+			get_echo(
+				'wp_print_inline_style_tag',
+				array( $this->css, $attributes )
+			)
+		);
+	}
+
+	/**
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter() {
+		$filtered_data = null;
+
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( $attributes, $data ) use ( &$filtered_data ) {
+				$attributes['nonce'] = 'test-nonce';
+				$filtered_data       = $data;
+				return $attributes;
+			},
+			10,
+			2
+		);
+
+		$this->assertSame(
+			"<style nonce=\"test-nonce\">\n{$this->css}\n</style>\n",
+			wp_get_inline_style_tag( $this->css )
+		);
+		$this->assertSame( "\n{$this->css}\n", $filtered_data );
+	}
+
+	/**
+	 * Test the behavior of generated style tag attributes passed different values and types of values.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_tag_attribute_value_types() {
+		$expected = <<<'HTML'
+<style
+	true
+	null
+	empty-string=""
+	0-string="0"
+	1-string="1"
+	0-numeric="0"
+	1-numeric="1"
+>
+body { color: #123456; }
+</style>
+
+HTML;
+
+		$this->assertEqualHTML(
+			$expected,
+			wp_get_inline_style_tag(
+				$this->css,
+				array(
+					'true'         => true,
+					'false'        => false,
+					'null'         => null,
+					'empty-string' => '',
+					'0-string'     => '0',
+					'1-string'     => '1',
+					'0-numeric'    => 0,
+					'1-numeric'    => 1,
+				)
+			)
+		);
+	}
+
+	/**
+	 * Test the behavior of generated style tag repeated attributes.
+	 *
+	 * HTML will ignore case-insensitive repeated attributes. Ensure that the handling of input
+	 * attributes aligns with expectations.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_tag_repeat_attributes() {
+		$expected = <<<'HTML'
+<style test="test-a">
+body { color: #123456; }
+</style>
+
+HTML;
+
+		$this->assertEqualHTML(
+			$expected,
+			wp_get_inline_style_tag(
+				$this->css,
+				array(
+					'test' => 'test-a',
+					'tesT' => 'tesT-b',
+					'teST' => 'teST-c',
+					'tEST' => 'tEST-d',
+					'TEST' => 'TEST-e',
+				)
+			)
+		);
+	}
+
+	/**
+	 * @ticket 51325
+	 */
+	public function test_inline_style_tag_escapes_closing_style_tag() {
+		$this->assertSame(
+			"<style>\nbody::after { content: \"\\3c\\2fstyle>\"; }\n</style>\n",
+			wp_get_inline_style_tag( 'body::after { content: "</style>"; }' )
+		);
+	}
+}

From 1eb9b67d1e9da9ff5fca9c34dfc03194464977b4 Mon Sep 17 00:00:00 2001
From: Sukhendu Sekhar Guria <sukhenduguria2017@gmail.com>
Date: Wed, 7 Oct 2026 14:36:45 +0530
Subject: [PATCH 02/68] refactor: tighten inline style API types

---
 src/wp-includes/script-loader.php             | 15 ++++++---
 .../tests/dependencies/wpInlineStyleTag.php   | 32 +++++++++----------
 2 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 2ab1bf660a067..e189892431cf8 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3668,10 +3668,13 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
  * @since 7.2.0
  *
  * @param string                     $data       CSS for the style tag.
- * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
+ * @param array<string, string|true> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
  * @return string HTML style tag containing the provided CSS.
+ *
+ * @phpstan-param array<non-falsy-string, string|true> $attributes
+ * @phpstan-return non-falsy-string
  */
-function wp_get_inline_style_tag( $data, $attributes = array() ) {
+function wp_get_inline_style_tag( string $data, array $attributes = array() ): string {
 	$data = "\n" . trim( $data, "\n\r " ) . "\n";
 
 	/**
@@ -3679,7 +3682,7 @@ function wp_get_inline_style_tag( $data, $attributes = array() ) {
 	 *
 	 * @since 7.2.0
 	 *
-	 * @param array<string, string|bool> $attributes Key-value pairs representing `<style>` tag attributes.
+	 * @param array<string, string|true> $attributes Key-value pairs representing `<style>` tag attributes.
 	 *                                               Only the attribute name is added to the `<style>` tag for
 	 *                                               entries with a boolean value, and that are true.
 	 * @param string                     $data       Inline CSS.
@@ -3724,9 +3727,11 @@ function wp_get_inline_style_tag( $data, $attributes = array() ) {
  * @since 7.2.0
  *
  * @param string                     $data       CSS for the style tag.
- * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
+ * @param array<string, string|true> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
+ *
+ * @phpstan-param array<non-falsy-string, string|true> $attributes
  */
-function wp_print_inline_style_tag( $data, $attributes = array() ) {
+function wp_print_inline_style_tag( string $data, array $attributes = array() ): void {
 	echo wp_get_inline_style_tag( $data, $attributes );
 }
 
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index baf42810e86e6..5cf14a5ba1aa4 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -74,19 +74,19 @@ static function ( $attributes, $data ) use ( &$filtered_data ) {
 	 */
 	public function test_inline_style_tag_attribute_value_types() {
 		$expected = <<<'HTML'
-<style
-	true
-	null
-	empty-string=""
-	0-string="0"
-	1-string="1"
-	0-numeric="0"
-	1-numeric="1"
->
-body { color: #123456; }
-</style>
+			<style
+				true
+				null
+				empty-string=""
+				0-string="0"
+				1-string="1"
+				0-numeric="0"
+				1-numeric="1"
+			>
+			body { color: #123456; }
+			</style>
 
-HTML;
+			HTML;
 
 		$this->assertEqualHTML(
 			$expected,
@@ -116,11 +116,11 @@ public function test_inline_style_tag_attribute_value_types() {
 	 */
 	public function test_inline_style_tag_repeat_attributes() {
 		$expected = <<<'HTML'
-<style test="test-a">
-body { color: #123456; }
-</style>
+			<style test="test-a">
+			body { color: #123456; }
+			</style>
 
-HTML;
+			HTML;
 
 		$this->assertEqualHTML(
 			$expected,

From b3c0fa57c4c56e1b92cb05ddb689ad8c5da6375b Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 11:13:35 -0700
Subject: [PATCH 03/68] Address PHPStan errors in tests

---
 tests/phpunit/tests/dependencies/styles.php   | 82 ++++++++-----------
 .../tests/dependencies/wpInlineStyleTag.php   | 33 +++++---
 2 files changed, 55 insertions(+), 60 deletions(-)

diff --git a/tests/phpunit/tests/dependencies/styles.php b/tests/phpunit/tests/dependencies/styles.php
index 890b8453e0c00..c37a979144c47 100644
--- a/tests/phpunit/tests/dependencies/styles.php
+++ b/tests/phpunit/tests/dependencies/styles.php
@@ -9,23 +9,19 @@
  * @covers ::wp_add_inline_style
  */
 class Tests_Dependencies_Styles extends WP_UnitTestCase {
-	private $old_wp_styles;
-	private $old_wp_scripts;
+	private ?WP_Styles $old_wp_styles;
+	private ?WP_Scripts $old_wp_scripts;
 
+	/**
+	 * @global WP_Scripts|null $wp_scripts
+	 * @global WP_Styles|null  $wp_styles
+	 */
 	public function set_up() {
+		global $wp_scripts, $wp_styles;
 		parent::set_up();
 
-		if ( empty( $GLOBALS['wp_styles'] ) ) {
-			$GLOBALS['wp_styles'] = null;
-		}
-
-		$this->old_wp_styles = $GLOBALS['wp_styles'];
-
-		if ( empty( $GLOBALS['wp_scripts'] ) ) {
-			$GLOBALS['wp_scripts'] = null;
-		}
-
-		$this->old_wp_styles = $GLOBALS['wp_scripts'];
+		$this->old_wp_styles  = $wp_styles;
+		$this->old_wp_scripts = $wp_scripts;
 
 		remove_action( 'wp_default_styles', 'wp_default_styles' );
 		remove_action( 'wp_print_styles', 'print_emoji_styles' );
@@ -37,9 +33,14 @@ public function set_up() {
 		$GLOBALS['wp_scripts']->default_version = get_bloginfo( 'version' );
 	}
 
+	/**
+	 * @global WP_Scripts|null $wp_scripts
+	 * @global WP_Styles|null  $wp_styles
+	 */
 	public function tear_down() {
-		$GLOBALS['wp_styles']  = $this->old_wp_styles;
-		$GLOBALS['wp_scripts'] = $this->old_wp_scripts;
+		global $wp_scripts, $wp_styles;
+		$wp_styles  = $this->old_wp_styles;
+		$wp_scripts = $this->old_wp_scripts;
 
 		add_action( 'wp_default_styles', 'wp_default_styles' );
 		add_action( 'wp_print_styles', 'print_emoji_styles' );
@@ -231,23 +232,23 @@ public function test_inline_styles_concat() {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_attributes_filter() {
-		$filter_calls = 0;
+		$mock_action = new MockAction();
+		add_filter( 'wp_inline_style_attributes', array( $mock_action, 'filter' ) );
 		add_filter(
 			'wp_inline_style_attributes',
-			static function ( $attributes ) use ( &$filter_calls ) {
-				++$filter_calls;
+			static function ( array $attributes ) {
 				$attributes['nonce'] = 'test-nonce';
 				return $attributes;
 			}
 		);
 
-		wp_enqueue_style( 'handle', 'http://example.com', array(), 1 );
+		wp_enqueue_style( 'handle', 'http://example.com', array(), '1' );
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 
 		$printed = get_echo( 'wp_print_styles' );
 
 		$this->assertStringContainsString( '<style id="handle-inline-css" nonce="test-nonce">', $printed );
-		$this->assertSame( 1, $filter_calls );
+		$this->assertSame( 1, $mock_action->get_call_count() );
 	}
 
 	/**
@@ -256,11 +257,9 @@ static function ( $attributes ) use ( &$filter_calls ) {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_attributes_filter_with_direct_call() {
-		global $wp_styles;
-
 		add_filter(
 			'wp_inline_style_attributes',
-			static function ( $attributes ) {
+			static function ( array $attributes ) {
 				$attributes['nonce'] = 'test-nonce';
 				return $attributes;
 			}
@@ -269,7 +268,7 @@ static function ( $attributes ) {
 		wp_register_style( 'handle', 'http://example.com' );
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 
-		$printed = get_echo( array( $wp_styles, 'print_inline_style' ), array( 'handle' ) );
+		$printed = get_echo( array( wp_styles(), 'print_inline_style' ), array( 'handle' ) );
 
 		$this->assertStringContainsString( '<style id="handle-inline-css" nonce="test-nonce">', $printed );
 	}
@@ -280,26 +279,24 @@ static function ( $attributes ) {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_attributes_filter_with_non_core_concat() {
-		global $wp_styles;
-
-		$wp_styles->do_concat    = true;
-		$wp_styles->default_dirs = array( '/wp-admin/', '/wp-includes/css/' );
+		wp_styles()->do_concat    = true;
+		wp_styles()->default_dirs = array( '/wp-admin/', '/wp-includes/css/' );
 
 		add_filter(
 			'wp_inline_style_attributes',
-			static function ( $attributes ) {
+			static function ( array $attributes ) {
 				$attributes['nonce'] = 'test-nonce';
 				return $attributes;
 			}
 		);
 
-		wp_enqueue_style( 'handle', 'http://example.com', array(), 1 );
+		wp_enqueue_style( 'handle', 'http://example.com', array(), '1' );
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 		wp_print_styles();
 
 		$this->assertStringContainsString(
 			'<style id="handle-inline-css" nonce="test-nonce">',
-			$wp_styles->print_html
+			wp_styles()->print_html
 		);
 	}
 
@@ -309,14 +306,12 @@ static function ( $attributes ) {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_attributes_filter_with_core_concat() {
-		global $wp_styles;
-
-		$wp_styles->do_concat    = true;
-		$wp_styles->default_dirs = array( '/wp-admin/' );
+		wp_styles()->do_concat    = true;
+		wp_styles()->default_dirs = array( '/wp-admin/' );
 
 		add_filter(
 			'wp_inline_style_attributes',
-			static function ( $attributes ) {
+			static function ( array $attributes ) {
 				$attributes['nonce'] = 'test-nonce';
 				return $attributes;
 			}
@@ -337,22 +332,15 @@ static function ( $attributes ) {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_attributes_filter_not_called_when_output_is_suppressed() {
-		$filter_calls = 0;
-
 		add_filter( 'style_loader_src', '__return_false' );
-		add_filter(
-			'wp_inline_style_attributes',
-			static function ( $attributes ) use ( &$filter_calls ) {
-				++$filter_calls;
-				return $attributes;
-			}
-		);
+		$mock_action = new MockAction();
+		add_filter( 'wp_inline_style_attributes', array( $mock_action, 'filter' ) );
 
-		wp_enqueue_style( 'handle', 'http://example.com', array(), 1 );
+		wp_enqueue_style( 'handle', 'http://example.com', array(), '1' );
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 
 		$this->assertSame( '', get_echo( 'wp_print_styles' ) );
-		$this->assertSame( 0, $filter_calls );
+		$this->assertSame( 0, $mock_action->get_call_count() );
 	}
 
 	/**
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 5cf14a5ba1aa4..d0fa898f16cff 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -10,16 +10,14 @@
  */
 class Tests_Dependencies_wpInlineStyleTag extends WP_UnitTestCase {
 
-	private $css = 'body { color: #123456; }';
-
 	/**
 	 * @ticket 51325
 	 */
 	public function test_get_inline_style_tag_with_attributes() {
 		$this->assertSame(
-			"<style id=\"test-inline-css\" nonce=\"test-nonce\">\n{$this->css}\n</style>\n",
+			"<style id=\"test-inline-css\" nonce=\"test-nonce\">\n{$this->get_test_css()}\n</style>\n",
 			wp_get_inline_style_tag(
-				$this->css,
+				$this->get_test_css(),
 				array(
 					'id'    => 'test-inline-css',
 					'nonce' => 'test-nonce',
@@ -35,10 +33,10 @@ public function test_print_inline_style_tag_prints_get_inline_style_tag() {
 		$attributes = array( 'id' => 'test-inline-css' );
 
 		$this->assertSame(
-			wp_get_inline_style_tag( $this->css, $attributes ),
+			wp_get_inline_style_tag( $this->get_test_css(), $attributes ),
 			get_echo(
 				'wp_print_inline_style_tag',
-				array( $this->css, $attributes )
+				array( $this->get_test_css(), $attributes )
 			)
 		);
 	}
@@ -51,7 +49,7 @@ public function test_inline_style_attributes_filter() {
 
 		add_filter(
 			'wp_inline_style_attributes',
-			static function ( $attributes, $data ) use ( &$filtered_data ) {
+			static function ( array $attributes, string $data ) use ( &$filtered_data ) {
 				$attributes['nonce'] = 'test-nonce';
 				$filtered_data       = $data;
 				return $attributes;
@@ -61,10 +59,10 @@ static function ( $attributes, $data ) use ( &$filtered_data ) {
 		);
 
 		$this->assertSame(
-			"<style nonce=\"test-nonce\">\n{$this->css}\n</style>\n",
-			wp_get_inline_style_tag( $this->css )
+			"<style nonce=\"test-nonce\">\n{$this->get_test_css()}\n</style>\n",
+			wp_get_inline_style_tag( $this->get_test_css() )
 		);
-		$this->assertSame( "\n{$this->css}\n", $filtered_data );
+		$this->assertSame( "\n{$this->get_test_css()}\n", $filtered_data );
 	}
 
 	/**
@@ -91,8 +89,8 @@ public function test_inline_style_tag_attribute_value_types() {
 		$this->assertEqualHTML(
 			$expected,
 			wp_get_inline_style_tag(
-				$this->css,
-				array(
+				$this->get_test_css(),
+				array( // @phpstan-ignore argument.type
 					'true'         => true,
 					'false'        => false,
 					'null'         => null,
@@ -125,7 +123,7 @@ public function test_inline_style_tag_repeat_attributes() {
 		$this->assertEqualHTML(
 			$expected,
 			wp_get_inline_style_tag(
-				$this->css,
+				$this->get_test_css(),
 				array(
 					'test' => 'test-a',
 					'tesT' => 'tesT-b',
@@ -146,4 +144,13 @@ public function test_inline_style_tag_escapes_closing_style_tag() {
 			wp_get_inline_style_tag( 'body::after { content: "</style>"; }' )
 		);
 	}
+
+	/**
+	 * Gets test CSS code.
+	 *
+	 * @return non-falsy-string
+	 */
+	private function get_test_css(): string {
+		return 'body { color: #123456; }';
+	}
 }

From 0468fec555f0e29908d65573cde75732c1b2d90f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 11:17:19 -0700
Subject: [PATCH 04/68] Make inline style tag tests less brittle

Replace substring and exact-string assertions with assertEqualHTML()
for fully deterministic output, so attribute order, quoting style and
self-closing syntax no longer cause spurious failures.

Use WP_HTML_Tag_Processor where full-markup comparison is a poor fit:
the core concatenation test (whose load-styles.php URL is noisy) and
the closing-tag escaping test, which now checks that the CSS cannot
break out of the STYLE element rather than pinning the exact escape
sequence.

Also verify the attributes passed to the wp_inline_style_attributes
filter during normal style output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/phpunit/tests/dependencies/styles.php   | 62 ++++++++++++++++---
 .../tests/dependencies/wpInlineStyleTag.php   | 36 ++++++++---
 2 files changed, 78 insertions(+), 20 deletions(-)

diff --git a/tests/phpunit/tests/dependencies/styles.php b/tests/phpunit/tests/dependencies/styles.php
index c37a979144c47..3786da4e2070c 100644
--- a/tests/phpunit/tests/dependencies/styles.php
+++ b/tests/phpunit/tests/dependencies/styles.php
@@ -245,10 +245,18 @@ static function ( array $attributes ) {
 		wp_enqueue_style( 'handle', 'http://example.com', array(), '1' );
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 
-		$printed = get_echo( 'wp_print_styles' );
+		$expected = <<<'HTML'
+			<link rel="stylesheet" id="handle-css" href="http://example.com?ver=1" media="all">
+			<style id="handle-inline-css" nonce="test-nonce">
+			body { color: #123456; }
+			/*# sourceURL=handle-inline-css */
+			</style>
 
-		$this->assertStringContainsString( '<style id="handle-inline-css" nonce="test-nonce">', $printed );
+			HTML;
+
+		$this->assertEqualHTML( $expected, get_echo( 'wp_print_styles' ) );
 		$this->assertSame( 1, $mock_action->get_call_count() );
+		$this->assertSame( array( 'id' => 'handle-inline-css' ), $mock_action->get_args()[0][0] );
 	}
 
 	/**
@@ -268,9 +276,18 @@ static function ( array $attributes ) {
 		wp_register_style( 'handle', 'http://example.com' );
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 
-		$printed = get_echo( array( wp_styles(), 'print_inline_style' ), array( 'handle' ) );
+		$expected = <<<'HTML'
+			<style id="handle-inline-css" nonce="test-nonce">
+			body { color: #123456; }
+			/*# sourceURL=handle-inline-css */
+			</style>
+
+			HTML;
 
-		$this->assertStringContainsString( '<style id="handle-inline-css" nonce="test-nonce">', $printed );
+		$this->assertEqualHTML(
+			$expected,
+			get_echo( array( wp_styles(), 'print_inline_style' ), array( 'handle' ) )
+		);
 	}
 
 	/**
@@ -294,10 +311,15 @@ static function ( array $attributes ) {
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 		wp_print_styles();
 
-		$this->assertStringContainsString(
-			'<style id="handle-inline-css" nonce="test-nonce">',
-			wp_styles()->print_html
-		);
+		$expected = <<<'HTML'
+			<link rel="stylesheet" id="handle-css" href="http://example.com?ver=1" media="all">
+			<style id="handle-inline-css" nonce="test-nonce">
+			body { color: #123456; }
+			</style>
+
+			HTML;
+
+		$this->assertEqualHTML( $expected, wp_styles()->print_html );
 	}
 
 	/**
@@ -321,9 +343,29 @@ static function ( array $attributes ) {
 		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
 		wp_print_styles();
 
-		$printed = get_echo( '_print_styles' );
+		$processor = new WP_HTML_Tag_Processor( get_echo( '_print_styles' ) );
+
+		$this->assertTrue( $processor->next_tag(), 'Expected the concatenated stylesheet LINK.' );
+		$this->assertSame( 'LINK', $processor->get_tag() );
+		$this->assertSame( 'stylesheet', $processor->get_attribute( 'rel' ) );
+		$href = $processor->get_attribute( 'href' );
+		$this->assertIsString( $href );
+		$this->assertStringContainsString( '/wp-admin/load-styles.php?', $href );
+
+		$this->assertTrue( $processor->next_tag(), 'Expected the concatenated inline STYLE.' );
+		$this->assertSame( 'STYLE', $processor->get_tag() );
+		$this->assertSame(
+			array( 'nonce' ),
+			$processor->get_attribute_names_with_prefix( '' ),
+			'Expected the filtered nonce to be the only attribute.'
+		);
+		$this->assertSame( 'test-nonce', $processor->get_attribute( 'nonce' ) );
+		$this->assertSame(
+			"\nbody { color: #123456; }\n/*# sourceURL=css-inline-concat-handle */\n",
+			$processor->get_modifiable_text()
+		);
 
-		$this->assertStringContainsString( '<style nonce="test-nonce">', $printed );
+		$this->assertFalse( $processor->next_tag(), 'Expected no other tags.' );
 	}
 
 	/**
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index d0fa898f16cff..edab921a8c36b 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -14,8 +14,15 @@ class Tests_Dependencies_wpInlineStyleTag extends WP_UnitTestCase {
 	 * @ticket 51325
 	 */
 	public function test_get_inline_style_tag_with_attributes() {
-		$this->assertSame(
-			"<style id=\"test-inline-css\" nonce=\"test-nonce\">\n{$this->get_test_css()}\n</style>\n",
+		$expected = <<<'HTML'
+			<style id="test-inline-css" nonce="test-nonce">
+			body { color: #123456; }
+			</style>
+
+			HTML;
+
+		$this->assertEqualHTML(
+			$expected,
 			wp_get_inline_style_tag(
 				$this->get_test_css(),
 				array(
@@ -58,10 +65,14 @@ static function ( array $attributes, string $data ) use ( &$filtered_data ) {
 			2
 		);
 
-		$this->assertSame(
-			"<style nonce=\"test-nonce\">\n{$this->get_test_css()}\n</style>\n",
-			wp_get_inline_style_tag( $this->get_test_css() )
-		);
+		$expected = <<<'HTML'
+			<style nonce="test-nonce">
+			body { color: #123456; }
+			</style>
+
+			HTML;
+
+		$this->assertEqualHTML( $expected, wp_get_inline_style_tag( $this->get_test_css() ) );
 		$this->assertSame( "\n{$this->get_test_css()}\n", $filtered_data );
 	}
 
@@ -139,10 +150,15 @@ public function test_inline_style_tag_repeat_attributes() {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_tag_escapes_closing_style_tag() {
-		$this->assertSame(
-			"<style>\nbody::after { content: \"\\3c\\2fstyle>\"; }\n</style>\n",
-			wp_get_inline_style_tag( 'body::after { content: "</style>"; }' )
-		);
+		$css       = 'body::after { content: "</style>"; } body::before { content: "<script>"; }';
+		$processor = new WP_HTML_Tag_Processor( wp_get_inline_style_tag( $css ) );
+
+		$this->assertTrue( $processor->next_tag(), 'Expected a STYLE tag.' );
+		$this->assertSame( 'STYLE', $processor->get_tag() );
+		$text = $processor->get_modifiable_text();
+		$this->assertStringNotContainsStringIgnoringCase( '</style', $text, 'Expected the closing STYLE tag to be escaped.' );
+		$this->assertStringContainsString( 'body::before { content: "<script>"; }', $text, 'Expected the rest of the CSS to be preserved.' );
+		$this->assertFalse( $processor->next_tag(), 'Expected the CSS to not break out of the STYLE element.' );
 	}
 
 	/**

From 9461b76184cb302b407396f52be4201535555bcb Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 11:31:46 -0700
Subject: [PATCH 05/68] Document inline style tag attribute values as
 string|bool

Widen the documented attribute value type from string|true to
string|bool for wp_get_inline_style_tag(), wp_print_inline_style_tag()
and the wp_inline_style_attributes filter. This matches
wp_get_script_tag() and wp_get_inline_script_tag(), and reflects that
a false value omits the attribute, as the filter docblock already
describes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index f5e993b72f889..74a4df23d78b6 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3670,10 +3670,10 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
  * @since 7.2.0
  *
  * @param string                     $data       CSS for the style tag.
- * @param array<string, string|true> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
+ * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
  * @return string HTML style tag containing the provided CSS.
  *
- * @phpstan-param array<non-falsy-string, string|true> $attributes
+ * @phpstan-param array<non-falsy-string, string|bool> $attributes
  * @phpstan-return non-falsy-string
  */
 function wp_get_inline_style_tag( string $data, array $attributes = array() ): string {
@@ -3684,7 +3684,7 @@ function wp_get_inline_style_tag( string $data, array $attributes = array() ): s
 	 *
 	 * @since 7.2.0
 	 *
-	 * @param array<string, string|true> $attributes Key-value pairs representing `<style>` tag attributes.
+	 * @param array<string, string|bool> $attributes Key-value pairs representing `<style>` tag attributes.
 	 *                                               Only the attribute name is added to the `<style>` tag for
 	 *                                               entries with a boolean value, and that are true.
 	 * @param string                     $data       Inline CSS.
@@ -3729,9 +3729,9 @@ function wp_get_inline_style_tag( string $data, array $attributes = array() ): s
  * @since 7.2.0
  *
  * @param string                     $data       CSS for the style tag.
- * @param array<string, string|true> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
+ * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
  *
- * @phpstan-param array<non-falsy-string, string|true> $attributes
+ * @phpstan-param array<non-falsy-string, string|bool> $attributes
  */
 function wp_print_inline_style_tag( string $data, array $attributes = array() ): void {
 	echo wp_get_inline_style_tag( $data, $attributes );

From 7167a1707163855451f406271a740878f6d60693 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 11:35:00 -0700
Subject: [PATCH 06/68] Filter attributes of hoisted extra block library inline
 style

When wp_hoist_late_printed_styles() splits CSS added via
wp_add_inline_style( 'wp-block-library', ... ) into a separate
wp-block-library-inline-css-extra STYLE tag, build that tag with
wp_get_inline_style_tag() so it receives the attributes from the
wp_inline_style_attributes filter. Previously the original tag had a
filtered nonce but the split-off tag did not, so a nonce-based Content
Security Policy would block the CSS after hoisting.

Add a hoisting test data set which filters in a nonce, and loosen the
global styles placeholder pattern so that it still matches the
placeholder STYLE tag when it has additional attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php |  9 +++---
 tests/phpunit/tests/template.php  | 53 ++++++++++++++++++++++++++++++-
 2 files changed, 56 insertions(+), 6 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 74a4df23d78b6..c4f0f9739f68e 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -4662,11 +4662,10 @@ public function replace( string $text ): void {
 				 * a sourceURL comment after the placeholder above is removed.
 				 */
 				if ( ! preg_match( ':^\s*(/\*# sourceURL=\S+? \*/\s*)?$:s', $extra_inline_styles ) ) {
-					$style_processor = new WP_HTML_Tag_Processor( '<style></style>' );
-					$style_processor->next_tag();
-					$style_processor->set_attribute( 'id', 'wp-block-library-inline-css-extra' );
-					$style_processor->set_modifiable_text( $extra_inline_styles );
-					$inserted_after .= "{$style_processor->get_updated_html()}\n";
+					$inserted_after .= wp_get_inline_style_tag(
+						$extra_inline_styles,
+						array( 'id' => 'wp-block-library-inline-css-extra' )
+					);
 				}
 
 				if ( '' !== $inserted_after ) {
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index 13b78040b9cf9..264a9079a3807 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1767,6 +1767,57 @@ static function () {
 				},
 			),
 
+			'standard_classic_theme_config_extra_block_library_inline_style_with_filtered_attributes' => array(
+				'set_up'            => static function () {
+					add_action(
+						'enqueue_block_assets',
+						static function () {
+							// Extra CSS which prevents empty inline style containing placeholder from being removed.
+							wp_add_inline_style( 'wp-block-library', '.wp-block-separator{ outline:solid 1px lime; }' );
+						}
+					);
+					add_filter(
+						'wp_inline_style_attributes',
+						static function ( array $attributes ): array {
+							$attributes['nonce'] = 'test-nonce';
+							return $attributes;
+						}
+					);
+				},
+				'content'           => $blocks_content,
+				'inline_size_limit' => 0,
+				'expected_styles'   => array(
+					'HEAD' => array_merge(
+						$early_common_styles,
+						array(
+							'wp-block-library-css',
+							'wp-block-separator-css',
+							'wp-block-library-inline-css-extra',
+							'classic-theme-styles-css',
+							'third-party-test-block-css',
+							'custom-block-styles-css',
+							'global-styles-inline-css',
+						),
+						$common_at_wp_enqueue_scripts,
+						$common_late_in_head,
+						$common_late_in_body
+					),
+					'BODY' => array(),
+				),
+				'assert'            => function ( string $buffer, string $filtered_buffer ) {
+					$processor = new WP_HTML_Tag_Processor( $filtered_buffer );
+					$found     = false;
+					while ( $processor->next_tag( 'STYLE' ) ) {
+						if ( 'wp-block-library-inline-css-extra' === $processor->get_attribute( 'id' ) ) {
+							$found = true;
+							$this->assertSame( 'test-nonce', $processor->get_attribute( 'nonce' ), 'Expected the hoisted extra inline style to have the filtered attributes.' );
+							$this->assertStringContainsString( '.wp-block-separator{ outline:solid 1px lime; }', $processor->get_modifiable_text() );
+						}
+					}
+					$this->assertTrue( $found, 'Expected the hoisted extra inline style to be present.' );
+				},
+			),
+
 			'classic_theme_opt_out_separate_block_styles' => array(
 				'set_up'            => static function () {
 					add_filter( 'should_load_separate_core_block_assets', '__return_false' );
@@ -2066,7 +2117,7 @@ static function () {
 		// Create a simulated output buffer.
 		$buffer = '<html lang="en"><head><meta charset="utf-8">' . $head_output . '</head><body><main>' . $content . '</main>' . $footer_output . '</body></html>';
 
-		$global_styles_placeholder_regexp = '#<style id="wp-global-styles-placeholder-inline-css">#';
+		$global_styles_placeholder_regexp = '#<style id="wp-global-styles-placeholder-inline-css"[\s>]#';
 		$block_library_placeholder_regexp = '#/\*wp_block_styles_on_demand_placeholder:[a-f0-9]+\*/#';
 		if ( has_action( 'wp_template_enhancement_output_buffer_started', 'wp_hoist_late_printed_styles' ) ) {
 			if ( wp_style_is( 'global-styles', 'enqueued' ) ) {

From 0b080ef420347af3605e2f17ad8f7a6864e3b7b0 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 11:35:34 -0700
Subject: [PATCH 07/68] Avoid recomputing inline style when printing a
 stylesheet

In WP_Styles::do_item(), the inline style for a handle is already
obtained up front via print_inline_style( $handle, false ). When not
concatenating, calling print_inline_style( $handle ) again re-read the
after data and rebuilt the sourceURL comment. Instead, append the inline
style tag to the LINK tag once, and then print or buffer the result,
which also removes the duplicated wp_get_inline_style_tag() call between
the concat and non-concat branches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/class-wp-styles.php | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/wp-includes/class-wp-styles.php b/src/wp-includes/class-wp-styles.php
index c494878943525..b78d9387f4b6e 100644
--- a/src/wp-includes/class-wp-styles.php
+++ b/src/wp-includes/class-wp-styles.php
@@ -242,17 +242,17 @@ public function do_item( $handle, $group = false ) {
 			}
 		}
 
+		if ( $inline_style ) {
+			$tag .= wp_get_inline_style_tag(
+				$inline_style,
+				array( 'id' => "{$handle}-inline-css" )
+			);
+		}
+
 		if ( $this->do_concat ) {
 			$this->print_html .= $tag;
-			if ( $inline_style ) {
-				$this->print_html .= wp_get_inline_style_tag(
-					$inline_style,
-					array( 'id' => "{$handle}-inline-css" )
-				);
-			}
 		} else {
 			echo $tag;
-			$this->print_inline_style( $handle );
 		}
 
 		return true;

From b2d9c628e3a9de5fe2d18a004d076227538a7c35 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 11:54:09 -0700
Subject: [PATCH 08/68] Use inline style tag API for other core STYLE tags

Print the remaining hand-built front-end STYLE tags via
wp_print_inline_style_tag() so that they also receive attributes from
the wp_inline_style_attributes filter, such as a nonce for a Content
Security Policy:

* Custom background (including the empty Customizer preview tag).
* Additional CSS from the Customizer.
* Custom logo header text hiding.
* Block support styles.
* Font faces.
* Recent Comments widget.

Add a data-provider test covering each STYLE tag printed outside of
WP_Styles, and extend the hoisting test data set with a filtered nonce
to assert that every STYLE tag in the page has it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/fonts/class-wp-font-face.php  |   5 +-
 src/wp-includes/script-loader.php             |   5 +-
 src/wp-includes/theme.php                     |  32 ++---
 .../class-wp-widget-recent-comments.php       |   2 +-
 .../tests/dependencies/wpInlineStyleTag.php   | 109 ++++++++++++++++++
 tests/phpunit/tests/template.php              |   5 +-
 6 files changed, 126 insertions(+), 32 deletions(-)

diff --git a/src/wp-includes/fonts/class-wp-font-face.php b/src/wp-includes/fonts/class-wp-font-face.php
index c8d081b9557b5..efb2eff0f58bf 100644
--- a/src/wp-includes/fonts/class-wp-font-face.php
+++ b/src/wp-includes/fonts/class-wp-font-face.php
@@ -92,10 +92,7 @@ public function generate_and_print( array $fonts ) {
 			return;
 		}
 
-		$processor = new WP_HTML_Tag_Processor( '<style class="wp-fonts-local"></style>' );
-		$processor->next_tag();
-		$processor->set_modifiable_text( "\n{$css}\n" );
-		echo "{$processor->get_updated_html()}\n";
+		wp_print_inline_style_tag( $css, array( 'class' => 'wp-fonts-local' ) );
 	}
 
 	/**
diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index c4f0f9739f68e..b28b3e5390bf2 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3934,10 +3934,7 @@ function wp_enqueue_block_support_styles( $style, $priority = 10 ) {
 	add_action(
 		$action_hook_name,
 		static function () use ( $style ) {
-			$processor = new WP_HTML_Tag_Processor( '<style></style>' );
-			$processor->next_tag();
-			$processor->set_modifiable_text( $style );
-			echo "{$processor->get_updated_html()}\n";
+			wp_print_inline_style_tag( $style );
 		},
 		$priority
 	);
diff --git a/src/wp-includes/theme.php b/src/wp-includes/theme.php
index d81616c6c552f..27492c22509da 100644
--- a/src/wp-includes/theme.php
+++ b/src/wp-includes/theme.php
@@ -1899,7 +1899,7 @@ function _custom_background_cb() {
 
 	if ( ! $background && ! $color ) {
 		if ( is_customize_preview() ) {
-			echo '<style id="custom-background-css"></style>';
+			wp_print_inline_style_tag( '', array( 'id' => 'custom-background-css' ) );
 		}
 		return;
 	}
@@ -1953,12 +1953,10 @@ function _custom_background_cb() {
 		$style .= $image . $position . $size . $repeat . $attachment;
 	}
 
-	$processor = new WP_HTML_Tag_Processor( '<style id="custom-background-css"></style>' );
-	$processor->next_tag();
-
-	$style_tag_content = 'body.custom-background { ' . trim( $style ) . ' }';
-	$processor->set_modifiable_text( "\n{$style_tag_content}\n" );
-	echo "{$processor->get_updated_html()}\n";
+	wp_print_inline_style_tag(
+		'body.custom-background { ' . trim( $style ) . ' }',
+		array( 'id' => 'custom-background-css' )
+	);
 }
 
 /**
@@ -1972,11 +1970,7 @@ function wp_custom_css_cb() {
 		return;
 	}
 
-	$processor = new WP_HTML_Tag_Processor( '<style></style>' );
-	$processor->next_tag();
-	$processor->set_attribute( 'id', 'wp-custom-css' );
-	$processor->set_modifiable_text( "\n{$styles}\n" );
-	echo "{$processor->get_updated_html()}\n";
+	wp_print_inline_style_tag( $styles, array( 'id' => 'wp-custom-css' ) );
 }
 
 /**
@@ -3006,15 +3000,11 @@ function _custom_logo_header_styles() {
 		$classes = (array) get_theme_support( 'custom-logo', 'header-text' );
 		$classes = array_map( 'sanitize_html_class', $classes );
 		$classes = '.' . implode( ', .', $classes );
-		?>
-		<!-- Custom Logo: hide header text -->
-		<style id="custom-logo-css">
-			<?php echo $classes; ?> {
-				position: absolute;
-				clip-path: inset(50%);
-			}
-		</style>
-		<?php
+		echo "<!-- Custom Logo: hide header text -->\n";
+		wp_print_inline_style_tag(
+			"{$classes} {\n\tposition: absolute;\n\tclip-path: inset(50%);\n}",
+			array( 'id' => 'custom-logo-css' )
+		);
 	}
 }
 
diff --git a/src/wp-includes/widgets/class-wp-widget-recent-comments.php b/src/wp-includes/widgets/class-wp-widget-recent-comments.php
index 246eac6cf9d72..475cb2a1aae90 100644
--- a/src/wp-includes/widgets/class-wp-widget-recent-comments.php
+++ b/src/wp-includes/widgets/class-wp-widget-recent-comments.php
@@ -55,7 +55,7 @@ public function recent_comments_style() {
 			return;
 		}
 
-		echo '<style>.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}</style>';
+		wp_print_inline_style_tag( '.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}' );
 	}
 
 	/**
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index edab921a8c36b..18a23c2f7de31 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -161,6 +161,115 @@ public function test_inline_style_tag_escapes_closing_style_tag() {
 		$this->assertFalse( $processor->next_tag(), 'Expected the CSS to not break out of the STYLE element.' );
 	}
 
+	/**
+	 * Data provider for test_core_inline_styles_have_filtered_attributes().
+	 *
+	 * @return array<non-falsy-string, array{ set_up: Closure(): void, print_callback: callable(): void, attribute_name: non-falsy-string, attribute_value: non-falsy-string }>
+	 */
+	public function data_core_inline_styles(): array {
+		return array(
+			'custom_background' => array(
+				'set_up'          => static function (): void {
+					add_theme_support( 'custom-background' );
+					set_theme_mod( 'background_color', 'ff0000' );
+				},
+				'print_callback'  => '_custom_background_cb',
+				'attribute_name'  => 'id',
+				'attribute_value' => 'custom-background-css',
+			),
+			'custom_css'        => array(
+				'set_up'          => static function (): void {
+					add_filter(
+						'wp_get_custom_css',
+						static function (): string {
+							return 'body { color: #123456; }';
+						}
+					);
+				},
+				'print_callback'  => 'wp_custom_css_cb',
+				'attribute_name'  => 'id',
+				'attribute_value' => 'wp-custom-css',
+			),
+			'custom_logo'       => array(
+				'set_up'          => static function (): void {
+					remove_theme_support( 'custom-header' );
+					add_theme_support( 'custom-logo', array( 'header-text' => array( 'site-title' ) ) );
+					set_theme_mod( 'header_text', false );
+				},
+				'print_callback'  => '_custom_logo_header_styles',
+				'attribute_name'  => 'id',
+				'attribute_value' => 'custom-logo-css',
+			),
+			'font_faces'        => array(
+				'set_up'          => static function (): void {},
+				'print_callback'  => static function (): void {
+					wp_print_font_faces(
+						array(
+							'Inter' => array(
+								array(
+									'font-family' => 'Inter',
+									'src'         => array( 'https://example.com/inter.woff2' ),
+								),
+							),
+						)
+					);
+				},
+				'attribute_name'  => 'class',
+				'attribute_value' => 'wp-fonts-local',
+			),
+			'recent_comments'   => array(
+				'set_up'          => static function (): void {
+					add_theme_support( 'widgets' );
+				},
+				'print_callback'  => static function (): void {
+					( new WP_Widget_Recent_Comments() )->recent_comments_style();
+				},
+				'attribute_name'  => 'nonce',
+				'attribute_value' => 'test-nonce',
+			),
+		);
+	}
+
+	/**
+	 * Tests that inline styles printed by core outside of WP_Styles have filtered attributes.
+	 *
+	 * @ticket 51325
+	 *
+	 * @covers ::_custom_background_cb
+	 * @covers ::wp_custom_css_cb
+	 * @covers ::_custom_logo_header_styles
+	 * @covers WP_Font_Face::generate_and_print
+	 * @covers WP_Widget_Recent_Comments::recent_comments_style
+	 *
+	 * @dataProvider data_core_inline_styles
+	 *
+	 * @param Closure(): void    $set_up          Set up callback.
+	 * @param callable(): void   $print_callback  Callback which prints the inline style.
+	 * @param non-falsy-string   $attribute_name  Name of an attribute the STYLE tag is expected to have.
+	 * @param non-falsy-string   $attribute_value Expected value of the attribute.
+	 */
+	public function test_core_inline_styles_have_filtered_attributes( Closure $set_up, callable $print_callback, string $attribute_name, string $attribute_value ): void {
+		$set_up();
+
+		$filter = new MockAction();
+		add_filter( 'wp_inline_style_attributes', array( $filter, 'filter' ) );
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( array $attributes ): array {
+				$attributes['nonce'] = 'test-nonce';
+				return $attributes;
+			}
+		);
+
+		$processor = new WP_HTML_Tag_Processor( get_echo( $print_callback ) );
+
+		$this->assertTrue( $processor->next_tag( 'STYLE' ), 'Expected a STYLE tag to be printed.' );
+		$this->assertSame( $attribute_value, $processor->get_attribute( $attribute_name ) );
+		$this->assertSame( 'test-nonce', $processor->get_attribute( 'nonce' ) );
+		$this->assertFalse( $processor->next_tag(), 'Expected only one tag to be printed.' );
+		$this->assertSame( 1, $filter->get_call_count(), 'Expected the filter to be applied once.' );
+	}
+
 	/**
 	 * Gets test CSS code.
 	 *
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index 264a9079a3807..1547aab02a179 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1808,9 +1808,10 @@ static function ( array $attributes ): array {
 					$processor = new WP_HTML_Tag_Processor( $filtered_buffer );
 					$found     = false;
 					while ( $processor->next_tag( 'STYLE' ) ) {
-						if ( 'wp-block-library-inline-css-extra' === $processor->get_attribute( 'id' ) ) {
+						$id = $processor->get_attribute( 'id' );
+						$this->assertSame( 'test-nonce', $processor->get_attribute( 'nonce' ), sprintf( 'Expected the STYLE tag with ID "%s" to have the filtered attributes.', is_string( $id ) ? $id : '' ) );
+						if ( 'wp-block-library-inline-css-extra' === $id ) {
 							$found = true;
-							$this->assertSame( 'test-nonce', $processor->get_attribute( 'nonce' ), 'Expected the hoisted extra inline style to have the filtered attributes.' );
 							$this->assertStringContainsString( '.wp-block-separator{ outline:solid 1px lime; }', $processor->get_modifiable_text() );
 						}
 					}

From 2f547ecf51f63c0b3b2a01ce18d32605b81cf124 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:05:52 -0700
Subject: [PATCH 09/68] Restore theme features after inline style tag tests

The core inline style data sets add and remove theme support, which is
not restored automatically between tests. The leaked custom-background
support caused WP_Test_REST_Themes_Controller to fail with an undefined
$custom_background global when run after these tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../tests/dependencies/wpInlineStyleTag.php   | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 18a23c2f7de31..3a7d95de80960 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -10,6 +10,31 @@
  */
 class Tests_Dependencies_wpInlineStyleTag extends WP_UnitTestCase {
 
+	/**
+	 * Theme features before each test, since they are not restored automatically.
+	 *
+	 * @var array<string, mixed>
+	 */
+	private array $original_theme_features;
+
+	/**
+	 * @global array<string, mixed> $_wp_theme_features
+	 */
+	public function set_up(): void {
+		global $_wp_theme_features;
+		parent::set_up();
+		$this->original_theme_features = $_wp_theme_features;
+	}
+
+	/**
+	 * @global array<string, mixed> $_wp_theme_features
+	 */
+	public function tear_down(): void {
+		global $_wp_theme_features;
+		$_wp_theme_features = $this->original_theme_features;
+		parent::tear_down();
+	}
+
 	/**
 	 * @ticket 51325
 	 */

From cee3db6a4a98c26a60bce294a8bbf6beee81e273 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:06:39 -0700
Subject: [PATCH 10/68] Use inline style tag API in default wp_die() handler

Print the error page styles with wp_print_inline_style_tag() so that
they receive attributes from the wp_inline_style_attributes filter. Since
wp_die() may be called before script-loader.php and the HTML API are
loaded, fall back to a literal STYLE tag in that case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/functions.php | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index c07a670d763d7..591d250e18730 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -4018,7 +4018,8 @@ function _default_wp_die_handler( $message, $title = '', $args = array() ) {
 		}
 		?>
 	<title><?php echo $title; ?></title>
-	<style>
+		<?php
+		$css = <<<'CSS'
 		html {
 			background: #f1f1f1;
 		}
@@ -4120,13 +4121,18 @@ function _default_wp_die_handler( $message, $title = '', $args = array() ) {
 			-webkit-box-shadow: none;
 			box-shadow: none;
 		}
-
-		<?php
+		CSS;
 		if ( 'rtl' === $text_direction ) {
-			echo 'body { font-family: Tahoma, Arial; }';
+			$css .= "\nbody { font-family: Tahoma, Arial; }";
+		}
+
+		// The wp_die() handler may be called before the inline style tag API has loaded.
+		if ( function_exists( 'wp_print_inline_style_tag' ) && class_exists( 'WP_HTML_Tag_Processor', false ) ) {
+			wp_print_inline_style_tag( $css );
+		} else {
+			echo "<style>\n{$css}\n</style>\n";
 		}
 		?>
-	</style>
 </head>
 <body id="error-page">
 <?php endif; // ! did_action( 'admin_head' ) ?>

From 3de2648079c494fc12958dc2fbae20c71a088b56 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:06:59 -0700
Subject: [PATCH 11/68] Use inline style tag API for interim login style

Print the transparent background style for the interim login modal with
wp_print_inline_style_tag() so that it receives filtered attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-login.php | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/wp-login.php b/src/wp-login.php
index 5a8df12b01c5e..a2c0fe91cfbc5 100644
--- a/src/wp-login.php
+++ b/src/wp-login.php
@@ -175,9 +175,7 @@ function login_header( $title = null, $message = '', $wp_error = null ) {
 	if ( $interim_login ) {
 		$classes[] = 'interim-login';
 
-		?>
-		<style>html{background-color: transparent;}</style>
-		<?php
+		wp_print_inline_style_tag( 'html{background-color: transparent;}' );
 
 		if ( 'success' === $interim_login ) {
 			$classes[] = 'interim-login-success';

From b727644573774be595e9f1f514f0ff04f71f1e6c Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:07:02 -0700
Subject: [PATCH 12/68] Use inline style tag API on Multisite signup and
 activation

Print the styles for wp-signup.php and wp-activate.php with
wp_print_inline_style_tag() so that they receive filtered attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-activate.php | 8 ++++----
 src/wp-signup.php   | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/wp-activate.php b/src/wp-activate.php
index 1de0f60c6cfd5..aed538a7e13fb 100644
--- a/src/wp-activate.php
+++ b/src/wp-activate.php
@@ -104,8 +104,8 @@ function do_activate_header() {
  * @since MU (3.0.0)
  */
 function wpmu_activate_stylesheet() {
-	?>
-	<style>
+	wp_print_inline_style_tag(
+		<<<'CSS'
 		.wp-activate-container { width: 90%; margin: 0 auto; text-align: start; padding: 24px; box-sizing: border-box; }
 		.wp-activate-container form { margin: 24px 0; }
 		.wp-activate-container p { font-size: 18px; }
@@ -113,8 +113,8 @@ function wpmu_activate_stylesheet() {
 		#key { width: 100%; direction: ltr; }
 		#submit { width: auto; }
 		span.h3 { font-weight: 600; }
-	</style>
-	<?php
+		CSS
+	);
 }
 add_action( 'wp_head', 'wpmu_activate_stylesheet' );
 add_action( 'wp_head', 'wp_strict_cross_origin_referrer' );
diff --git a/src/wp-signup.php b/src/wp-signup.php
index a53013a76b5c6..f4c1e40332297 100644
--- a/src/wp-signup.php
+++ b/src/wp-signup.php
@@ -67,8 +67,8 @@ function do_signup_header() {
  * @since MU (3.0.0)
  */
 function wpmu_signup_stylesheet() {
-	?>
-	<style>
+	wp_print_inline_style_tag(
+		<<<'CSS'
 		.mu_register { width: 90%; margin: 0 auto; text-align: start; padding: 24px; box-sizing: border-box; }
 		.mu_register p { font-size: 18px; }
 		.mu_register form { margin: 24px 0; }
@@ -99,8 +99,8 @@ function wpmu_signup_stylesheet() {
 		.mu_register .privacy-intro .wp-signup-radio-button { margin-right: 0.5em; }
 		.rtl .mu_register .wp-signup-blogname { direction: ltr; text-align: right; }
 		.rtl .mu_register label[for="site-language"] .dashicons { margin-right: 0.5em; margin-left: 0; }
-	</style>
-	<?php
+		CSS
+	);
 }
 add_action( 'wp_head', 'wpmu_signup_stylesheet' );
 

From 4a2c1d0cdcc88eef3d7782aaa1e2014c82a0b2e9 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:07:32 -0700
Subject: [PATCH 13/68] Use inline style tag API for plugin information banner

Print the banner background styles in the plugin information modal
with wp_print_inline_style_tag() so that they receive filtered
attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-admin/includes/plugin-install.php | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/wp-admin/includes/plugin-install.php b/src/wp-admin/includes/plugin-install.php
index ffae71c5b81f6..4576c933e5f53 100644
--- a/src/wp-admin/includes/plugin-install.php
+++ b/src/wp-admin/includes/plugin-install.php
@@ -606,18 +606,20 @@ function install_plugin_information() {
 		$_with_banner = 'with-banner';
 		$low          = empty( $api->banners['low'] ) ? $api->banners['high'] : $api->banners['low'];
 		$high         = empty( $api->banners['high'] ) ? $api->banners['low'] : $api->banners['high'];
-		?>
-		<style>
+		$low_url      = esc_url( $low );
+		$high_url     = esc_url( $high );
+		wp_print_inline_style_tag(
+			<<<CSS
 			#plugin-information-title.with-banner {
-				background-image: url( <?php echo esc_url( $low ); ?> );
+				background-image: url( {$low_url} );
 			}
 			@media only screen and ( -webkit-min-device-pixel-ratio: 1.5 ) {
 				#plugin-information-title.with-banner {
-					background-image: url( <?php echo esc_url( $high ); ?> );
+					background-image: url( {$high_url} );
 				}
 			}
-		</style>
-		<?php
+			CSS
+		);
 	}
 
 	echo '<div id="plugin-information-scrollable">';

From d8101947d7fd00a5b3e802d28ddfa845b9f18c83 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:07:36 -0700
Subject: [PATCH 14/68] Use inline style tag API for site icon preview in
 General Settings

Print the site icon URL custom property with wp_print_inline_style_tag()
so that it receives filtered attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-admin/options-general.php | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/wp-admin/options-general.php b/src/wp-admin/options-general.php
index 1e6e00ea703d8..00f6465fe0945 100644
--- a/src/wp-admin/options-general.php
+++ b/src/wp-admin/options-general.php
@@ -188,14 +188,16 @@
 			);
 		}
 	}
+	$site_icon_css_url = esc_url( $site_icon_url );
+	wp_print_inline_style_tag(
+		<<<CSS
+		:root {
+			--site-icon-url: url( '{$site_icon_css_url}' );
+		}
+		CSS
+	);
 	?>
 
-	<style>
-	:root {
-		--site-icon-url: url( '<?php echo esc_url( $site_icon_url ); ?>' );
-	}
-	</style>
-
 	<div id="site-icon-preview" class="site-icon-preview settings <?php echo esc_attr( $classes_for_wrapper ); ?>">
 		<div class="direction-wrap">
 			<img id="app-icon-preview" src="<?php echo esc_url( $site_icon_url ); ?>" class="app-icon-preview" alt="<?php echo esc_attr( $app_icon_alt_value ); ?>" />

From a6799e8654ee19bb80479507009a3ec4fe36aae4 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:07:39 -0700
Subject: [PATCH 15/68] Use inline style tag API in Customizer

Print the Customizer preview loading styles, the highlighted widget
styles and the site icon control template styles with
wp_print_inline_style_tag() so that they receive filtered attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../class-wp-customize-manager.php            |  8 +++----
 .../class-wp-customize-widgets.php            | 22 +++++++++----------
 .../class-wp-customize-site-icon-control.php  |  8 +++++--
 3 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/src/wp-includes/class-wp-customize-manager.php b/src/wp-includes/class-wp-customize-manager.php
index 412f575e3afd0..fddfcfc6af189 100644
--- a/src/wp-includes/class-wp-customize-manager.php
+++ b/src/wp-includes/class-wp-customize-manager.php
@@ -2055,8 +2055,8 @@ public function customize_preview_html5() {
 	 * @since 4.2.0
 	 */
 	public function customize_preview_loading_style() {
-		?>
-		<style>
+		wp_print_inline_style_tag(
+			<<<'CSS'
 			body.wp-customizer-unloading {
 				opacity: 0.25;
 				cursor: progress !important;
@@ -2074,8 +2074,8 @@ public function customize_preview_loading_style() {
 			area.customize-unpreviewable {
 				cursor: not-allowed !important;
 			}
-		</style>
-		<?php
+			CSS
+		);
 	}
 
 	/**
diff --git a/src/wp-includes/class-wp-customize-widgets.php b/src/wp-includes/class-wp-customize-widgets.php
index d7cd0d5de15dd..bdb3553c28b20 100644
--- a/src/wp-includes/class-wp-customize-widgets.php
+++ b/src/wp-includes/class-wp-customize-widgets.php
@@ -1283,17 +1283,17 @@ public function customize_preview_enqueue() {
 	 * @since 3.9.0
 	 */
 	public function print_preview_css() {
-		?>
-		<style>
-		.widget-customizer-highlighted-widget {
-			outline: none;
-			-webkit-box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
-			box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
-			position: relative;
-			z-index: 1;
-		}
-		</style>
-		<?php
+		wp_print_inline_style_tag(
+			<<<'CSS'
+			.widget-customizer-highlighted-widget {
+				outline: none;
+				-webkit-box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
+				box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
+				position: relative;
+				z-index: 1;
+			}
+			CSS
+		);
 	}
 
 	/**
diff --git a/src/wp-includes/customize/class-wp-customize-site-icon-control.php b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
index e8dd34070d74c..1f95b2cc720de 100644
--- a/src/wp-includes/customize/class-wp-customize-site-icon-control.php
+++ b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
@@ -58,11 +58,15 @@ public function content_template() {
 		<# if ( data.attachment && data.attachment.id ) { #>
 			<div class="attachment-media-view">
 				<# if ( data.attachment.sizes ) { #>
-					<style>
+					<?php
+					wp_print_inline_style_tag(
+						<<<'CSS'
 						:root{
 							--site-icon-url: url( '{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}' );
 						}
-					</style>
+						CSS
+					);
+					?>
 					<div class="site-icon-preview customizer">
 						<div class="direction-wrap">
 							<img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" class="app-icon-preview" alt="{{

From 5ac7b82884452f7bbf5f95241ed2118ab726f265 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:07:47 -0700
Subject: [PATCH 16/68] Use inline style tag API for site icon crop preview
 template

Print the site icon URL custom property in the tmpl-site-icon-preview-crop
template with wp_print_inline_style_tag() so that it receives filtered
attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/media-template.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/media-template.php b/src/wp-includes/media-template.php
index ee9c6bc21a1c3..0a198d8e1ef1a 100644
--- a/src/wp-includes/media-template.php
+++ b/src/wp-includes/media-template.php
@@ -1561,11 +1561,15 @@ function wp_print_media_templates() {
 
 	<?php // Template for the Site Icon preview, used for example in the Customizer. ?>
 	<script type="text/html" id="tmpl-site-icon-preview-crop">
-		<style>
+		<?php
+		wp_print_inline_style_tag(
+			<<<'CSS'
 			:root{
 				--site-icon-url: url( "{{ data.url }}" );
 			}
-		</style>
+			CSS
+		);
+		?>
 		<h2><?php _ex( 'Site Icon Preview', 'noun' ); ?></h2>
 		<p><?php _e( 'As an app icon and a browser icon.' ); ?></p>
 		<div class="site-icon-preview crop">

From dfa73a57179ec6d77db498c520957957e60da26a Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:07:49 -0700
Subject: [PATCH 17/68] Use inline style tag API for default gallery styles

Build the gallery shortcode's default STYLE tag with
wp_get_inline_style_tag() so that it receives filtered attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/media.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php
index 2ffa92f2edba0..251d28ff0b8d9 100644
--- a/src/wp-includes/media.php
+++ b/src/wp-includes/media.php
@@ -2989,8 +2989,8 @@ function gallery_shortcode( $attr ) {
 	 *                    Otherwise, defaults to true.
 	 */
 	if ( apply_filters( 'use_default_gallery_style', ! $html5 ) ) {
-		$gallery_style = "
-		<style>
+		$gallery_style = "\n\t\t" . wp_get_inline_style_tag(
+			<<<CSS
 			#{$selector} {
 				margin: auto;
 			}
@@ -3007,7 +3007,8 @@ function gallery_shortcode( $attr ) {
 				margin-left: 0;
 			}
 			/* see gallery_shortcode() in wp-includes/media.php */
-		</style>\n\t\t";
+			CSS
+		) . "\t\t";
 	}
 
 	$size_class  = sanitize_html_class( is_array( $atts['size'] ) ? implode( 'x', $atts['size'] ) : $atts['size'] );

From b290c962d8e7339d6dc5808ba7f3b1f70e4c0f4f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 12:07:57 -0700
Subject: [PATCH 18/68] Use inline style tag API for Legacy Widget previews

Print the reset styles in the Legacy Widget block preview and the REST
API widget preview iframe with wp_print_inline_style_tag() so that they
receive filtered attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/blocks/legacy-widget.php                  | 8 ++++++--
 .../endpoints/class-wp-rest-widget-types-controller.php   | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/wp-includes/blocks/legacy-widget.php b/src/wp-includes/blocks/legacy-widget.php
index bec1b16b6ba8c..c35fb0ead9b4b 100644
--- a/src/wp-includes/blocks/legacy-widget.php
+++ b/src/wp-includes/blocks/legacy-widget.php
@@ -98,7 +98,9 @@ function handle_legacy_widget_preview_iframe() {
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
 		<link rel="profile" href="https://gmpg.org/xfn/11" />
 		<?php wp_head(); ?>
-		<style>
+		<?php
+		wp_print_inline_style_tag(
+			<<<'CSS'
 			/* Reset theme styles */
 			html, body, #page, #content {
 				padding: 0 !important;
@@ -131,7 +133,9 @@ function handle_legacy_widget_preview_iframe() {
 			.widget {
 				font-size: var(--global--font-size-base);
 			}
-		</style>
+			CSS
+		);
+		?>
 	</head>
 	<body <?php body_class(); ?>>
 		<div id="page" class="site">
diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php
index cd905188512b3..18f3b49c3810a 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php
@@ -638,13 +638,17 @@ private function render_legacy_widget_preview_iframe( $id_base, $instance ) {
 			<meta name="viewport" content="width=device-width, initial-scale=1" />
 			<link rel="profile" href="https://gmpg.org/xfn/11" />
 			<?php wp_head(); ?>
-			<style>
+			<?php
+			wp_print_inline_style_tag(
+				<<<'CSS'
 				/* Reset theme styles */
 				html, body, #page, #content {
 					padding: 0 !important;
 					margin: 0 !important;
 				}
-			</style>
+				CSS
+			);
+			?>
 		</head>
 		<body <?php body_class(); ?>>
 		<div id="page" class="site">

From 1a312c648032781a830df68fbfe440497a22199f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 15:44:49 -0700
Subject: [PATCH 19/68] Use inline style tag API in deprecated functions

Print the STYLE tags in print_embed_styles(), print_emoji_styles(),
wp_admin_bar_header(), _admin_bar_bump_cb(),
the_block_template_skip_link(), wp_print_auto_sizes_contain_css_fix()
and graceful_fail() with the inline style tag API so that they receive
filtered attributes when still called by plugins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/deprecated.php    | 72 ++++++++++++++-----------------
 src/wp-includes/ms-deprecated.php | 31 ++++++-------
 2 files changed, 49 insertions(+), 54 deletions(-)

diff --git a/src/wp-includes/deprecated.php b/src/wp-includes/deprecated.php
index df621af9267c4..417461aa7c053 100644
--- a/src/wp-includes/deprecated.php
+++ b/src/wp-includes/deprecated.php
@@ -5946,11 +5946,7 @@ function print_embed_styles() {
 	_deprecated_function( __FUNCTION__, '6.4.0', 'wp_enqueue_embed_styles' );
 
 	$suffix = SCRIPT_DEBUG ? '' : '.min';
-	?>
-	<style>
-		<?php echo file_get_contents( ABSPATH . WPINC . "/css/wp-embed-template$suffix.css" ); ?>
-	</style>
-	<?php
+	wp_print_inline_style_tag( (string) file_get_contents( ABSPATH . WPINC . "/css/wp-embed-template$suffix.css" ) );
 }
 
 /**
@@ -5969,22 +5965,22 @@ function print_emoji_styles() {
 
 	$printed = true;
 
-	?>
-	<style>
-	img.wp-smiley,
-	img.emoji {
-		display: inline !important;
-		border: none !important;
-		box-shadow: none !important;
-		height: 1em !important;
-		width: 1em !important;
-		margin: 0 0.07em !important;
-		vertical-align: -0.1em !important;
-		background: none !important;
-		padding: 0 !important;
-	}
-	</style>
-	<?php
+	wp_print_inline_style_tag(
+		<<<'CSS'
+		img.wp-smiley,
+		img.emoji {
+			display: inline !important;
+			border: none !important;
+			box-shadow: none !important;
+			height: 1em !important;
+			width: 1em !important;
+			margin: 0 0.07em !important;
+			vertical-align: -0.1em !important;
+			background: none !important;
+			padding: 0 !important;
+		}
+		CSS
+	);
 }
 
 /**
@@ -5995,9 +5991,7 @@ function print_emoji_styles() {
  */
 function wp_admin_bar_header() {
 	_deprecated_function( __FUNCTION__, '6.4.0', 'wp_enqueue_admin_bar_header_styles' );
-	?>
-	<style media="print">#wpadminbar { display:none; }</style>
-	<?php
+	wp_print_inline_style_tag( '#wpadminbar { display:none; }', array( 'media' => 'print' ) );
 }
 
 /**
@@ -6008,14 +6002,15 @@ function wp_admin_bar_header() {
  */
 function _admin_bar_bump_cb() {
 	_deprecated_function( __FUNCTION__, '6.4.0', 'wp_enqueue_admin_bar_bump_styles' );
-	?>
-	<style media="screen">
-	html { margin-top: 32px !important; }
-	@media screen and ( max-width: 782px ) {
-	  html { margin-top: 46px !important; }
-	}
-	</style>
-	<?php
+	wp_print_inline_style_tag(
+		<<<'CSS'
+		html { margin-top: 32px !important; }
+		@media screen and ( max-width: 782px ) {
+		  html { margin-top: 46px !important; }
+		}
+		CSS,
+		array( 'media' => 'screen' )
+	);
 }
 
 /**
@@ -6209,8 +6204,8 @@ function the_block_template_skip_link() {
 	/**
 	 * Print the skip-link styles.
 	 */
-	?>
-	<style id="skip-link-styles">
+	wp_print_inline_style_tag(
+		<<<'CSS'
 		.skip-link.screen-reader-text {
 			border: 0;
 			clip-path: inset(50%);
@@ -6240,8 +6235,9 @@ function the_block_template_skip_link() {
 			width: auto;
 			z-index: 100000;
 		}
-	</style>
-	<?php
+		CSS,
+		array( 'id' => 'skip-link-styles' )
+	);
 	/**
 	 * Print the skip-link script.
 	 */
@@ -6530,9 +6526,7 @@ function wp_print_auto_sizes_contain_css_fix() {
 		return;
 	}
 
-	?>
-	<style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>
-	<?php
+	wp_print_inline_style_tag( 'img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }' );
 }
 
 /**
diff --git a/src/wp-includes/ms-deprecated.php b/src/wp-includes/ms-deprecated.php
index 8b4a1ff6f023f..c25e81c4544e1 100644
--- a/src/wp-includes/ms-deprecated.php
+++ b/src/wp-includes/ms-deprecated.php
@@ -96,21 +96,22 @@ function graceful_fail( $message ) {
 <html><head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
 <title>Error!</title>
-<style>
-img {
-	border: 0;
-}
-body {
-line-height: 1.6em; font-family: Georgia, serif; width: 390px; margin: auto;
-text-align: center;
-}
-.message {
-	font-size: 22px;
-	width: 350px;
-	margin: auto;
-}
-</style>
-</head>
+' . wp_get_inline_style_tag(
+	<<<'CSS'
+	img {
+		border: 0;
+	}
+	body {
+	line-height: 1.6em; font-family: Georgia, serif; width: 390px; margin: auto;
+	text-align: center;
+	}
+	.message {
+		font-size: 22px;
+		width: 350px;
+		margin: auto;
+	}
+	CSS
+) . '</head>
 <body>
 <p class="message">%s</p>
 </body>

From db14096e800bb50069b48b9291596a145589bbab Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 15:44:51 -0700
Subject: [PATCH 20/68] Use inline style tag API in theme compat header

Print the Kubrick background style in the theme compatibility header
template with wp_print_inline_style_tag() so that it receives filtered
attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/theme-compat/header.php | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/wp-includes/theme-compat/header.php b/src/wp-includes/theme-compat/header.php
index 340477fb94f1e..6001880ca7b0a 100644
--- a/src/wp-includes/theme-compat/header.php
+++ b/src/wp-includes/theme-compat/header.php
@@ -26,20 +26,20 @@
 <link rel="stylesheet" href="<?php bloginfo( 'stylesheet_url' ); ?>" media="screen" />
 <link rel="pingback" href="<?php bloginfo( 'pingback_url' ); ?>" />
 
-<?php if ( file_exists( get_stylesheet_directory() . '/images/kubrickbgwide.jpg' ) ) { ?>
-<style media="screen">
-
-	<?php
+<?php
+if ( file_exists( get_stylesheet_directory() . '/images/kubrickbgwide.jpg' ) ) {
 	// Checks to see whether it needs a sidebar.
 	if ( empty( $withcomments ) && ! is_single() ) {
-		?>
-	#page { background: url("<?php bloginfo( 'stylesheet_directory' ); ?>/images/kubrickbg-<?php bloginfo( 'text_direction' ); ?>.jpg") repeat-y top; border: none; }
-<?php } else { // No sidebar. ?>
-	#page { background: url("<?php bloginfo( 'stylesheet_directory' ); ?>/images/kubrickbgwide.jpg") repeat-y top; border: none; }
-<?php } ?>
-
-</style>
-<?php } ?>
+		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbg-' . get_bloginfo( 'text_direction', 'display' ) . '.jpg';
+	} else { // No sidebar.
+		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbgwide.jpg';
+	}
+	wp_print_inline_style_tag(
+		sprintf( '#page { background: url("%s") repeat-y top; border: none; }', $kubrick_background ),
+		array( 'media' => 'screen' )
+	);
+}
+?>
 
 <?php
 if ( is_singular() ) {

From 8dc24253ff2edb1db799158d9277ea4910e61dbe Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 20:38:05 -0700
Subject: [PATCH 21/68] Use nowdoc for one-line CSS in deprecated functions

Pass the CSS for wp_admin_bar_header() and
wp_print_auto_sizes_contain_css_fix() as a CSS nowdoc, like the other
inline styles, so that IDEs apply CSS syntax highlighting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/deprecated.php | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/deprecated.php b/src/wp-includes/deprecated.php
index 417461aa7c053..c9cdec64a2818 100644
--- a/src/wp-includes/deprecated.php
+++ b/src/wp-includes/deprecated.php
@@ -5991,7 +5991,12 @@ function print_emoji_styles() {
  */
 function wp_admin_bar_header() {
 	_deprecated_function( __FUNCTION__, '6.4.0', 'wp_enqueue_admin_bar_header_styles' );
-	wp_print_inline_style_tag( '#wpadminbar { display:none; }', array( 'media' => 'print' ) );
+	wp_print_inline_style_tag(
+		<<<'CSS'
+		#wpadminbar { display:none; }
+		CSS,
+		array( 'media' => 'print' )
+	);
 }
 
 /**
@@ -6526,7 +6531,11 @@ function wp_print_auto_sizes_contain_css_fix() {
 		return;
 	}
 
-	wp_print_inline_style_tag( 'img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }' );
+	wp_print_inline_style_tag(
+		<<<'CSS'
+		img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }
+		CSS
+	);
 }
 
 /**

From bd7687b285c310780d53a7b39e28208190d7dd15 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 20:38:09 -0700
Subject: [PATCH 22/68] Use nowdoc for one-line CSS in interim login and Recent
 Comments widget

Pass the CSS as a CSS nowdoc, like the other inline styles, so that IDEs
apply CSS syntax highlighting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/widgets/class-wp-widget-recent-comments.php | 6 +++++-
 src/wp-login.php                                            | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/widgets/class-wp-widget-recent-comments.php b/src/wp-includes/widgets/class-wp-widget-recent-comments.php
index 475cb2a1aae90..e7fa16c4e0f52 100644
--- a/src/wp-includes/widgets/class-wp-widget-recent-comments.php
+++ b/src/wp-includes/widgets/class-wp-widget-recent-comments.php
@@ -55,7 +55,11 @@ public function recent_comments_style() {
 			return;
 		}
 
-		wp_print_inline_style_tag( '.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}' );
+		wp_print_inline_style_tag(
+			<<<'CSS'
+			.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}
+			CSS
+		);
 	}
 
 	/**
diff --git a/src/wp-login.php b/src/wp-login.php
index a2c0fe91cfbc5..03faf59f87240 100644
--- a/src/wp-login.php
+++ b/src/wp-login.php
@@ -175,7 +175,11 @@ function login_header( $title = null, $message = '', $wp_error = null ) {
 	if ( $interim_login ) {
 		$classes[] = 'interim-login';
 
-		wp_print_inline_style_tag( 'html{background-color: transparent;}' );
+		wp_print_inline_style_tag(
+			<<<'CSS'
+			html{background-color: transparent;}
+			CSS
+		);
 
 		if ( 'success' === $interim_login ) {
 			$classes[] = 'interim-login-success';

From a976fe204761857ce9287761f59fa46b73597435 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 20:43:58 -0700
Subject: [PATCH 23/68] Use esc_url_raw() for plugin banner URLs in inline
 style

HTML character references are not decoded in STYLE elements, so the
&#038; produced by esc_url() for a URL with multiple query parameters
would end up in the CSS literally. Escape with esc_url_raw() instead,
and wrap the URLs in double quotes: esc_url_raw() strips double quotes
but not single quotes or parentheses, so an unquoted url() token could
otherwise be terminated by the URL. Name the variables to make clear
they are already escaped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-admin/includes/plugin-install.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/wp-admin/includes/plugin-install.php b/src/wp-admin/includes/plugin-install.php
index 4576c933e5f53..eecebec85d891 100644
--- a/src/wp-admin/includes/plugin-install.php
+++ b/src/wp-admin/includes/plugin-install.php
@@ -606,16 +606,16 @@ function install_plugin_information() {
 		$_with_banner = 'with-banner';
 		$low          = empty( $api->banners['low'] ) ? $api->banners['high'] : $api->banners['low'];
 		$high         = empty( $api->banners['high'] ) ? $api->banners['low'] : $api->banners['high'];
-		$low_url      = esc_url( $low );
-		$high_url     = esc_url( $high );
+		$escaped_low  = esc_url_raw( $low );
+		$escaped_high = esc_url_raw( $high );
 		wp_print_inline_style_tag(
 			<<<CSS
 			#plugin-information-title.with-banner {
-				background-image: url( {$low_url} );
+				background-image: url( "{$escaped_low}" );
 			}
 			@media only screen and ( -webkit-min-device-pixel-ratio: 1.5 ) {
 				#plugin-information-title.with-banner {
-					background-image: url( {$high_url} );
+					background-image: url( "{$escaped_high}" );
 				}
 			}
 			CSS

From a6ee044f7d90065e84975efbb47fa32783f5ea4f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 20:44:01 -0700
Subject: [PATCH 24/68] Use esc_url_raw() for site icon URL in General Settings
 inline style

HTML character references are not decoded in STYLE elements, so escape
the URL with esc_url_raw() instead of esc_url(). Wrap it in double
quotes, since esc_url_raw() strips double quotes but not single quotes,
which could otherwise terminate the CSS string. Name the variable to
make clear it is already escaped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-admin/options-general.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-admin/options-general.php b/src/wp-admin/options-general.php
index 00f6465fe0945..dfc84b479e3ef 100644
--- a/src/wp-admin/options-general.php
+++ b/src/wp-admin/options-general.php
@@ -188,11 +188,11 @@
 			);
 		}
 	}
-	$site_icon_css_url = esc_url( $site_icon_url );
+	$escaped_site_icon_url = esc_url_raw( $site_icon_url );
 	wp_print_inline_style_tag(
 		<<<CSS
 		:root {
-			--site-icon-url: url( '{$site_icon_css_url}' );
+			--site-icon-url: url( "{$escaped_site_icon_url}" );
 		}
 		CSS
 	);

From 7c513025007ad74d20639b15f57166070b2ed718 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 20:44:06 -0700
Subject: [PATCH 25/68] Use esc_url_raw() for theme compat background URL

HTML character references are not decoded in STYLE elements, so obtain
the raw stylesheet directory URL and text direction rather than their
display-filtered values, and escape the resulting URL with
esc_url_raw(). Pass the CSS as a heredoc for syntax highlighting, and
name the variable to make clear it is already escaped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/theme-compat/header.php | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/theme-compat/header.php b/src/wp-includes/theme-compat/header.php
index 6001880ca7b0a..b1002fb8a2297 100644
--- a/src/wp-includes/theme-compat/header.php
+++ b/src/wp-includes/theme-compat/header.php
@@ -30,12 +30,15 @@
 if ( file_exists( get_stylesheet_directory() . '/images/kubrickbgwide.jpg' ) ) {
 	// Checks to see whether it needs a sidebar.
 	if ( empty( $withcomments ) && ! is_single() ) {
-		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbg-' . get_bloginfo( 'text_direction', 'display' ) . '.jpg';
+		$kubrick_background = get_bloginfo( 'stylesheet_directory' ) . '/images/kubrickbg-' . get_bloginfo( 'text_direction' ) . '.jpg';
 	} else { // No sidebar.
-		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbgwide.jpg';
+		$kubrick_background = get_bloginfo( 'stylesheet_directory' ) . '/images/kubrickbgwide.jpg';
 	}
+	$escaped_kubrick_background = esc_url_raw( $kubrick_background );
 	wp_print_inline_style_tag(
-		sprintf( '#page { background: url("%s") repeat-y top; border: none; }', $kubrick_background ),
+		<<<CSS
+		#page { background: url( "{$escaped_kubrick_background}" ) repeat-y top; border: none; }
+		CSS,
 		array( 'media' => 'screen' )
 	);
 }

From a0b53828d6f1f7049d4e3e9b7e918ca973bf0ad3 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 20:44:11 -0700
Subject: [PATCH 26/68] Use double quotes for site icon URL in Customizer
 control template

Match the quoting used for url() values in the other inline styles,
including the site icon crop preview template.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../customize/class-wp-customize-site-icon-control.php          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/customize/class-wp-customize-site-icon-control.php b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
index 1f95b2cc720de..c86e20b1726e4 100644
--- a/src/wp-includes/customize/class-wp-customize-site-icon-control.php
+++ b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
@@ -62,7 +62,7 @@ public function content_template() {
 					wp_print_inline_style_tag(
 						<<<'CSS'
 						:root{
-							--site-icon-url: url( '{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}' );
+							--site-icon-url: url( "{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" );
 						}
 						CSS
 					);

From 14902b9b4050f125434db7507880e4949e245dc6 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 21:47:02 -0700
Subject: [PATCH 27/68] Escape URLs late inside inline style heredocs

Call esc_url_raw() as a variable function inside the heredoc
interpolation, so that the URLs are escaped at the point of output
rather than in separate variables beforehand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-admin/includes/plugin-install.php | 7 +++----
 src/wp-admin/options-general.php         | 4 ++--
 src/wp-includes/theme-compat/header.php  | 4 ++--
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/src/wp-admin/includes/plugin-install.php b/src/wp-admin/includes/plugin-install.php
index eecebec85d891..c675b6cedfd82 100644
--- a/src/wp-admin/includes/plugin-install.php
+++ b/src/wp-admin/includes/plugin-install.php
@@ -606,16 +606,15 @@ function install_plugin_information() {
 		$_with_banner = 'with-banner';
 		$low          = empty( $api->banners['low'] ) ? $api->banners['high'] : $api->banners['low'];
 		$high         = empty( $api->banners['high'] ) ? $api->banners['low'] : $api->banners['high'];
-		$escaped_low  = esc_url_raw( $low );
-		$escaped_high = esc_url_raw( $high );
+		$esc_url_raw  = 'esc_url_raw';
 		wp_print_inline_style_tag(
 			<<<CSS
 			#plugin-information-title.with-banner {
-				background-image: url( "{$escaped_low}" );
+				background-image: url( "{$esc_url_raw( $low )}" );
 			}
 			@media only screen and ( -webkit-min-device-pixel-ratio: 1.5 ) {
 				#plugin-information-title.with-banner {
-					background-image: url( "{$escaped_high}" );
+					background-image: url( "{$esc_url_raw( $high )}" );
 				}
 			}
 			CSS
diff --git a/src/wp-admin/options-general.php b/src/wp-admin/options-general.php
index dfc84b479e3ef..8c9b7bf8a5803 100644
--- a/src/wp-admin/options-general.php
+++ b/src/wp-admin/options-general.php
@@ -188,11 +188,11 @@
 			);
 		}
 	}
-	$escaped_site_icon_url = esc_url_raw( $site_icon_url );
+	$esc_url_raw = 'esc_url_raw';
 	wp_print_inline_style_tag(
 		<<<CSS
 		:root {
-			--site-icon-url: url( "{$escaped_site_icon_url}" );
+			--site-icon-url: url( "{$esc_url_raw( $site_icon_url )}" );
 		}
 		CSS
 	);
diff --git a/src/wp-includes/theme-compat/header.php b/src/wp-includes/theme-compat/header.php
index b1002fb8a2297..9fdf9f9ec2b7b 100644
--- a/src/wp-includes/theme-compat/header.php
+++ b/src/wp-includes/theme-compat/header.php
@@ -34,10 +34,10 @@
 	} else { // No sidebar.
 		$kubrick_background = get_bloginfo( 'stylesheet_directory' ) . '/images/kubrickbgwide.jpg';
 	}
-	$escaped_kubrick_background = esc_url_raw( $kubrick_background );
+	$esc_url_raw = 'esc_url_raw';
 	wp_print_inline_style_tag(
 		<<<CSS
-		#page { background: url( "{$escaped_kubrick_background}" ) repeat-y top; border: none; }
+		#page { background: url( "{$esc_url_raw( $kubrick_background )}" ) repeat-y top; border: none; }
 		CSS,
 		array( 'media' => 'screen' )
 	);

From ee5df2104742e1aaab3fa53c44a0e7a95d87a92f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 21:53:06 -0700
Subject: [PATCH 28/68] Restore display context for theme compat background URL

Getting the raw stylesheet directory URL skipped the bloginfo_url filter,
which plugins use to rewrite asset URLs, for example to a CDN. The
display context applies no escaping to URLs, so esc_url_raw() remains
correct.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/theme-compat/header.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/theme-compat/header.php b/src/wp-includes/theme-compat/header.php
index 9fdf9f9ec2b7b..ae5ffe58e274c 100644
--- a/src/wp-includes/theme-compat/header.php
+++ b/src/wp-includes/theme-compat/header.php
@@ -30,9 +30,9 @@
 if ( file_exists( get_stylesheet_directory() . '/images/kubrickbgwide.jpg' ) ) {
 	// Checks to see whether it needs a sidebar.
 	if ( empty( $withcomments ) && ! is_single() ) {
-		$kubrick_background = get_bloginfo( 'stylesheet_directory' ) . '/images/kubrickbg-' . get_bloginfo( 'text_direction' ) . '.jpg';
+		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbg-' . get_bloginfo( 'text_direction', 'display' ) . '.jpg';
 	} else { // No sidebar.
-		$kubrick_background = get_bloginfo( 'stylesheet_directory' ) . '/images/kubrickbgwide.jpg';
+		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbgwide.jpg';
 	}
 	$esc_url_raw = 'esc_url_raw';
 	wp_print_inline_style_tag(

From aca233e2b7128caa11ba091d289ab1249087e7c6 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sat, 10 Oct 2026 21:53:13 -0700
Subject: [PATCH 29/68] Escape percent signs in graceful_fail() inline style
 tag

The template is a sprintf() format, so a '%' in an attribute value added
via the wp_inline_style_attributes filter would be treated as a
conversion specification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/ms-deprecated.php | 34 +++++++++++++++++--------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/src/wp-includes/ms-deprecated.php b/src/wp-includes/ms-deprecated.php
index c25e81c4544e1..9e9da5e75df71 100644
--- a/src/wp-includes/ms-deprecated.php
+++ b/src/wp-includes/ms-deprecated.php
@@ -96,21 +96,25 @@ function graceful_fail( $message ) {
 <html><head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
 <title>Error!</title>
-' . wp_get_inline_style_tag(
-	<<<'CSS'
-	img {
-		border: 0;
-	}
-	body {
-	line-height: 1.6em; font-family: Georgia, serif; width: 390px; margin: auto;
-	text-align: center;
-	}
-	.message {
-		font-size: 22px;
-		width: 350px;
-		margin: auto;
-	}
-	CSS
+' . str_replace( // Escape any '%' from filtered attributes, since this is a sprintf() format.
+	'%',
+	'%%',
+	wp_get_inline_style_tag(
+		<<<'CSS'
+		img {
+			border: 0;
+		}
+		body {
+		line-height: 1.6em; font-family: Georgia, serif; width: 390px; margin: auto;
+		text-align: center;
+		}
+		.message {
+			font-size: 22px;
+			width: 350px;
+			margin: auto;
+		}
+		CSS
+	)
 ) . '</head>
 <body>
 <p class="message">%s</p>

From 22a99e29d7b13f2f31bdeae9f08edbd717745019 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 12:53:15 -0700
Subject: [PATCH 30/68] Revert inline style tag API change in Legacy Widget
 block

The src/wp-includes/blocks directory is copied from the Gutenberg build,
so the change was overwritten during the build and caused the
uncommitted changes check to fail in CI. The change would need to be
made in Gutenberg instead. The REST API preview of legacy widgets is
maintained in core and keeps the change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/blocks/legacy-widget.php | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/wp-includes/blocks/legacy-widget.php b/src/wp-includes/blocks/legacy-widget.php
index c35fb0ead9b4b..bec1b16b6ba8c 100644
--- a/src/wp-includes/blocks/legacy-widget.php
+++ b/src/wp-includes/blocks/legacy-widget.php
@@ -98,9 +98,7 @@ function handle_legacy_widget_preview_iframe() {
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
 		<link rel="profile" href="https://gmpg.org/xfn/11" />
 		<?php wp_head(); ?>
-		<?php
-		wp_print_inline_style_tag(
-			<<<'CSS'
+		<style>
 			/* Reset theme styles */
 			html, body, #page, #content {
 				padding: 0 !important;
@@ -133,9 +131,7 @@ function handle_legacy_widget_preview_iframe() {
 			.widget {
 				font-size: var(--global--font-size-base);
 			}
-			CSS
-		);
-		?>
+		</style>
 	</head>
 	<body <?php body_class(); ?>>
 		<div id="page" class="site">

From f6b0261512f9d03094f938101586599488ee36e6 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:02:55 -0700
Subject: [PATCH 31/68] Twenty Ten: Use inline style tag API when available

Print the admin header style with wp_print_inline_style_tag() when it
exists, so that it receives attributes from the
wp_inline_style_attributes filter, falling back to the STYLE tag
otherwise. The CSS is a heredoc with the closing identifier at the start
of the line, since the theme supports PHP 5.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-content/themes/twentyten/functions.php | 31 +++++++++++--------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/src/wp-content/themes/twentyten/functions.php b/src/wp-content/themes/twentyten/functions.php
index 8cfd93bbf6faa..3005731da0262 100644
--- a/src/wp-content/themes/twentyten/functions.php
+++ b/src/wp-content/themes/twentyten/functions.php
@@ -274,21 +274,26 @@ function twentyten_setup() {
 	 * Referenced via add_custom_image_header() in twentyten_setup().
 	 *
 	 * @since Twenty Ten 1.0
+	 * @since Twenty Ten 4.8 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyten_admin_header_style() {
-		?>
-	<style id="twentyten-admin-header-css">
-	/* Shows the same border as on front end */
-	#headimg {
-	border-bottom: 1px solid #000;
-	border-top: 4px solid #000;
-	}
-	/* If header-text was supported, you would style the text with these selectors:
-	#headimg #name { }
-	#headimg #desc { }
-	*/
-	</style>
-		<?php
+		$css = <<<CSS
+		/* Shows the same border as on front end */
+		#headimg {
+		border-bottom: 1px solid #000;
+		border-top: 4px solid #000;
+		}
+		/* If header-text was supported, you would style the text with these selectors:
+		#headimg #name { }
+		#headimg #desc { }
+		*/
+CSS;
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentyten-admin-header-css' ) );
+		} else {
+			echo "<style id=\"twentyten-admin-header-css\">\n{$css}\n</style>\n";
+		}
 	}
 endif;
 

From b8387e4afb5046d1f359f8193507763bc68db8e4 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:01 -0700
Subject: [PATCH 32/68] Twenty Eleven: Use inline style tag API when available

Print the header, admin header, and link color styles with
wp_print_inline_style_tag() when it exists, so that they receive
attributes from the wp_inline_style_attributes filter, falling back to
the STYLE tag otherwise. The CSS is built from heredocs with the closing
identifier at the start of the line, since the theme supports PHP 5.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../themes/twentyeleven/functions.php         | 131 ++++++++++--------
 .../themes/twentyeleven/inc/theme-options.php |  64 +++++----
 2 files changed, 109 insertions(+), 86 deletions(-)

diff --git a/src/wp-content/themes/twentyeleven/functions.php b/src/wp-content/themes/twentyeleven/functions.php
index 251d2807a41e8..9216530700019 100644
--- a/src/wp-content/themes/twentyeleven/functions.php
+++ b/src/wp-content/themes/twentyeleven/functions.php
@@ -326,6 +326,7 @@ function twentyeleven_block_editor_styles() {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @since Twenty Eleven 1.0
+	 * @since Twenty Eleven 5.3 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyeleven_header_style() {
 		$text_color = get_header_textcolor();
@@ -336,28 +337,30 @@ function twentyeleven_header_style() {
 		}
 
 		// If we get this far, we have custom styles. Let's do this.
-		?>
-		<style id="twentyeleven-header-css">
-		<?php
-		// Has the text been hidden?
-		if ( 'blank' === $text_color ) :
-			?>
-		#site-title,
-		#site-description {
-			position: absolute;
-			clip-path: inset(50%);
+		if ( 'blank' === $text_color ) {
+			// The text has been hidden.
+			$css = <<<CSS
+			#site-title,
+			#site-description {
+				position: absolute;
+				clip-path: inset(50%);
+			}
+CSS;
+		} else {
+			// The user has set a custom color for the text, so use that.
+			$css = <<<CSS
+			#site-title a,
+			#site-description {
+				color: #{$text_color};
+			}
+CSS;
 		}
-			<?php
-			// If the user has set a custom color for the text, use that.
-		else :
-			?>
-		#site-title a,
-		#site-description {
-			color: #<?php echo $text_color; ?>;
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentyeleven-header-css' ) );
+		} else {
+			echo "<style id=\"twentyeleven-header-css\">\n{$css}\n</style>\n";
 		}
-	<?php endif; ?>
-	</style>
-		<?php
 	}
 endif; // twentyeleven_header_style()
 
@@ -368,46 +371,60 @@ function twentyeleven_header_style() {
 	 * Referenced via add_theme_support('custom-header') in twentyeleven_setup().
 	 *
 	 * @since Twenty Eleven 1.0
+	 * @since Twenty Eleven 5.3 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyeleven_admin_header_style() {
-		?>
-	<style id="twentyeleven-admin-header-css">
-	.appearance_page_custom-header #headimg {
-		border: none;
-	}
-	#headimg h1,
-	#desc {
-		font-family: "Helvetica Neue", Arial, Helvetica, "Nimbus Sans L", sans-serif;
-	}
-	#headimg h1 {
-		margin: 0;
-	}
-	#headimg h1 a {
-		font-size: 32px;
-		line-height: 36px;
-		text-decoration: none;
-	}
-	#desc {
-		font-size: 14px;
-		line-height: 23px;
-		padding: 0 0 3em;
-	}
-		<?php
+		$css = array();
+
+		$css[] = <<<CSS
+		.appearance_page_custom-header #headimg {
+			border: none;
+		}
+		#headimg h1,
+		#desc {
+			font-family: "Helvetica Neue", Arial, Helvetica, "Nimbus Sans L", sans-serif;
+		}
+		#headimg h1 {
+			margin: 0;
+		}
+		#headimg h1 a {
+			font-size: 32px;
+			line-height: 36px;
+			text-decoration: none;
+		}
+		#desc {
+			font-size: 14px;
+			line-height: 23px;
+			padding: 0 0 3em;
+		}
+CSS;
+
 		// If the user has set a custom color for the text, use that.
-		if ( get_header_textcolor() !== HEADER_TEXTCOLOR ) :
-			?>
-	#site-title a,
-	#site-description {
-		color: #<?php echo get_header_textcolor(); ?>;
-	}
-	<?php endif; ?>
-	#headimg img {
-		max-width: 1000px;
-		height: auto;
-		width: 100%;
-	}
-	</style>
-		<?php
+		$text_color = get_header_textcolor();
+		if ( HEADER_TEXTCOLOR !== $text_color ) {
+			$css[] = <<<CSS
+			#site-title a,
+			#site-description {
+				color: #{$text_color};
+			}
+CSS;
+		}
+
+		$css[] = <<<CSS
+		#headimg img {
+			max-width: 1000px;
+			height: auto;
+			width: 100%;
+		}
+CSS;
+
+		$css = implode( "\n", $css );
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentyeleven-admin-header-css' ) );
+		} else {
+			echo "<style id=\"twentyeleven-admin-header-css\">\n{$css}\n</style>\n";
+		}
 	}
 endif; // twentyeleven_admin_header_style()
 
diff --git a/src/wp-content/themes/twentyeleven/inc/theme-options.php b/src/wp-content/themes/twentyeleven/inc/theme-options.php
index 7b357b835843a..e68e97f0aa577 100644
--- a/src/wp-content/themes/twentyeleven/inc/theme-options.php
+++ b/src/wp-content/themes/twentyeleven/inc/theme-options.php
@@ -452,6 +452,7 @@ function twentyeleven_enqueue_color_scheme() {
  * This function is attached to the wp_head action hook.
  *
  * @since Twenty Eleven 1.0
+ * @since Twenty Eleven 5.3 Added `wp_print_inline_style_tag()` support.
  */
 function twentyeleven_print_link_color_style() {
 	$options    = twentyeleven_get_theme_options();
@@ -463,35 +464,40 @@ function twentyeleven_print_link_color_style() {
 	if ( $default_options['link_color'] === $link_color ) {
 		return;
 	}
-	?>
-	<style>
-		/* Link color */
-		a,
-		#site-title a:focus,
-		#site-title a:hover,
-		#site-title a:active,
-		.entry-title a:hover,
-		.entry-title a:focus,
-		.entry-title a:active,
-		.widget_twentyeleven_ephemera .comments-link a:hover,
-		section.recent-posts .other-recent-posts a[rel="bookmark"]:hover,
-		section.recent-posts .other-recent-posts .comments-link a:hover,
-		.format-image footer.entry-meta a:hover,
-		#site-generator a:hover {
-			color: <?php echo $link_color; ?>;
-		}
-		section.recent-posts .other-recent-posts .comments-link a:hover {
-			border-color: <?php echo $link_color; ?>;
-		}
-		article.feature-image.small .entry-summary p a:hover,
-		.entry-header .comments-link a:hover,
-		.entry-header .comments-link a:focus,
-		.entry-header .comments-link a:active,
-		.feature-slider a.active {
-			background-color: <?php echo $link_color; ?>;
-		}
-	</style>
-	<?php
+
+	$css = <<<CSS
+	/* Link color */
+	a,
+	#site-title a:focus,
+	#site-title a:hover,
+	#site-title a:active,
+	.entry-title a:hover,
+	.entry-title a:focus,
+	.entry-title a:active,
+	.widget_twentyeleven_ephemera .comments-link a:hover,
+	section.recent-posts .other-recent-posts a[rel="bookmark"]:hover,
+	section.recent-posts .other-recent-posts .comments-link a:hover,
+	.format-image footer.entry-meta a:hover,
+	#site-generator a:hover {
+		color: {$link_color};
+	}
+	section.recent-posts .other-recent-posts .comments-link a:hover {
+		border-color: {$link_color};
+	}
+	article.feature-image.small .entry-summary p a:hover,
+	.entry-header .comments-link a:hover,
+	.entry-header .comments-link a:focus,
+	.entry-header .comments-link a:active,
+	.feature-slider a.active {
+		background-color: {$link_color};
+	}
+CSS;
+
+	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+		wp_print_inline_style_tag( $css );
+	} else {
+		echo "<style>\n{$css}\n</style>\n";
+	}
 }
 add_action( 'wp_head', 'twentyeleven_print_link_color_style' );
 

From 46f8f2bc0c2858eb0be5f7d716a5581a5d97986e Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:18 -0700
Subject: [PATCH 33/68] Twenty Twelve: Use inline style tag API when available

Print the header and admin header styles with
wp_print_inline_style_tag() when it exists, so that they receive
attributes from the wp_inline_style_attributes filter, falling back to
the STYLE tag otherwise. The CSS is built from heredocs with the closing
identifier at the start of the line, since the theme supports PHP 5.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../themes/twentytwelve/inc/custom-header.php | 58 +++++++++++--------
 1 file changed, 34 insertions(+), 24 deletions(-)

diff --git a/src/wp-content/themes/twentytwelve/inc/custom-header.php b/src/wp-content/themes/twentytwelve/inc/custom-header.php
index d7297cf0de93f..fcb1ab2406cb2 100644
--- a/src/wp-content/themes/twentytwelve/inc/custom-header.php
+++ b/src/wp-content/themes/twentytwelve/inc/custom-header.php
@@ -66,6 +66,7 @@ function twentytwelve_custom_header_fonts() {
  * get_header_textcolor() options: 515151 is default, hide text (returns 'blank'), or any hex value.
  *
  * @since Twenty Twelve 1.0
+ * @since Twenty Twelve 5.0 Added `wp_print_inline_style_tag()` support.
  */
 function twentytwelve_header_style() {
 	$text_color = get_header_textcolor();
@@ -76,38 +77,42 @@ function twentytwelve_header_style() {
 	}
 
 	// If we get this far, we have custom styles.
-	?>
-	<style id="twentytwelve-header-css">
-	<?php
-		// Has the text been hidden?
-	if ( ! display_header_text() ) :
-		?>
-	.site-title,
-	.site-description {
-		position: absolute;
-		clip-path: inset(50%);
-	}
-		<?php
-		// If the user has set a custom color for the text, use that.
-		else :
-			?>
+	if ( ! display_header_text() ) {
+		// The text has been hidden.
+		$css = <<<CSS
+		.site-title,
+		.site-description {
+			position: absolute;
+			clip-path: inset(50%);
+		}
+CSS;
+	} else {
+		// The user has set a custom color for the text, so use that.
+		$css = <<<CSS
 		.site-header h1 a,
 		.site-header h2 {
-			color: #<?php echo $text_color; ?>;
+			color: #{$text_color};
 		}
-	<?php endif; ?>
-	</style>
-	<?php
+CSS;
+	}
+
+	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+		wp_print_inline_style_tag( $css, array( 'id' => 'twentytwelve-header-css' ) );
+	} else {
+		echo "<style id=\"twentytwelve-header-css\">\n{$css}\n</style>\n";
+	}
 }
 
 /**
  * Styles the header image displayed on the Appearance > Header admin panel.
  *
  * @since Twenty Twelve 1.0
+ * @since Twenty Twelve 5.0 Added `wp_print_inline_style_tag()` support.
  */
 function twentytwelve_admin_header_style() {
-	?>
-	<style id="twentytwelve-admin-header-css">
+	$max_width = get_theme_support( 'custom-header', 'max-width' );
+
+	$css = <<<CSS
 	.appearance_page_custom-header #headimg {
 		border: none;
 		font-family: "Open Sans", Helvetica, Arial, sans-serif;
@@ -134,10 +139,15 @@ function twentytwelve_admin_header_style() {
 		margin-bottom: 24px;
 	}
 	#headimg img {
-		max-width: <?php echo get_theme_support( 'custom-header', 'max-width' ); ?>px;
+		max-width: {$max_width}px;
+	}
+CSS;
+
+	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+		wp_print_inline_style_tag( $css, array( 'id' => 'twentytwelve-admin-header-css' ) );
+	} else {
+		echo "<style id=\"twentytwelve-admin-header-css\">\n{$css}\n</style>\n";
 	}
-	</style>
-	<?php
 }
 
 /**

From e1f061cb9c32548e6dd75a93184b8e2dc2acf135 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:21 -0700
Subject: [PATCH 34/68] Twenty Thirteen: Use inline style tag API when
 available

Print the header and admin header styles with
wp_print_inline_style_tag() when it exists, so that they receive
attributes from the wp_inline_style_attributes filter, falling back to
the STYLE tag otherwise. The CSS is built from heredocs with the closing
identifier at the start of the line, since the theme supports PHP 5.2.

Escape the header image URL with esc_url_raw() instead of esc_url() and
wrap it in double quotes, since HTML character references are not
decoded in STYLE elements, and esc_url_raw() strips double quotes but
not parentheses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../twentythirteen/inc/custom-header.php      | 147 ++++++++++--------
 1 file changed, 86 insertions(+), 61 deletions(-)

diff --git a/src/wp-content/themes/twentythirteen/inc/custom-header.php b/src/wp-content/themes/twentythirteen/inc/custom-header.php
index f293a46a46858..1fde1af4a8d14 100644
--- a/src/wp-content/themes/twentythirteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentythirteen/inc/custom-header.php
@@ -84,6 +84,7 @@ function twentythirteen_custom_header_fonts() {
  * get_header_textcolor() options: Hide text (returns 'blank'), or any hex value.
  *
  * @since Twenty Thirteen 1.0
+ * @since Twenty Thirteen 4.8 Added `wp_print_inline_style_tag()` support.
  */
 function twentythirteen_header_style() {
 	$header_image = get_header_image();
@@ -95,76 +96,105 @@ function twentythirteen_header_style() {
 	}
 
 	// If we get this far, we have custom styles.
-	?>
-	<style id="twentythirteen-header-css">
-	<?php
-	if ( ! empty( $header_image ) ) :
-		?>
-	.site-header {
-		background: url(<?php header_image(); ?>) no-repeat scroll top;
-		background-size: 1600px auto;
-	}
-	@media (max-width: 767px) {
+	$css = array();
+
+	if ( ! empty( $header_image ) ) {
+		$escaped_header_image = esc_url_raw( $header_image );
+
+		$css[] = <<<CSS
 		.site-header {
-			background-size: 768px auto;
+			background: url("{$escaped_header_image}") no-repeat scroll top;
+			background-size: 1600px auto;
 		}
-	}
-	@media (max-width: 359px) {
-		.site-header {
-			background-size: 360px auto;
+		@media (max-width: 767px) {
+			.site-header {
+				background-size: 768px auto;
+			}
+		}
+		@media (max-width: 359px) {
+			.site-header {
+				background-size: 360px auto;
+			}
 		}
+CSS;
 	}
-		<?php
-		endif;
 
-		// Has the text been hidden?
-	if ( ! display_header_text() ) :
-		?>
-	.site-title,
-	.site-description {
-		position: absolute;
-		clip-path: inset(50%);
-	}
-		<?php
-		if ( empty( $header_image ) ) :
-			?>
-	.site-header .home-link {
-	min-height: 0;
-	}
-			<?php
-		endif;
+	if ( ! display_header_text() ) {
+		// The text has been hidden.
+		$css[] = <<<CSS
+		.site-title,
+		.site-description {
+			position: absolute;
+			clip-path: inset(50%);
+		}
+CSS;
 
-		// If the user has set a custom color for the text, use that.
-		elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) :
-			?>
+		if ( empty( $header_image ) ) {
+			$css[] = <<<CSS
+			.site-header .home-link {
+			min-height: 0;
+			}
+CSS;
+		}
+	} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
+		// The user has set a custom color for the text, so use that.
+		$escaped_text_color = esc_attr( $text_color );
+
+		$css[] = <<<CSS
 		.site-title,
 		.site-description {
-			color: #<?php echo esc_attr( $text_color ); ?>;
+			color: #{$escaped_text_color};
 		}
-	<?php endif; ?>
-	</style>
-	<?php
+CSS;
+	}
+
+	$css = implode( "\n", $css );
+
+	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+		wp_print_inline_style_tag( $css, array( 'id' => 'twentythirteen-header-css' ) );
+	} else {
+		echo "<style id=\"twentythirteen-header-css\">\n{$css}\n</style>\n";
+	}
 }
 
 /**
  * Styles the header image displayed on the Appearance > Header admin panel.
  *
  * @since Twenty Thirteen 1.0
+ * @since Twenty Thirteen 4.8 Added `wp_print_inline_style_tag()` support.
  */
 function twentythirteen_admin_header_style() {
 	$header_image = get_header_image();
-	?>
-	<style id="twentythirteen-admin-header-css">
+
+	$header_image_declarations = '';
+	if ( ! empty( $header_image ) ) {
+		$escaped_header_image      = esc_url_raw( $header_image );
+		$header_image_declarations = "background: url(\"{$escaped_header_image}\") no-repeat scroll top; background-size: 1600px auto;";
+	}
+
+	$min_height_declaration = '';
+	if ( ! empty( $header_image ) || display_header_text() ) {
+		$min_height_declaration = 'min-height: 230px;';
+	}
+
+	$hidden_text_rule = '';
+	if ( ! display_header_text() ) {
+		$hidden_text_rule = <<<CSS
+	#headimg h1,
+	#headimg h2 {
+		position: absolute !important;
+		clip-path: inset(50%);
+	}
+CSS;
+	}
+
+	$css = <<<CSS
 	.appearance_page_custom-header #headimg {
 		border: none;
 		-webkit-box-sizing: border-box;
 		-moz-box-sizing:    border-box;
 		box-sizing:         border-box;
-		<?php
-		if ( ! empty( $header_image ) ) {
-			echo 'background: url(' . esc_url( $header_image ) . ') no-repeat scroll top; background-size: 1600px auto;';
-		}
-		?>
+		{$header_image_declarations}
 		padding: 0 20px;
 	}
 	#headimg .home-link {
@@ -173,20 +203,10 @@ function twentythirteen_admin_header_style() {
 		box-sizing:         border-box;
 		margin: 0 auto;
 		max-width: 1040px;
-		<?php
-		if ( ! empty( $header_image ) || display_header_text() ) {
-			echo 'min-height: 230px;';
-		}
-		?>
+		{$min_height_declaration}
 		width: 100%;
 	}
-	<?php if ( ! display_header_text() ) : ?>
-	#headimg h1,
-	#headimg h2 {
-		position: absolute !important;
-		clip-path: inset(50%);
-	}
-	<?php endif; ?>
+{$hidden_text_rule}
 	#headimg h1 {
 		font: bold 60px/1 Bitter, Georgia, serif;
 		margin: 0;
@@ -207,8 +227,13 @@ function twentythirteen_admin_header_style() {
 		max-width: 230px;
 		width: auto;
 	}
-	</style>
-	<?php
+CSS;
+
+	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+		wp_print_inline_style_tag( $css, array( 'id' => 'twentythirteen-admin-header-css' ) );
+	} else {
+		echo "<style id=\"twentythirteen-admin-header-css\">\n{$css}\n</style>\n";
+	}
 }
 
 /**

From 8e419cb048e0c9b3f78adea293c7e87dbcd5750e Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:27 -0700
Subject: [PATCH 35/68] Twenty Fourteen: Use inline style tag API when
 available

Print the header and admin header styles with
wp_print_inline_style_tag() when it exists, so that they receive
attributes from the wp_inline_style_attributes filter, falling back to
the STYLE tag otherwise. The CSS is built from heredocs with the closing
identifier at the start of the line, since the theme supports PHP 5.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../twentyfourteen/inc/custom-header.php      | 102 ++++++++++--------
 1 file changed, 57 insertions(+), 45 deletions(-)

diff --git a/src/wp-content/themes/twentyfourteen/inc/custom-header.php b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
index 5569accc17c2a..9a6a10a8268b7 100644
--- a/src/wp-content/themes/twentyfourteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
@@ -58,6 +58,8 @@ function twentyfourteen_custom_header_setup() {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @see twentyfourteen_custom_header_setup().
+	 *
+	 * @since Twenty Fourteen 4.7 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyfourteen_header_style() {
 		$text_color = get_header_textcolor();
@@ -68,27 +70,32 @@ function twentyfourteen_header_style() {
 		}
 
 		// If we get this far, we have custom styles.
-		?>
-		<style id="twentyfourteen-header-css">
-		<?php
-		// Has the text been hidden?
-		if ( ! display_header_text() ) :
-			?>
-		.site-title,
-		.site-description {
-			clip-path: inset(50%);
-			position: absolute;
+		$css = '';
+		if ( ! display_header_text() ) {
+			// The text has been hidden.
+			$css = <<<CSS
+			.site-title,
+			.site-description {
+				clip-path: inset(50%);
+				position: absolute;
+			}
+CSS;
+		} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
+			// The user has set a custom color for the text, so use that.
+			$escaped_text_color = esc_attr( $text_color );
+
+			$css = <<<CSS
+			.site-title a {
+				color: #{$escaped_text_color};
+			}
+CSS;
 		}
-			<?php
-			// If the user has set a custom color for the text, use that.
-		elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) :
-			?>
-		.site-title a {
-			color: #<?php echo esc_attr( $text_color ); ?>;
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentyfourteen-header-css' ) );
+		} else {
+			echo "<style id=\"twentyfourteen-header-css\">\n{$css}\n</style>\n";
 		}
-	<?php endif; ?>
-	</style>
-		<?php
 	}
 endif; // twentyfourteen_header_style()
 
@@ -100,34 +107,39 @@ function twentyfourteen_header_style() {
 	 * @see twentyfourteen_custom_header_setup()
 	 *
 	 * @since Twenty Fourteen 1.0
+	 * @since Twenty Fourteen 4.7 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyfourteen_admin_header_style() {
-		?>
-	<style id="twentyfourteen-admin-header-css">
-	.appearance_page_custom-header #headimg {
-		background-color: #000;
-		border: none;
-		max-width: 1260px;
-		min-height: 48px;
-	}
-	#headimg h1 {
-		font-family: Lato, sans-serif;
-		font-size: 18px;
-		line-height: 48px;
-		margin: 0 0 0 30px;
-	}
-	.rtl #headimg h1  {
-		margin: 0 30px 0 0;
-	}
-	#headimg h1 a {
-		color: #fff;
-		text-decoration: none;
-	}
-	#headimg img {
-		vertical-align: middle;
-	}
-	</style>
-		<?php
+		$css = <<<CSS
+		.appearance_page_custom-header #headimg {
+			background-color: #000;
+			border: none;
+			max-width: 1260px;
+			min-height: 48px;
+		}
+		#headimg h1 {
+			font-family: Lato, sans-serif;
+			font-size: 18px;
+			line-height: 48px;
+			margin: 0 0 0 30px;
+		}
+		.rtl #headimg h1  {
+			margin: 0 30px 0 0;
+		}
+		#headimg h1 a {
+			color: #fff;
+			text-decoration: none;
+		}
+		#headimg img {
+			vertical-align: middle;
+		}
+CSS;
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentyfourteen-admin-header-css' ) );
+		} else {
+			echo "<style id=\"twentyfourteen-admin-header-css\">\n{$css}\n</style>\n";
+		}
 	}
 endif; // twentyfourteen_admin_header_style()
 

From bcf2f8a5d610762c528251f7e8afe8e27ccc1fbc Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:31 -0700
Subject: [PATCH 36/68] Twenty Fifteen: Use inline style tag API when available

Print the header style with wp_print_inline_style_tag() when it exists,
so that it receives attributes from the wp_inline_style_attributes
filter, falling back to the STYLE tag otherwise. The CSS is built from
heredocs with the closing identifier at the start of the line, since the
theme supports PHP 5.2.

Escape the header image URL with esc_url_raw() instead of esc_url() and
wrap it in double quotes, since HTML character references are not
decoded in STYLE elements, and esc_url_raw() strips double quotes but
not parentheses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../twentyfifteen/inc/custom-header.php       | 45 +++++++++++--------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/src/wp-content/themes/twentyfifteen/inc/custom-header.php b/src/wp-content/themes/twentyfifteen/inc/custom-header.php
index 699d72cec7b31..201c1e4937f9c 100644
--- a/src/wp-content/themes/twentyfifteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyfifteen/inc/custom-header.php
@@ -82,6 +82,7 @@ function twentyfifteen_hex2rgb( $color ) {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @since Twenty Fifteen 1.0
+	 * @since Twenty Fifteen 4.4 Added `wp_print_inline_style_tag()` support.
 	 *
 	 * @see twentyfifteen_custom_header_setup()
 	 */
@@ -94,12 +95,11 @@ function twentyfifteen_header_style() {
 		}
 
 		// If we get this far, we have custom styles. Let's do this.
-		?>
-		<style id="twentyfifteen-header-css">
-		<?php
+		$css = array();
+
 		// Short header for when there is no Custom Header and Header Text is hidden.
-		if ( empty( $header_image ) && ! display_header_text() ) :
-			?>
+		if ( empty( $header_image ) && ! display_header_text() ) {
+			$css[] = <<<CSS
 		.site-header {
 			padding-top: 14px;
 			padding-bottom: 14px;
@@ -136,19 +136,21 @@ function twentyfifteen_header_style() {
 				min-height: 0;
 			}
 		}
-			<?php
-		endif;
+CSS;
+		}
 
 		// Has a Custom Header been added?
-		if ( ! empty( $header_image ) ) :
-			?>
+		if ( ! empty( $header_image ) ) {
+			$escaped_header_image = esc_url_raw( $header_image );
+
+			$css[] = <<<CSS
 		.site-header {
 
 			/*
 			 * No shorthand so the Customizer can override individual properties.
 			 * @see https://core.trac.wordpress.org/ticket/31460
 			 */
-			background-image: url(<?php header_image(); ?>);
+			background-image: url("{$escaped_header_image}");
 			background-repeat: no-repeat;
 			background-position: 50% 50%;
 			-webkit-background-size: cover;
@@ -164,7 +166,7 @@ function twentyfifteen_header_style() {
 				 * No shorthand so the Customizer can override individual properties.
 				 * @see https://core.trac.wordpress.org/ticket/31460
 				 */
-				background-image: url(<?php header_image(); ?>);
+				background-image: url("{$escaped_header_image}");
 				background-repeat: no-repeat;
 				background-position: 100% 50%;
 				-webkit-background-size: cover;
@@ -178,20 +180,27 @@ function twentyfifteen_header_style() {
 				background: transparent;
 			}
 		}
-			<?php
-		endif;
+CSS;
+		}
 
 		// Has the text been hidden?
-		if ( ! display_header_text() ) :
-			?>
+		if ( ! display_header_text() ) {
+			$css[] = <<<CSS
 		.site-title,
 		.site-description {
 			clip-path: inset(50%);
 			position: absolute;
 		}
-	<?php endif; ?>
-	</style>
-		<?php
+CSS;
+		}
+
+		$css = implode( "\n", $css );
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentyfifteen-header-css' ) );
+		} else {
+			echo "<style id=\"twentyfifteen-header-css\">\n{$css}\n</style>\n";
+		}
 	}
 endif; // twentyfifteen_header_style()
 

From f2866daa658c7aaf6b1bae6eb2888f45bdc3b3a3 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:36 -0700
Subject: [PATCH 37/68] Twenty Sixteen: Use inline style tag API when available

Print the header style with wp_print_inline_style_tag() when it exists,
so that it receives attributes from the wp_inline_style_attributes
filter, falling back to the STYLE tag otherwise. The CSS is a heredoc
with the closing identifier at the start of the line, since the theme
supports PHP 5.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../themes/twentysixteen/inc/customizer.php         | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/wp-content/themes/twentysixteen/inc/customizer.php b/src/wp-content/themes/twentysixteen/inc/customizer.php
index f72a83d53b51b..d1afe396f0395 100644
--- a/src/wp-content/themes/twentysixteen/inc/customizer.php
+++ b/src/wp-content/themes/twentysixteen/inc/customizer.php
@@ -79,6 +79,7 @@ function twentysixteen_custom_header_and_background() {
 	 * Create your own twentysixteen_header_style() function to override in a child theme.
 	 *
 	 * @since Twenty Sixteen 1.0
+	 * @since Twenty Sixteen 4.0 Added `wp_print_inline_style_tag()` support.
 	 *
 	 * @see twentysixteen_custom_header_and_background().
 	 */
@@ -89,8 +90,7 @@ function twentysixteen_header_style() {
 		}
 
 		// If the header text has been hidden.
-		?>
-		<style id="twentysixteen-header-css">
+		$css = <<<CSS
 		.site-branding {
 			margin: 0 auto 0 0;
 		}
@@ -100,8 +100,13 @@ function twentysixteen_header_style() {
 			clip-path: inset(50%);
 			position: absolute;
 		}
-		</style>
-		<?php
+CSS;
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentysixteen-header-css' ) );
+		} else {
+			echo "<style id=\"twentysixteen-header-css\">\n{$css}\n</style>\n";
+		}
 	}
 endif; // twentysixteen_header_style()
 

From 445b58541513928fecfcb33bac0fdcc9d92f4c29 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:50 -0700
Subject: [PATCH 38/68] Twenty Seventeen: Use inline style tag API when
 available

Print the custom header and custom colors styles with
wp_print_inline_style_tag() when it exists, so that they receive
attributes from the wp_inline_style_attributes filter, falling back to
the STYLE tag otherwise. The id and data-hue attributes that the
Customizer preview relies on are retained. The CSS is built from
heredocs with the closing identifier at the start of the line, since the
theme supports PHP 5.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../themes/twentyseventeen/functions.php      | 26 +++++++++-----
 .../twentyseventeen/inc/custom-header.php     | 34 +++++++++++--------
 2 files changed, 38 insertions(+), 22 deletions(-)

diff --git a/src/wp-content/themes/twentyseventeen/functions.php b/src/wp-content/themes/twentyseventeen/functions.php
index e693c0fe16f8e..ea145ebfcb93d 100644
--- a/src/wp-content/themes/twentyseventeen/functions.php
+++ b/src/wp-content/themes/twentyseventeen/functions.php
@@ -435,6 +435,8 @@ function twentyseventeen_pingback_header() {
 
 /**
  * Displays custom color CSS.
+ *
+ * @since Twenty Seventeen 4.3 Added `wp_print_inline_style_tag()` support.
  */
 function twentyseventeen_colors_css_wrap() {
 	if ( 'custom' !== get_theme_mod( 'colorscheme' ) && ! is_customize_preview() ) {
@@ -444,15 +446,23 @@ function twentyseventeen_colors_css_wrap() {
 	require_once get_parent_theme_file_path( '/inc/color-patterns.php' );
 	$hue = absint( get_theme_mod( 'colorscheme_hue', 250 ) );
 
-	$customize_preview_data_hue = '';
-	if ( is_customize_preview() ) {
-		$customize_preview_data_hue = 'data-hue="' . $hue . '"';
+	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+		$attributes = array( 'id' => 'custom-theme-colors' );
+		if ( is_customize_preview() ) {
+			$attributes['data-hue'] = (string) $hue;
+		}
+		wp_print_inline_style_tag( twentyseventeen_custom_colors_css(), $attributes );
+	} else {
+		$customize_preview_data_hue = '';
+		if ( is_customize_preview() ) {
+			$customize_preview_data_hue = 'data-hue="' . $hue . '"';
+		}
+		?>
+		<style id="custom-theme-colors" <?php echo $customize_preview_data_hue; ?>>
+			<?php echo twentyseventeen_custom_colors_css(); ?>
+		</style>
+		<?php
 	}
-	?>
-	<style id="custom-theme-colors" <?php echo $customize_preview_data_hue; ?>>
-		<?php echo twentyseventeen_custom_colors_css(); ?>
-	</style>
-	<?php
 }
 add_action( 'wp_head', 'twentyseventeen_colors_css_wrap' );
 
diff --git a/src/wp-content/themes/twentyseventeen/inc/custom-header.php b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
index e64d74f64f165..21a05eb6ef68b 100644
--- a/src/wp-content/themes/twentyseventeen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
@@ -65,6 +65,8 @@ function twentyseventeen_custom_header_setup() {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @see twentyseventeen_custom_header_setup().
+	 *
+	 * @since Twenty Seventeen 4.3 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyseventeen_header_style() {
 		$header_text_color = get_header_textcolor();
@@ -76,21 +78,20 @@ function twentyseventeen_header_style() {
 		}
 
 		// If we get this far, we have custom styles. Let's do this.
-		?>
-		<style id="twentyseventeen-custom-header-styles">
-		<?php
-		// Has the text been hidden?
-		if ( 'blank' === $header_text_color ) :
-			?>
+		if ( 'blank' === $header_text_color ) {
+			// The text has been hidden.
+			$css = <<<CSS
 		.site-title,
 		.site-description {
 			position: absolute;
 			clip-path: inset(50%);
 		}
-			<?php
-			// If the user has set a custom color for the text use that.
-		else :
-			?>
+CSS;
+		} else {
+			// The user has set a custom color for the text, so use that.
+			$escaped_header_text_color = esc_attr( $header_text_color );
+
+			$css = <<<CSS
 		.site-title a,
 		.colors-dark .site-title a,
 		.colors-custom .site-title a,
@@ -109,11 +110,16 @@ function twentyseventeen_header_style() {
 		body.has-header-video.colors-dark .site-description,
 		body.has-header-image.colors-custom .site-description,
 		body.has-header-video.colors-custom .site-description {
-			color: #<?php echo esc_attr( $header_text_color ); ?>;
+			color: #{$escaped_header_text_color};
+		}
+CSS;
+		}
+
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css, array( 'id' => 'twentyseventeen-custom-header-styles' ) );
+		} else {
+			echo "<style id=\"twentyseventeen-custom-header-styles\">\n{$css}\n</style>\n";
 		}
-	<?php endif; ?>
-	</style>
-		<?php
 	}
 endif; // End of twentyseventeen_header_style().
 

From 35242b3e91845757643fab8c86e81e4893c6b06f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:58 -0700
Subject: [PATCH 39/68] Twenty Nineteen: Use inline style tag API when
 available

Print the custom colors style with wp_print_inline_style_tag() when it
exists, so that it receives attributes from the
wp_inline_style_attributes filter, falling back to the STYLE tag
otherwise. The id and data-hue attributes that the Customizer preview
relies on are retained.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../themes/twentynineteen/functions.php       | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/src/wp-content/themes/twentynineteen/functions.php b/src/wp-content/themes/twentynineteen/functions.php
index 987c13c22f019..baea9702380d5 100644
--- a/src/wp-content/themes/twentynineteen/functions.php
+++ b/src/wp-content/themes/twentynineteen/functions.php
@@ -335,6 +335,8 @@ function twentynineteen_editor_customizer_styles() {
 
 /**
  * Displays custom color CSS in customizer and on frontend.
+ *
+ * @since Twenty Nineteen 3.5 Added `wp_print_inline_style_tag()` support.
  */
 function twentynineteen_colors_css_wrap() {
 
@@ -349,12 +351,21 @@ function twentynineteen_colors_css_wrap() {
 	if ( 'default' !== get_theme_mod( 'primary_color', 'default' ) ) {
 		$primary_color = get_theme_mod( 'primary_color_hue', 199 );
 	}
-	?>
 
-	<style id="custom-theme-colors" <?php echo is_customize_preview() ? 'data-hue="' . absint( $primary_color ) . '"' : ''; ?>>
-		<?php echo twentynineteen_custom_colors_css(); ?>
-	</style>
-	<?php
+	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+		$attributes = array( 'id' => 'custom-theme-colors' );
+		if ( is_customize_preview() ) {
+			$attributes['data-hue'] = (string) absint( $primary_color );
+		}
+		wp_print_inline_style_tag( twentynineteen_custom_colors_css(), $attributes );
+	} else {
+		?>
+
+		<style id="custom-theme-colors" <?php echo is_customize_preview() ? 'data-hue="' . absint( $primary_color ) . '"' : ''; ?>>
+			<?php echo twentynineteen_custom_colors_css(); ?>
+		</style>
+		<?php
+	}
 }
 add_action( 'wp_head', 'twentynineteen_colors_css_wrap' );
 

From 4d6346257b1d5fe7cae5d479a41691488dea8f7c Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:03:59 -0700
Subject: [PATCH 40/68] Twenty Twenty-One: Use inline style tag API when
 available

Print the dark mode toggle style with wp_print_inline_style_tag() when it
exists, so that it receives attributes from the
wp_inline_style_attributes filter, falling back to the STYLE tag
otherwise. The translated labels are escaped before the heredoc so that
they remain extractable for translation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../class-twenty-twenty-one-dark-mode.php     | 30 +++++++++++++------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
index 6644e7d02eeab..55ef5448f967c 100644
--- a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
+++ b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
@@ -303,6 +303,7 @@ public function the_switch() {
 	 * Inspired from https://codepen.io/aaroniker/pen/KGpXZo (MIT-licensed)
 	 *
 	 * @since Twenty Twenty-One 1.0
+	 * @since Twenty Twenty-One 3.0 Added `wp_print_inline_style_tag()` support.
 	 *
 	 * @param array $attrs The attributes to add to our <button> element.
 	 * @return void
@@ -328,18 +329,25 @@ public function the_html( $attrs = array() ) {
 			'<span aria-hidden="true"></span>'
 		);
 		echo '</button>';
-		?>
-		<style>
+
+		$margin_side       = is_rtl() ? 'right' : 'left';
+		$escaped_off_label = esc_attr__( 'Off', 'twentytwentyone' );
+		$escaped_on_label  = esc_attr__( 'On', 'twentytwentyone' );
+
+		$css = <<<CSS
 			#dark-mode-toggler > span {
-				margin-<?php echo is_rtl() ? 'right' : 'left'; ?>: 5px;
+				margin-{$margin_side}: 5px;
 			}
 			#dark-mode-toggler > span::before {
-				content: '<?php esc_attr_e( 'Off', 'twentytwentyone' ); ?>';
+				content: '{$escaped_off_label}';
 			}
 			#dark-mode-toggler[aria-pressed="true"] > span::before {
-				content: '<?php esc_attr_e( 'On', 'twentytwentyone' ); ?>';
+				content: '{$escaped_on_label}';
 			}
-			<?php if ( is_admin() || wp_is_json_request() ) : ?>
+CSS;
+
+		if ( is_admin() || wp_is_json_request() ) {
+			$css .= "\n" . <<<CSS
 				.components-editor-notices__pinned ~ .edit-post-visual-editor #dark-mode-toggler {
 					z-index: 20;
 				}
@@ -351,10 +359,14 @@ public function the_html( $attrs = array() ) {
 						margin-top: 32px;
 					}
 				}
-			<?php endif; ?>
-		</style>
+CSS;
+		}
 
-		<?php
+		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
+			wp_print_inline_style_tag( $css );
+		} else {
+			echo "<style>\n{$css}\n</style>\n";
+		}
 	}
 
 	/**

From e965370b9fadc44f9c611ccabd0e90bedc83ad0c Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:41:56 -0700
Subject: [PATCH 41/68] Avoid fatal error for non-string inline style data

Remove the native string type from the $data parameter of
wp_get_inline_style_tag() and wp_print_inline_style_tag(), matching the
inline script tag functions, and cast it to a string instead. Callers
such as wp_custom_css_cb() pass filtered values, so a filter returning
null would otherwise cause a TypeError where the previous code coerced
the value to a string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php                    |  6 +++---
 .../phpunit/tests/dependencies/wpInlineStyleTag.php  | 12 ++++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index b28b3e5390bf2..cfad689a740e6 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3676,8 +3676,8 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
  * @phpstan-param array<non-falsy-string, string|bool> $attributes
  * @phpstan-return non-falsy-string
  */
-function wp_get_inline_style_tag( string $data, array $attributes = array() ): string {
-	$data = "\n" . trim( $data, "\n\r " ) . "\n";
+function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
+	$data = "\n" . trim( (string) $data, "\n\r " ) . "\n";
 
 	/**
 	 * Filters attributes to be added to an inline style tag.
@@ -3733,7 +3733,7 @@ function wp_get_inline_style_tag( string $data, array $attributes = array() ): s
  *
  * @phpstan-param array<non-falsy-string, string|bool> $attributes
  */
-function wp_print_inline_style_tag( string $data, array $attributes = array() ): void {
+function wp_print_inline_style_tag( $data, array $attributes = array() ): void {
 	echo wp_get_inline_style_tag( $data, $attributes );
 }
 
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 3a7d95de80960..2ff7fb7c96b3c 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -171,6 +171,18 @@ public function test_inline_style_tag_repeat_attributes() {
 		);
 	}
 
+	/**
+	 * Tests that a non-string value, such as from a misbehaving filter, does not cause a fatal error.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_tag_with_null_data() {
+		$this->assertEqualHTML(
+			"<style>\n\n</style>\n",
+			wp_get_inline_style_tag( null ) // @phpstan-ignore argument.type
+		);
+	}
+
 	/**
 	 * @ticket 51325
 	 */

From 37b6babafb97b98ecc49305d7d72227aea00663a Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:42:03 -0700
Subject: [PATCH 42/68] Print inline style via WP_Styles::print_inline_style()
 when not concatenating

Restore the call to print_inline_style() in WP_Styles::do_item() when
not concatenating, as before, so that subclasses which override that
method continue to control how the inline style is printed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/class-wp-styles.php | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/wp-includes/class-wp-styles.php b/src/wp-includes/class-wp-styles.php
index b78d9387f4b6e..c494878943525 100644
--- a/src/wp-includes/class-wp-styles.php
+++ b/src/wp-includes/class-wp-styles.php
@@ -242,17 +242,17 @@ public function do_item( $handle, $group = false ) {
 			}
 		}
 
-		if ( $inline_style ) {
-			$tag .= wp_get_inline_style_tag(
-				$inline_style,
-				array( 'id' => "{$handle}-inline-css" )
-			);
-		}
-
 		if ( $this->do_concat ) {
 			$this->print_html .= $tag;
+			if ( $inline_style ) {
+				$this->print_html .= wp_get_inline_style_tag(
+					$inline_style,
+					array( 'id' => "{$handle}-inline-css" )
+				);
+			}
 		} else {
 			echo $tag;
+			$this->print_inline_style( $handle );
 		}
 
 		return true;

From a7e0bb8c3b97ff076e334ebb96938986e8ea8a04 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:57:39 -0700
Subject: [PATCH 43/68] Fix PHPStan errors in changed themes lines

---
 src/wp-content/themes/twentynineteen/inc/color-patterns.php  | 2 ++
 src/wp-content/themes/twentyseventeen/inc/color-patterns.php | 2 ++
 src/wp-content/themes/twentytwelve/inc/custom-header.php     | 2 +-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/wp-content/themes/twentynineteen/inc/color-patterns.php b/src/wp-content/themes/twentynineteen/inc/color-patterns.php
index 61e0ecccd2ac5..2e9f7721d010c 100644
--- a/src/wp-content/themes/twentynineteen/inc/color-patterns.php
+++ b/src/wp-content/themes/twentynineteen/inc/color-patterns.php
@@ -9,6 +9,8 @@
 
 /**
  * Generates the CSS for the current primary color.
+ *
+ * @return string Generated CSS.
  */
 function twentynineteen_custom_colors_css() {
 
diff --git a/src/wp-content/themes/twentyseventeen/inc/color-patterns.php b/src/wp-content/themes/twentyseventeen/inc/color-patterns.php
index 3c070b7ea9984..ef86858b17aa6 100644
--- a/src/wp-content/themes/twentyseventeen/inc/color-patterns.php
+++ b/src/wp-content/themes/twentyseventeen/inc/color-patterns.php
@@ -9,6 +9,8 @@
 
 /**
  * Generates the CSS for the current custom color scheme.
+ *
+ * @return string Generated CSS.
  */
 function twentyseventeen_custom_colors_css() {
 	$hue = absint( get_theme_mod( 'colorscheme_hue', 250 ) );
diff --git a/src/wp-content/themes/twentytwelve/inc/custom-header.php b/src/wp-content/themes/twentytwelve/inc/custom-header.php
index fcb1ab2406cb2..59a4a80ed4167 100644
--- a/src/wp-content/themes/twentytwelve/inc/custom-header.php
+++ b/src/wp-content/themes/twentytwelve/inc/custom-header.php
@@ -110,7 +110,7 @@ function twentytwelve_header_style() {
  * @since Twenty Twelve 5.0 Added `wp_print_inline_style_tag()` support.
  */
 function twentytwelve_admin_header_style() {
-	$max_width = get_theme_support( 'custom-header', 'max-width' );
+	$max_width = (int) get_theme_support( 'custom-header', 'max-width' );
 
 	$css = <<<CSS
 	.appearance_page_custom-header #headimg {

From a958ba26ad04dba5b27a20c63fd5e2068e532427 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 13:59:55 -0700
Subject: [PATCH 44/68] Sanitize header text color for CSS instead of escaping
 as attribute

Twenty Thirteen, Twenty Fourteen, and Twenty Seventeen passed the header
text color through esc_attr() before printing it in an inline style.
HTML character references are not decoded in STYLE elements, so
attribute escaping is the wrong treatment for this context. Since the
value is a hex color without the hash, use sanitize_hex_color_no_hash()
instead, which also ensures that nothing other than a hex color is
printed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-content/themes/twentyfourteen/inc/custom-header.php  | 4 ++--
 src/wp-content/themes/twentyseventeen/inc/custom-header.php | 4 ++--
 src/wp-content/themes/twentythirteen/inc/custom-header.php  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/wp-content/themes/twentyfourteen/inc/custom-header.php b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
index 9a6a10a8268b7..cb92adc7e09f0 100644
--- a/src/wp-content/themes/twentyfourteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
@@ -82,11 +82,11 @@ function twentyfourteen_header_style() {
 CSS;
 		} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
 			// The user has set a custom color for the text, so use that.
-			$escaped_text_color = esc_attr( $text_color );
+			$sanitized_text_color = sanitize_hex_color_no_hash( $text_color );
 
 			$css = <<<CSS
 			.site-title a {
-				color: #{$escaped_text_color};
+				color: #{$sanitized_text_color};
 			}
 CSS;
 		}
diff --git a/src/wp-content/themes/twentyseventeen/inc/custom-header.php b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
index 21a05eb6ef68b..86ff9df9a0b85 100644
--- a/src/wp-content/themes/twentyseventeen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
@@ -89,7 +89,7 @@ function twentyseventeen_header_style() {
 CSS;
 		} else {
 			// The user has set a custom color for the text, so use that.
-			$escaped_header_text_color = esc_attr( $header_text_color );
+			$sanitized_header_text_color = sanitize_hex_color_no_hash( $header_text_color );
 
 			$css = <<<CSS
 		.site-title a,
@@ -110,7 +110,7 @@ function twentyseventeen_header_style() {
 		body.has-header-video.colors-dark .site-description,
 		body.has-header-image.colors-custom .site-description,
 		body.has-header-video.colors-custom .site-description {
-			color: #{$escaped_header_text_color};
+			color: #{$sanitized_header_text_color};
 		}
 CSS;
 		}
diff --git a/src/wp-content/themes/twentythirteen/inc/custom-header.php b/src/wp-content/themes/twentythirteen/inc/custom-header.php
index 1fde1af4a8d14..de55588fd1871 100644
--- a/src/wp-content/themes/twentythirteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentythirteen/inc/custom-header.php
@@ -138,12 +138,12 @@ function twentythirteen_header_style() {
 		}
 	} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
 		// The user has set a custom color for the text, so use that.
-		$escaped_text_color = esc_attr( $text_color );
+		$sanitized_text_color = sanitize_hex_color_no_hash( $text_color );
 
 		$css[] = <<<CSS
 		.site-title,
 		.site-description {
-			color: #{$escaped_text_color};
+			color: #{$sanitized_text_color};
 		}
 CSS;
 	}

From 7a6b8e423a09555736349900e4fb90a40990cbee Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 14:02:23 -0700
Subject: [PATCH 45/68] Validate header text color inline in Twenty Thirteen
 and Twenty Fourteen

sanitize_hex_color_no_hash() was only defined in the Customizer manager
class until WordPress 4.6, so calling it on the front end would cause a
fatal error on the older WordPress versions these themes support.
Validate the hex color with the same pattern inline instead, as Twenty
Eleven already does for its link color option.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-content/themes/twentyfourteen/inc/custom-header.php | 3 ++-
 src/wp-content/themes/twentythirteen/inc/custom-header.php | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/wp-content/themes/twentyfourteen/inc/custom-header.php b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
index cb92adc7e09f0..4a13bfeb92600 100644
--- a/src/wp-content/themes/twentyfourteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
@@ -82,7 +82,8 @@ function twentyfourteen_header_style() {
 CSS;
 		} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
 			// The user has set a custom color for the text, so use that.
-			$sanitized_text_color = sanitize_hex_color_no_hash( $text_color );
+			// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
+			$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
 
 			$css = <<<CSS
 			.site-title a {
diff --git a/src/wp-content/themes/twentythirteen/inc/custom-header.php b/src/wp-content/themes/twentythirteen/inc/custom-header.php
index de55588fd1871..8b486eedaebfe 100644
--- a/src/wp-content/themes/twentythirteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentythirteen/inc/custom-header.php
@@ -138,7 +138,8 @@ function twentythirteen_header_style() {
 		}
 	} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
 		// The user has set a custom color for the text, so use that.
-		$sanitized_text_color = sanitize_hex_color_no_hash( $text_color );
+		// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
+		$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
 
 		$css[] = <<<CSS
 		.site-title,

From 595418c68fac45d56eb2f9d0eb1e9d847ddfce0f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 14:02:48 -0700
Subject: [PATCH 46/68] Validate header text color in Twenty Eleven and Twenty
 Twelve

The header text color was printed into the inline style without any
sanitization. Validate it as a hex color inline, since
sanitize_hex_color_no_hash() is not available outside the Customizer
before WordPress 4.6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-content/themes/twentyeleven/functions.php       | 10 ++++++++--
 .../themes/twentytwelve/inc/custom-header.php          |  5 ++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/wp-content/themes/twentyeleven/functions.php b/src/wp-content/themes/twentyeleven/functions.php
index 9216530700019..a48682f05c8fc 100644
--- a/src/wp-content/themes/twentyeleven/functions.php
+++ b/src/wp-content/themes/twentyeleven/functions.php
@@ -348,10 +348,13 @@ function twentyeleven_header_style() {
 CSS;
 		} else {
 			// The user has set a custom color for the text, so use that.
+			// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
+			$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
+
 			$css = <<<CSS
 			#site-title a,
 			#site-description {
-				color: #{$text_color};
+				color: #{$sanitized_text_color};
 			}
 CSS;
 		}
@@ -402,10 +405,13 @@ function twentyeleven_admin_header_style() {
 		// If the user has set a custom color for the text, use that.
 		$text_color = get_header_textcolor();
 		if ( HEADER_TEXTCOLOR !== $text_color ) {
+			// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
+			$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
+
 			$css[] = <<<CSS
 			#site-title a,
 			#site-description {
-				color: #{$text_color};
+				color: #{$sanitized_text_color};
 			}
 CSS;
 		}
diff --git a/src/wp-content/themes/twentytwelve/inc/custom-header.php b/src/wp-content/themes/twentytwelve/inc/custom-header.php
index 59a4a80ed4167..5ffdd64fe5f1d 100644
--- a/src/wp-content/themes/twentytwelve/inc/custom-header.php
+++ b/src/wp-content/themes/twentytwelve/inc/custom-header.php
@@ -88,10 +88,13 @@ function twentytwelve_header_style() {
 CSS;
 	} else {
 		// The user has set a custom color for the text, so use that.
+		// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
+		$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
+
 		$css = <<<CSS
 		.site-header h1 a,
 		.site-header h2 {
-			color: #{$text_color};
+			color: #{$sanitized_text_color};
 		}
 CSS;
 	}

From f5033375db036648d837e828a91f4a5757d91ef7 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 14:03:27 -0700
Subject: [PATCH 47/68] Twenty Twenty-One: Escape dark mode labels as CSS
 strings

The translated Off and On labels were escaped with esc_attr__() before
being placed in single-quoted CSS content strings. HTML character
references are not decoded in STYLE elements, so a translation with an
apostrophe was displayed with a literal &#039;. Escape backslashes,
single quotes, and line breaks as CSS escapes instead, and also escape
the less-than sign so that a translation cannot close the STYLE element
when the tag is printed without the inline style tag API.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../class-twenty-twenty-one-dark-mode.php        | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
index 55ef5448f967c..15688d1a241c1 100644
--- a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
+++ b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
@@ -330,9 +330,21 @@ public function the_html( $attrs = array() ) {
 		);
 		echo '</button>';
 
+		/*
+		 * Escape the labels for use in single-quoted CSS strings. HTML character references
+		 * are not decoded in STYLE elements, so esc_attr() would not be appropriate here.
+		 */
+		$escape_css_string = static function ( $text ) {
+			return str_replace(
+				array( '\\', "'", '<', "\n", "\r" ),
+				array( '\\\\', "\\'", '\\3C ', '\\A ', '\\D ' ),
+				$text
+			);
+		};
+
 		$margin_side       = is_rtl() ? 'right' : 'left';
-		$escaped_off_label = esc_attr__( 'Off', 'twentytwentyone' );
-		$escaped_on_label  = esc_attr__( 'On', 'twentytwentyone' );
+		$escaped_off_label = $escape_css_string( __( 'Off', 'twentytwentyone' ) );
+		$escaped_on_label  = $escape_css_string( __( 'On', 'twentytwentyone' ) );
 
 		$css = <<<CSS
 			#dark-mode-toggler > span {

From c67e40c836c5ad40a428a61f28522b37b9da150f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 14:04:42 -0700
Subject: [PATCH 48/68] Twenty Twenty-One: Escape dark mode labels late inside
 heredoc

Call the CSS string escaping closure inside the heredoc interpolation so
that the labels are escaped at the point of output. The translation
calls remain literal, so the strings are still extracted for
translation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../classes/class-twenty-twenty-one-dark-mode.php         | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
index 15688d1a241c1..3cdcc105f866f 100644
--- a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
+++ b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
@@ -342,19 +342,17 @@ public function the_html( $attrs = array() ) {
 			);
 		};
 
-		$margin_side       = is_rtl() ? 'right' : 'left';
-		$escaped_off_label = $escape_css_string( __( 'Off', 'twentytwentyone' ) );
-		$escaped_on_label  = $escape_css_string( __( 'On', 'twentytwentyone' ) );
+		$margin_side = is_rtl() ? 'right' : 'left';
 
 		$css = <<<CSS
 			#dark-mode-toggler > span {
 				margin-{$margin_side}: 5px;
 			}
 			#dark-mode-toggler > span::before {
-				content: '{$escaped_off_label}';
+				content: '{$escape_css_string( __( 'Off', 'twentytwentyone' ) )}';
 			}
 			#dark-mode-toggler[aria-pressed="true"] > span::before {
-				content: '{$escaped_on_label}';
+				content: '{$escape_css_string( __( 'On', 'twentytwentyone' ) )}';
 			}
 CSS;
 

From 45739df7db9b45e0e2e99caab815c6f94971f3b3 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Sun, 11 Oct 2026 14:08:32 -0700
Subject: [PATCH 49/68] Escape late inside heredocs in bundled theme header
 styles

Call esc_url_raw() in Twenty Thirteen and Twenty Fifteen, and
sanitize_hex_color_no_hash() in Twenty Seventeen, as variable functions
inside the heredoc interpolation, so that the values are escaped at the
point of output rather than in separate variables beforehand. This
syntax is supported as of PHP 5.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-content/themes/twentyfifteen/inc/custom-header.php | 6 +++---
 .../themes/twentyseventeen/inc/custom-header.php          | 4 ++--
 .../themes/twentythirteen/inc/custom-header.php           | 8 ++++----
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/wp-content/themes/twentyfifteen/inc/custom-header.php b/src/wp-content/themes/twentyfifteen/inc/custom-header.php
index 201c1e4937f9c..65e55254ee4b4 100644
--- a/src/wp-content/themes/twentyfifteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyfifteen/inc/custom-header.php
@@ -141,7 +141,7 @@ function twentyfifteen_header_style() {
 
 		// Has a Custom Header been added?
 		if ( ! empty( $header_image ) ) {
-			$escaped_header_image = esc_url_raw( $header_image );
+			$esc_url_raw = 'esc_url_raw';
 
 			$css[] = <<<CSS
 		.site-header {
@@ -150,7 +150,7 @@ function twentyfifteen_header_style() {
 			 * No shorthand so the Customizer can override individual properties.
 			 * @see https://core.trac.wordpress.org/ticket/31460
 			 */
-			background-image: url("{$escaped_header_image}");
+			background-image: url("{$esc_url_raw( $header_image )}");
 			background-repeat: no-repeat;
 			background-position: 50% 50%;
 			-webkit-background-size: cover;
@@ -166,7 +166,7 @@ function twentyfifteen_header_style() {
 				 * No shorthand so the Customizer can override individual properties.
 				 * @see https://core.trac.wordpress.org/ticket/31460
 				 */
-				background-image: url("{$escaped_header_image}");
+				background-image: url("{$esc_url_raw( $header_image )}");
 				background-repeat: no-repeat;
 				background-position: 100% 50%;
 				-webkit-background-size: cover;
diff --git a/src/wp-content/themes/twentyseventeen/inc/custom-header.php b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
index 86ff9df9a0b85..5a31b1d3fc7c7 100644
--- a/src/wp-content/themes/twentyseventeen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
@@ -89,7 +89,7 @@ function twentyseventeen_header_style() {
 CSS;
 		} else {
 			// The user has set a custom color for the text, so use that.
-			$sanitized_header_text_color = sanitize_hex_color_no_hash( $header_text_color );
+			$sanitize_hex_color_no_hash = 'sanitize_hex_color_no_hash';
 
 			$css = <<<CSS
 		.site-title a,
@@ -110,7 +110,7 @@ function twentyseventeen_header_style() {
 		body.has-header-video.colors-dark .site-description,
 		body.has-header-image.colors-custom .site-description,
 		body.has-header-video.colors-custom .site-description {
-			color: #{$sanitized_header_text_color};
+			color: #{$sanitize_hex_color_no_hash( $header_text_color )};
 		}
 CSS;
 		}
diff --git a/src/wp-content/themes/twentythirteen/inc/custom-header.php b/src/wp-content/themes/twentythirteen/inc/custom-header.php
index 8b486eedaebfe..dac0e1a413e98 100644
--- a/src/wp-content/themes/twentythirteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentythirteen/inc/custom-header.php
@@ -99,11 +99,11 @@ function twentythirteen_header_style() {
 	$css = array();
 
 	if ( ! empty( $header_image ) ) {
-		$escaped_header_image = esc_url_raw( $header_image );
+		$esc_url_raw = 'esc_url_raw';
 
 		$css[] = <<<CSS
 		.site-header {
-			background: url("{$escaped_header_image}") no-repeat scroll top;
+			background: url("{$esc_url_raw( $header_image )}") no-repeat scroll top;
 			background-size: 1600px auto;
 		}
 		@media (max-width: 767px) {
@@ -169,8 +169,8 @@ function twentythirteen_admin_header_style() {
 
 	$header_image_declarations = '';
 	if ( ! empty( $header_image ) ) {
-		$escaped_header_image      = esc_url_raw( $header_image );
-		$header_image_declarations = "background: url(\"{$escaped_header_image}\") no-repeat scroll top; background-size: 1600px auto;";
+		$esc_url_raw               = 'esc_url_raw';
+		$header_image_declarations = "background: url(\"{$esc_url_raw( $header_image )}\") no-repeat scroll top; background-size: 1600px auto;";
 	}
 
 	$min_height_declaration = '';

From dc2267be680cbd38d77e9882b92dd849fdd15ccb Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Mon, 12 Oct 2026 10:45:17 -0700
Subject: [PATCH 50/68] Limit this change to the inline style tag API

Revert the conversions of STYLE tags in core and in the bundled themes,
so that this change only introduces wp_get_inline_style_tag() and
wp_print_inline_style_tag(), plus their use in WP_Styles and
script-loader.php, along with the tests for them. The conversions will
be proposed separately, one change for the bundled themes and another
for the rest of core.

The tests for the STYLE tags printed by core outside of WP_Styles, and
the test for hoisting with filtered attributes, depend on those
conversions, so they are moved along with them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-activate.php                           |   8 +-
 src/wp-admin/includes/plugin-install.php      |  13 +-
 src/wp-admin/options-general.php              |  14 +-
 .../themes/twentyeleven/functions.php         | 137 +++++++---------
 .../themes/twentyeleven/inc/theme-options.php |  64 ++++----
 .../twentyfifteen/inc/custom-header.php       |  45 +++---
 .../twentyfourteen/inc/custom-header.php      | 103 ++++++------
 .../themes/twentynineteen/functions.php       |  21 +--
 .../twentynineteen/inc/color-patterns.php     |   2 -
 .../themes/twentyseventeen/functions.php      |  26 +--
 .../twentyseventeen/inc/color-patterns.php    |   2 -
 .../twentyseventeen/inc/custom-header.php     |  34 ++--
 .../themes/twentysixteen/inc/customizer.php   |  13 +-
 src/wp-content/themes/twentyten/functions.php |  31 ++--
 .../twentythirteen/inc/custom-header.php      | 148 ++++++++----------
 .../themes/twentytwelve/inc/custom-header.php |  61 +++-----
 .../class-twenty-twenty-one-dark-mode.php     |  40 ++---
 .../class-wp-customize-manager.php            |   8 +-
 .../class-wp-customize-widgets.php            |  22 +--
 .../class-wp-customize-site-icon-control.php  |  10 +-
 src/wp-includes/deprecated.php                |  81 +++++-----
 src/wp-includes/fonts/class-wp-font-face.php  |   5 +-
 src/wp-includes/functions.php                 |  16 +-
 src/wp-includes/media-template.php            |   8 +-
 src/wp-includes/media.php                     |   7 +-
 src/wp-includes/ms-deprecated.php             |  35 ++---
 .../class-wp-rest-widget-types-controller.php |   8 +-
 src/wp-includes/theme-compat/header.php       |  27 ++--
 src/wp-includes/theme.php                     |  32 ++--
 .../class-wp-widget-recent-comments.php       |   6 +-
 src/wp-login.php                              |   8 +-
 src/wp-signup.php                             |   8 +-
 .../tests/dependencies/wpInlineStyleTag.php   | 134 ----------------
 tests/phpunit/tests/template.php              |  54 +------
 34 files changed, 433 insertions(+), 798 deletions(-)

diff --git a/src/wp-activate.php b/src/wp-activate.php
index aed538a7e13fb..1de0f60c6cfd5 100644
--- a/src/wp-activate.php
+++ b/src/wp-activate.php
@@ -104,8 +104,8 @@ function do_activate_header() {
  * @since MU (3.0.0)
  */
 function wpmu_activate_stylesheet() {
-	wp_print_inline_style_tag(
-		<<<'CSS'
+	?>
+	<style>
 		.wp-activate-container { width: 90%; margin: 0 auto; text-align: start; padding: 24px; box-sizing: border-box; }
 		.wp-activate-container form { margin: 24px 0; }
 		.wp-activate-container p { font-size: 18px; }
@@ -113,8 +113,8 @@ function wpmu_activate_stylesheet() {
 		#key { width: 100%; direction: ltr; }
 		#submit { width: auto; }
 		span.h3 { font-weight: 600; }
-		CSS
-	);
+	</style>
+	<?php
 }
 add_action( 'wp_head', 'wpmu_activate_stylesheet' );
 add_action( 'wp_head', 'wp_strict_cross_origin_referrer' );
diff --git a/src/wp-admin/includes/plugin-install.php b/src/wp-admin/includes/plugin-install.php
index c675b6cedfd82..ffae71c5b81f6 100644
--- a/src/wp-admin/includes/plugin-install.php
+++ b/src/wp-admin/includes/plugin-install.php
@@ -606,19 +606,18 @@ function install_plugin_information() {
 		$_with_banner = 'with-banner';
 		$low          = empty( $api->banners['low'] ) ? $api->banners['high'] : $api->banners['low'];
 		$high         = empty( $api->banners['high'] ) ? $api->banners['low'] : $api->banners['high'];
-		$esc_url_raw  = 'esc_url_raw';
-		wp_print_inline_style_tag(
-			<<<CSS
+		?>
+		<style>
 			#plugin-information-title.with-banner {
-				background-image: url( "{$esc_url_raw( $low )}" );
+				background-image: url( <?php echo esc_url( $low ); ?> );
 			}
 			@media only screen and ( -webkit-min-device-pixel-ratio: 1.5 ) {
 				#plugin-information-title.with-banner {
-					background-image: url( "{$esc_url_raw( $high )}" );
+					background-image: url( <?php echo esc_url( $high ); ?> );
 				}
 			}
-			CSS
-		);
+		</style>
+		<?php
 	}
 
 	echo '<div id="plugin-information-scrollable">';
diff --git a/src/wp-admin/options-general.php b/src/wp-admin/options-general.php
index 8c9b7bf8a5803..1e6e00ea703d8 100644
--- a/src/wp-admin/options-general.php
+++ b/src/wp-admin/options-general.php
@@ -188,16 +188,14 @@
 			);
 		}
 	}
-	$esc_url_raw = 'esc_url_raw';
-	wp_print_inline_style_tag(
-		<<<CSS
-		:root {
-			--site-icon-url: url( "{$esc_url_raw( $site_icon_url )}" );
-		}
-		CSS
-	);
 	?>
 
+	<style>
+	:root {
+		--site-icon-url: url( '<?php echo esc_url( $site_icon_url ); ?>' );
+	}
+	</style>
+
 	<div id="site-icon-preview" class="site-icon-preview settings <?php echo esc_attr( $classes_for_wrapper ); ?>">
 		<div class="direction-wrap">
 			<img id="app-icon-preview" src="<?php echo esc_url( $site_icon_url ); ?>" class="app-icon-preview" alt="<?php echo esc_attr( $app_icon_alt_value ); ?>" />
diff --git a/src/wp-content/themes/twentyeleven/functions.php b/src/wp-content/themes/twentyeleven/functions.php
index a48682f05c8fc..251d2807a41e8 100644
--- a/src/wp-content/themes/twentyeleven/functions.php
+++ b/src/wp-content/themes/twentyeleven/functions.php
@@ -326,7 +326,6 @@ function twentyeleven_block_editor_styles() {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @since Twenty Eleven 1.0
-	 * @since Twenty Eleven 5.3 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyeleven_header_style() {
 		$text_color = get_header_textcolor();
@@ -337,33 +336,28 @@ function twentyeleven_header_style() {
 		}
 
 		// If we get this far, we have custom styles. Let's do this.
-		if ( 'blank' === $text_color ) {
-			// The text has been hidden.
-			$css = <<<CSS
-			#site-title,
-			#site-description {
-				position: absolute;
-				clip-path: inset(50%);
-			}
-CSS;
-		} else {
-			// The user has set a custom color for the text, so use that.
-			// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
-			$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
-
-			$css = <<<CSS
-			#site-title a,
-			#site-description {
-				color: #{$sanitized_text_color};
-			}
-CSS;
+		?>
+		<style id="twentyeleven-header-css">
+		<?php
+		// Has the text been hidden?
+		if ( 'blank' === $text_color ) :
+			?>
+		#site-title,
+		#site-description {
+			position: absolute;
+			clip-path: inset(50%);
 		}
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentyeleven-header-css' ) );
-		} else {
-			echo "<style id=\"twentyeleven-header-css\">\n{$css}\n</style>\n";
+			<?php
+			// If the user has set a custom color for the text, use that.
+		else :
+			?>
+		#site-title a,
+		#site-description {
+			color: #<?php echo $text_color; ?>;
 		}
+	<?php endif; ?>
+	</style>
+		<?php
 	}
 endif; // twentyeleven_header_style()
 
@@ -374,63 +368,46 @@ function twentyeleven_header_style() {
 	 * Referenced via add_theme_support('custom-header') in twentyeleven_setup().
 	 *
 	 * @since Twenty Eleven 1.0
-	 * @since Twenty Eleven 5.3 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyeleven_admin_header_style() {
-		$css = array();
-
-		$css[] = <<<CSS
-		.appearance_page_custom-header #headimg {
-			border: none;
-		}
-		#headimg h1,
-		#desc {
-			font-family: "Helvetica Neue", Arial, Helvetica, "Nimbus Sans L", sans-serif;
-		}
-		#headimg h1 {
-			margin: 0;
-		}
-		#headimg h1 a {
-			font-size: 32px;
-			line-height: 36px;
-			text-decoration: none;
-		}
-		#desc {
-			font-size: 14px;
-			line-height: 23px;
-			padding: 0 0 3em;
-		}
-CSS;
-
+		?>
+	<style id="twentyeleven-admin-header-css">
+	.appearance_page_custom-header #headimg {
+		border: none;
+	}
+	#headimg h1,
+	#desc {
+		font-family: "Helvetica Neue", Arial, Helvetica, "Nimbus Sans L", sans-serif;
+	}
+	#headimg h1 {
+		margin: 0;
+	}
+	#headimg h1 a {
+		font-size: 32px;
+		line-height: 36px;
+		text-decoration: none;
+	}
+	#desc {
+		font-size: 14px;
+		line-height: 23px;
+		padding: 0 0 3em;
+	}
+		<?php
 		// If the user has set a custom color for the text, use that.
-		$text_color = get_header_textcolor();
-		if ( HEADER_TEXTCOLOR !== $text_color ) {
-			// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
-			$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
-
-			$css[] = <<<CSS
-			#site-title a,
-			#site-description {
-				color: #{$sanitized_text_color};
-			}
-CSS;
-		}
-
-		$css[] = <<<CSS
-		#headimg img {
-			max-width: 1000px;
-			height: auto;
-			width: 100%;
-		}
-CSS;
-
-		$css = implode( "\n", $css );
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentyeleven-admin-header-css' ) );
-		} else {
-			echo "<style id=\"twentyeleven-admin-header-css\">\n{$css}\n</style>\n";
-		}
+		if ( get_header_textcolor() !== HEADER_TEXTCOLOR ) :
+			?>
+	#site-title a,
+	#site-description {
+		color: #<?php echo get_header_textcolor(); ?>;
+	}
+	<?php endif; ?>
+	#headimg img {
+		max-width: 1000px;
+		height: auto;
+		width: 100%;
+	}
+	</style>
+		<?php
 	}
 endif; // twentyeleven_admin_header_style()
 
diff --git a/src/wp-content/themes/twentyeleven/inc/theme-options.php b/src/wp-content/themes/twentyeleven/inc/theme-options.php
index e68e97f0aa577..7b357b835843a 100644
--- a/src/wp-content/themes/twentyeleven/inc/theme-options.php
+++ b/src/wp-content/themes/twentyeleven/inc/theme-options.php
@@ -452,7 +452,6 @@ function twentyeleven_enqueue_color_scheme() {
  * This function is attached to the wp_head action hook.
  *
  * @since Twenty Eleven 1.0
- * @since Twenty Eleven 5.3 Added `wp_print_inline_style_tag()` support.
  */
 function twentyeleven_print_link_color_style() {
 	$options    = twentyeleven_get_theme_options();
@@ -464,40 +463,35 @@ function twentyeleven_print_link_color_style() {
 	if ( $default_options['link_color'] === $link_color ) {
 		return;
 	}
-
-	$css = <<<CSS
-	/* Link color */
-	a,
-	#site-title a:focus,
-	#site-title a:hover,
-	#site-title a:active,
-	.entry-title a:hover,
-	.entry-title a:focus,
-	.entry-title a:active,
-	.widget_twentyeleven_ephemera .comments-link a:hover,
-	section.recent-posts .other-recent-posts a[rel="bookmark"]:hover,
-	section.recent-posts .other-recent-posts .comments-link a:hover,
-	.format-image footer.entry-meta a:hover,
-	#site-generator a:hover {
-		color: {$link_color};
-	}
-	section.recent-posts .other-recent-posts .comments-link a:hover {
-		border-color: {$link_color};
-	}
-	article.feature-image.small .entry-summary p a:hover,
-	.entry-header .comments-link a:hover,
-	.entry-header .comments-link a:focus,
-	.entry-header .comments-link a:active,
-	.feature-slider a.active {
-		background-color: {$link_color};
-	}
-CSS;
-
-	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-		wp_print_inline_style_tag( $css );
-	} else {
-		echo "<style>\n{$css}\n</style>\n";
-	}
+	?>
+	<style>
+		/* Link color */
+		a,
+		#site-title a:focus,
+		#site-title a:hover,
+		#site-title a:active,
+		.entry-title a:hover,
+		.entry-title a:focus,
+		.entry-title a:active,
+		.widget_twentyeleven_ephemera .comments-link a:hover,
+		section.recent-posts .other-recent-posts a[rel="bookmark"]:hover,
+		section.recent-posts .other-recent-posts .comments-link a:hover,
+		.format-image footer.entry-meta a:hover,
+		#site-generator a:hover {
+			color: <?php echo $link_color; ?>;
+		}
+		section.recent-posts .other-recent-posts .comments-link a:hover {
+			border-color: <?php echo $link_color; ?>;
+		}
+		article.feature-image.small .entry-summary p a:hover,
+		.entry-header .comments-link a:hover,
+		.entry-header .comments-link a:focus,
+		.entry-header .comments-link a:active,
+		.feature-slider a.active {
+			background-color: <?php echo $link_color; ?>;
+		}
+	</style>
+	<?php
 }
 add_action( 'wp_head', 'twentyeleven_print_link_color_style' );
 
diff --git a/src/wp-content/themes/twentyfifteen/inc/custom-header.php b/src/wp-content/themes/twentyfifteen/inc/custom-header.php
index 65e55254ee4b4..699d72cec7b31 100644
--- a/src/wp-content/themes/twentyfifteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyfifteen/inc/custom-header.php
@@ -82,7 +82,6 @@ function twentyfifteen_hex2rgb( $color ) {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @since Twenty Fifteen 1.0
-	 * @since Twenty Fifteen 4.4 Added `wp_print_inline_style_tag()` support.
 	 *
 	 * @see twentyfifteen_custom_header_setup()
 	 */
@@ -95,11 +94,12 @@ function twentyfifteen_header_style() {
 		}
 
 		// If we get this far, we have custom styles. Let's do this.
-		$css = array();
-
+		?>
+		<style id="twentyfifteen-header-css">
+		<?php
 		// Short header for when there is no Custom Header and Header Text is hidden.
-		if ( empty( $header_image ) && ! display_header_text() ) {
-			$css[] = <<<CSS
+		if ( empty( $header_image ) && ! display_header_text() ) :
+			?>
 		.site-header {
 			padding-top: 14px;
 			padding-bottom: 14px;
@@ -136,21 +136,19 @@ function twentyfifteen_header_style() {
 				min-height: 0;
 			}
 		}
-CSS;
-		}
+			<?php
+		endif;
 
 		// Has a Custom Header been added?
-		if ( ! empty( $header_image ) ) {
-			$esc_url_raw = 'esc_url_raw';
-
-			$css[] = <<<CSS
+		if ( ! empty( $header_image ) ) :
+			?>
 		.site-header {
 
 			/*
 			 * No shorthand so the Customizer can override individual properties.
 			 * @see https://core.trac.wordpress.org/ticket/31460
 			 */
-			background-image: url("{$esc_url_raw( $header_image )}");
+			background-image: url(<?php header_image(); ?>);
 			background-repeat: no-repeat;
 			background-position: 50% 50%;
 			-webkit-background-size: cover;
@@ -166,7 +164,7 @@ function twentyfifteen_header_style() {
 				 * No shorthand so the Customizer can override individual properties.
 				 * @see https://core.trac.wordpress.org/ticket/31460
 				 */
-				background-image: url("{$esc_url_raw( $header_image )}");
+				background-image: url(<?php header_image(); ?>);
 				background-repeat: no-repeat;
 				background-position: 100% 50%;
 				-webkit-background-size: cover;
@@ -180,27 +178,20 @@ function twentyfifteen_header_style() {
 				background: transparent;
 			}
 		}
-CSS;
-		}
+			<?php
+		endif;
 
 		// Has the text been hidden?
-		if ( ! display_header_text() ) {
-			$css[] = <<<CSS
+		if ( ! display_header_text() ) :
+			?>
 		.site-title,
 		.site-description {
 			clip-path: inset(50%);
 			position: absolute;
 		}
-CSS;
-		}
-
-		$css = implode( "\n", $css );
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentyfifteen-header-css' ) );
-		} else {
-			echo "<style id=\"twentyfifteen-header-css\">\n{$css}\n</style>\n";
-		}
+	<?php endif; ?>
+	</style>
+		<?php
 	}
 endif; // twentyfifteen_header_style()
 
diff --git a/src/wp-content/themes/twentyfourteen/inc/custom-header.php b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
index 4a13bfeb92600..5569accc17c2a 100644
--- a/src/wp-content/themes/twentyfourteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyfourteen/inc/custom-header.php
@@ -58,8 +58,6 @@ function twentyfourteen_custom_header_setup() {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @see twentyfourteen_custom_header_setup().
-	 *
-	 * @since Twenty Fourteen 4.7 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyfourteen_header_style() {
 		$text_color = get_header_textcolor();
@@ -70,33 +68,27 @@ function twentyfourteen_header_style() {
 		}
 
 		// If we get this far, we have custom styles.
-		$css = '';
-		if ( ! display_header_text() ) {
-			// The text has been hidden.
-			$css = <<<CSS
-			.site-title,
-			.site-description {
-				clip-path: inset(50%);
-				position: absolute;
-			}
-CSS;
-		} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
-			// The user has set a custom color for the text, so use that.
-			// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
-			$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
-
-			$css = <<<CSS
-			.site-title a {
-				color: #{$sanitized_text_color};
-			}
-CSS;
+		?>
+		<style id="twentyfourteen-header-css">
+		<?php
+		// Has the text been hidden?
+		if ( ! display_header_text() ) :
+			?>
+		.site-title,
+		.site-description {
+			clip-path: inset(50%);
+			position: absolute;
 		}
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentyfourteen-header-css' ) );
-		} else {
-			echo "<style id=\"twentyfourteen-header-css\">\n{$css}\n</style>\n";
+			<?php
+			// If the user has set a custom color for the text, use that.
+		elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) :
+			?>
+		.site-title a {
+			color: #<?php echo esc_attr( $text_color ); ?>;
 		}
+	<?php endif; ?>
+	</style>
+		<?php
 	}
 endif; // twentyfourteen_header_style()
 
@@ -108,39 +100,34 @@ function twentyfourteen_header_style() {
 	 * @see twentyfourteen_custom_header_setup()
 	 *
 	 * @since Twenty Fourteen 1.0
-	 * @since Twenty Fourteen 4.7 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyfourteen_admin_header_style() {
-		$css = <<<CSS
-		.appearance_page_custom-header #headimg {
-			background-color: #000;
-			border: none;
-			max-width: 1260px;
-			min-height: 48px;
-		}
-		#headimg h1 {
-			font-family: Lato, sans-serif;
-			font-size: 18px;
-			line-height: 48px;
-			margin: 0 0 0 30px;
-		}
-		.rtl #headimg h1  {
-			margin: 0 30px 0 0;
-		}
-		#headimg h1 a {
-			color: #fff;
-			text-decoration: none;
-		}
-		#headimg img {
-			vertical-align: middle;
-		}
-CSS;
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentyfourteen-admin-header-css' ) );
-		} else {
-			echo "<style id=\"twentyfourteen-admin-header-css\">\n{$css}\n</style>\n";
-		}
+		?>
+	<style id="twentyfourteen-admin-header-css">
+	.appearance_page_custom-header #headimg {
+		background-color: #000;
+		border: none;
+		max-width: 1260px;
+		min-height: 48px;
+	}
+	#headimg h1 {
+		font-family: Lato, sans-serif;
+		font-size: 18px;
+		line-height: 48px;
+		margin: 0 0 0 30px;
+	}
+	.rtl #headimg h1  {
+		margin: 0 30px 0 0;
+	}
+	#headimg h1 a {
+		color: #fff;
+		text-decoration: none;
+	}
+	#headimg img {
+		vertical-align: middle;
+	}
+	</style>
+		<?php
 	}
 endif; // twentyfourteen_admin_header_style()
 
diff --git a/src/wp-content/themes/twentynineteen/functions.php b/src/wp-content/themes/twentynineteen/functions.php
index baea9702380d5..987c13c22f019 100644
--- a/src/wp-content/themes/twentynineteen/functions.php
+++ b/src/wp-content/themes/twentynineteen/functions.php
@@ -335,8 +335,6 @@ function twentynineteen_editor_customizer_styles() {
 
 /**
  * Displays custom color CSS in customizer and on frontend.
- *
- * @since Twenty Nineteen 3.5 Added `wp_print_inline_style_tag()` support.
  */
 function twentynineteen_colors_css_wrap() {
 
@@ -351,21 +349,12 @@ function twentynineteen_colors_css_wrap() {
 	if ( 'default' !== get_theme_mod( 'primary_color', 'default' ) ) {
 		$primary_color = get_theme_mod( 'primary_color_hue', 199 );
 	}
+	?>
 
-	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-		$attributes = array( 'id' => 'custom-theme-colors' );
-		if ( is_customize_preview() ) {
-			$attributes['data-hue'] = (string) absint( $primary_color );
-		}
-		wp_print_inline_style_tag( twentynineteen_custom_colors_css(), $attributes );
-	} else {
-		?>
-
-		<style id="custom-theme-colors" <?php echo is_customize_preview() ? 'data-hue="' . absint( $primary_color ) . '"' : ''; ?>>
-			<?php echo twentynineteen_custom_colors_css(); ?>
-		</style>
-		<?php
-	}
+	<style id="custom-theme-colors" <?php echo is_customize_preview() ? 'data-hue="' . absint( $primary_color ) . '"' : ''; ?>>
+		<?php echo twentynineteen_custom_colors_css(); ?>
+	</style>
+	<?php
 }
 add_action( 'wp_head', 'twentynineteen_colors_css_wrap' );
 
diff --git a/src/wp-content/themes/twentynineteen/inc/color-patterns.php b/src/wp-content/themes/twentynineteen/inc/color-patterns.php
index 2e9f7721d010c..61e0ecccd2ac5 100644
--- a/src/wp-content/themes/twentynineteen/inc/color-patterns.php
+++ b/src/wp-content/themes/twentynineteen/inc/color-patterns.php
@@ -9,8 +9,6 @@
 
 /**
  * Generates the CSS for the current primary color.
- *
- * @return string Generated CSS.
  */
 function twentynineteen_custom_colors_css() {
 
diff --git a/src/wp-content/themes/twentyseventeen/functions.php b/src/wp-content/themes/twentyseventeen/functions.php
index ea145ebfcb93d..e693c0fe16f8e 100644
--- a/src/wp-content/themes/twentyseventeen/functions.php
+++ b/src/wp-content/themes/twentyseventeen/functions.php
@@ -435,8 +435,6 @@ function twentyseventeen_pingback_header() {
 
 /**
  * Displays custom color CSS.
- *
- * @since Twenty Seventeen 4.3 Added `wp_print_inline_style_tag()` support.
  */
 function twentyseventeen_colors_css_wrap() {
 	if ( 'custom' !== get_theme_mod( 'colorscheme' ) && ! is_customize_preview() ) {
@@ -446,23 +444,15 @@ function twentyseventeen_colors_css_wrap() {
 	require_once get_parent_theme_file_path( '/inc/color-patterns.php' );
 	$hue = absint( get_theme_mod( 'colorscheme_hue', 250 ) );
 
-	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-		$attributes = array( 'id' => 'custom-theme-colors' );
-		if ( is_customize_preview() ) {
-			$attributes['data-hue'] = (string) $hue;
-		}
-		wp_print_inline_style_tag( twentyseventeen_custom_colors_css(), $attributes );
-	} else {
-		$customize_preview_data_hue = '';
-		if ( is_customize_preview() ) {
-			$customize_preview_data_hue = 'data-hue="' . $hue . '"';
-		}
-		?>
-		<style id="custom-theme-colors" <?php echo $customize_preview_data_hue; ?>>
-			<?php echo twentyseventeen_custom_colors_css(); ?>
-		</style>
-		<?php
+	$customize_preview_data_hue = '';
+	if ( is_customize_preview() ) {
+		$customize_preview_data_hue = 'data-hue="' . $hue . '"';
 	}
+	?>
+	<style id="custom-theme-colors" <?php echo $customize_preview_data_hue; ?>>
+		<?php echo twentyseventeen_custom_colors_css(); ?>
+	</style>
+	<?php
 }
 add_action( 'wp_head', 'twentyseventeen_colors_css_wrap' );
 
diff --git a/src/wp-content/themes/twentyseventeen/inc/color-patterns.php b/src/wp-content/themes/twentyseventeen/inc/color-patterns.php
index ef86858b17aa6..3c070b7ea9984 100644
--- a/src/wp-content/themes/twentyseventeen/inc/color-patterns.php
+++ b/src/wp-content/themes/twentyseventeen/inc/color-patterns.php
@@ -9,8 +9,6 @@
 
 /**
  * Generates the CSS for the current custom color scheme.
- *
- * @return string Generated CSS.
  */
 function twentyseventeen_custom_colors_css() {
 	$hue = absint( get_theme_mod( 'colorscheme_hue', 250 ) );
diff --git a/src/wp-content/themes/twentyseventeen/inc/custom-header.php b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
index 5a31b1d3fc7c7..e64d74f64f165 100644
--- a/src/wp-content/themes/twentyseventeen/inc/custom-header.php
+++ b/src/wp-content/themes/twentyseventeen/inc/custom-header.php
@@ -65,8 +65,6 @@ function twentyseventeen_custom_header_setup() {
 	 * Styles the header image and text displayed on the blog.
 	 *
 	 * @see twentyseventeen_custom_header_setup().
-	 *
-	 * @since Twenty Seventeen 4.3 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyseventeen_header_style() {
 		$header_text_color = get_header_textcolor();
@@ -78,20 +76,21 @@ function twentyseventeen_header_style() {
 		}
 
 		// If we get this far, we have custom styles. Let's do this.
-		if ( 'blank' === $header_text_color ) {
-			// The text has been hidden.
-			$css = <<<CSS
+		?>
+		<style id="twentyseventeen-custom-header-styles">
+		<?php
+		// Has the text been hidden?
+		if ( 'blank' === $header_text_color ) :
+			?>
 		.site-title,
 		.site-description {
 			position: absolute;
 			clip-path: inset(50%);
 		}
-CSS;
-		} else {
-			// The user has set a custom color for the text, so use that.
-			$sanitize_hex_color_no_hash = 'sanitize_hex_color_no_hash';
-
-			$css = <<<CSS
+			<?php
+			// If the user has set a custom color for the text use that.
+		else :
+			?>
 		.site-title a,
 		.colors-dark .site-title a,
 		.colors-custom .site-title a,
@@ -110,16 +109,11 @@ function twentyseventeen_header_style() {
 		body.has-header-video.colors-dark .site-description,
 		body.has-header-image.colors-custom .site-description,
 		body.has-header-video.colors-custom .site-description {
-			color: #{$sanitize_hex_color_no_hash( $header_text_color )};
-		}
-CSS;
-		}
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentyseventeen-custom-header-styles' ) );
-		} else {
-			echo "<style id=\"twentyseventeen-custom-header-styles\">\n{$css}\n</style>\n";
+			color: #<?php echo esc_attr( $header_text_color ); ?>;
 		}
+	<?php endif; ?>
+	</style>
+		<?php
 	}
 endif; // End of twentyseventeen_header_style().
 
diff --git a/src/wp-content/themes/twentysixteen/inc/customizer.php b/src/wp-content/themes/twentysixteen/inc/customizer.php
index d1afe396f0395..f72a83d53b51b 100644
--- a/src/wp-content/themes/twentysixteen/inc/customizer.php
+++ b/src/wp-content/themes/twentysixteen/inc/customizer.php
@@ -79,7 +79,6 @@ function twentysixteen_custom_header_and_background() {
 	 * Create your own twentysixteen_header_style() function to override in a child theme.
 	 *
 	 * @since Twenty Sixteen 1.0
-	 * @since Twenty Sixteen 4.0 Added `wp_print_inline_style_tag()` support.
 	 *
 	 * @see twentysixteen_custom_header_and_background().
 	 */
@@ -90,7 +89,8 @@ function twentysixteen_header_style() {
 		}
 
 		// If the header text has been hidden.
-		$css = <<<CSS
+		?>
+		<style id="twentysixteen-header-css">
 		.site-branding {
 			margin: 0 auto 0 0;
 		}
@@ -100,13 +100,8 @@ function twentysixteen_header_style() {
 			clip-path: inset(50%);
 			position: absolute;
 		}
-CSS;
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentysixteen-header-css' ) );
-		} else {
-			echo "<style id=\"twentysixteen-header-css\">\n{$css}\n</style>\n";
-		}
+		</style>
+		<?php
 	}
 endif; // twentysixteen_header_style()
 
diff --git a/src/wp-content/themes/twentyten/functions.php b/src/wp-content/themes/twentyten/functions.php
index 3005731da0262..8cfd93bbf6faa 100644
--- a/src/wp-content/themes/twentyten/functions.php
+++ b/src/wp-content/themes/twentyten/functions.php
@@ -274,26 +274,21 @@ function twentyten_setup() {
 	 * Referenced via add_custom_image_header() in twentyten_setup().
 	 *
 	 * @since Twenty Ten 1.0
-	 * @since Twenty Ten 4.8 Added `wp_print_inline_style_tag()` support.
 	 */
 	function twentyten_admin_header_style() {
-		$css = <<<CSS
-		/* Shows the same border as on front end */
-		#headimg {
-		border-bottom: 1px solid #000;
-		border-top: 4px solid #000;
-		}
-		/* If header-text was supported, you would style the text with these selectors:
-		#headimg #name { }
-		#headimg #desc { }
-		*/
-CSS;
-
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css, array( 'id' => 'twentyten-admin-header-css' ) );
-		} else {
-			echo "<style id=\"twentyten-admin-header-css\">\n{$css}\n</style>\n";
-		}
+		?>
+	<style id="twentyten-admin-header-css">
+	/* Shows the same border as on front end */
+	#headimg {
+	border-bottom: 1px solid #000;
+	border-top: 4px solid #000;
+	}
+	/* If header-text was supported, you would style the text with these selectors:
+	#headimg #name { }
+	#headimg #desc { }
+	*/
+	</style>
+		<?php
 	}
 endif;
 
diff --git a/src/wp-content/themes/twentythirteen/inc/custom-header.php b/src/wp-content/themes/twentythirteen/inc/custom-header.php
index dac0e1a413e98..f293a46a46858 100644
--- a/src/wp-content/themes/twentythirteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentythirteen/inc/custom-header.php
@@ -84,7 +84,6 @@ function twentythirteen_custom_header_fonts() {
  * get_header_textcolor() options: Hide text (returns 'blank'), or any hex value.
  *
  * @since Twenty Thirteen 1.0
- * @since Twenty Thirteen 4.8 Added `wp_print_inline_style_tag()` support.
  */
 function twentythirteen_header_style() {
 	$header_image = get_header_image();
@@ -96,106 +95,76 @@ function twentythirteen_header_style() {
 	}
 
 	// If we get this far, we have custom styles.
-	$css = array();
-
-	if ( ! empty( $header_image ) ) {
-		$esc_url_raw = 'esc_url_raw';
-
-		$css[] = <<<CSS
+	?>
+	<style id="twentythirteen-header-css">
+	<?php
+	if ( ! empty( $header_image ) ) :
+		?>
+	.site-header {
+		background: url(<?php header_image(); ?>) no-repeat scroll top;
+		background-size: 1600px auto;
+	}
+	@media (max-width: 767px) {
 		.site-header {
-			background: url("{$esc_url_raw( $header_image )}") no-repeat scroll top;
-			background-size: 1600px auto;
-		}
-		@media (max-width: 767px) {
-			.site-header {
-				background-size: 768px auto;
-			}
+			background-size: 768px auto;
 		}
-		@media (max-width: 359px) {
-			.site-header {
-				background-size: 360px auto;
-			}
-		}
-CSS;
 	}
-
-	if ( ! display_header_text() ) {
-		// The text has been hidden.
-		$css[] = <<<CSS
-		.site-title,
-		.site-description {
-			position: absolute;
-			clip-path: inset(50%);
+	@media (max-width: 359px) {
+		.site-header {
+			background-size: 360px auto;
 		}
-CSS;
+	}
+		<?php
+		endif;
 
-		if ( empty( $header_image ) ) {
-			$css[] = <<<CSS
-			.site-header .home-link {
-			min-height: 0;
-			}
-CSS;
-		}
-	} elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) {
-		// The user has set a custom color for the text, so use that.
-		// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
-		$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
+		// Has the text been hidden?
+	if ( ! display_header_text() ) :
+		?>
+	.site-title,
+	.site-description {
+		position: absolute;
+		clip-path: inset(50%);
+	}
+		<?php
+		if ( empty( $header_image ) ) :
+			?>
+	.site-header .home-link {
+	min-height: 0;
+	}
+			<?php
+		endif;
 
-		$css[] = <<<CSS
+		// If the user has set a custom color for the text, use that.
+		elseif ( get_theme_support( 'custom-header', 'default-text-color' ) !== $text_color ) :
+			?>
 		.site-title,
 		.site-description {
-			color: #{$sanitized_text_color};
+			color: #<?php echo esc_attr( $text_color ); ?>;
 		}
-CSS;
-	}
-
-	$css = implode( "\n", $css );
-
-	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-		wp_print_inline_style_tag( $css, array( 'id' => 'twentythirteen-header-css' ) );
-	} else {
-		echo "<style id=\"twentythirteen-header-css\">\n{$css}\n</style>\n";
-	}
+	<?php endif; ?>
+	</style>
+	<?php
 }
 
 /**
  * Styles the header image displayed on the Appearance > Header admin panel.
  *
  * @since Twenty Thirteen 1.0
- * @since Twenty Thirteen 4.8 Added `wp_print_inline_style_tag()` support.
  */
 function twentythirteen_admin_header_style() {
 	$header_image = get_header_image();
-
-	$header_image_declarations = '';
-	if ( ! empty( $header_image ) ) {
-		$esc_url_raw               = 'esc_url_raw';
-		$header_image_declarations = "background: url(\"{$esc_url_raw( $header_image )}\") no-repeat scroll top; background-size: 1600px auto;";
-	}
-
-	$min_height_declaration = '';
-	if ( ! empty( $header_image ) || display_header_text() ) {
-		$min_height_declaration = 'min-height: 230px;';
-	}
-
-	$hidden_text_rule = '';
-	if ( ! display_header_text() ) {
-		$hidden_text_rule = <<<CSS
-	#headimg h1,
-	#headimg h2 {
-		position: absolute !important;
-		clip-path: inset(50%);
-	}
-CSS;
-	}
-
-	$css = <<<CSS
+	?>
+	<style id="twentythirteen-admin-header-css">
 	.appearance_page_custom-header #headimg {
 		border: none;
 		-webkit-box-sizing: border-box;
 		-moz-box-sizing:    border-box;
 		box-sizing:         border-box;
-		{$header_image_declarations}
+		<?php
+		if ( ! empty( $header_image ) ) {
+			echo 'background: url(' . esc_url( $header_image ) . ') no-repeat scroll top; background-size: 1600px auto;';
+		}
+		?>
 		padding: 0 20px;
 	}
 	#headimg .home-link {
@@ -204,10 +173,20 @@ function twentythirteen_admin_header_style() {
 		box-sizing:         border-box;
 		margin: 0 auto;
 		max-width: 1040px;
-		{$min_height_declaration}
+		<?php
+		if ( ! empty( $header_image ) || display_header_text() ) {
+			echo 'min-height: 230px;';
+		}
+		?>
 		width: 100%;
 	}
-{$hidden_text_rule}
+	<?php if ( ! display_header_text() ) : ?>
+	#headimg h1,
+	#headimg h2 {
+		position: absolute !important;
+		clip-path: inset(50%);
+	}
+	<?php endif; ?>
 	#headimg h1 {
 		font: bold 60px/1 Bitter, Georgia, serif;
 		margin: 0;
@@ -228,13 +207,8 @@ function twentythirteen_admin_header_style() {
 		max-width: 230px;
 		width: auto;
 	}
-CSS;
-
-	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-		wp_print_inline_style_tag( $css, array( 'id' => 'twentythirteen-admin-header-css' ) );
-	} else {
-		echo "<style id=\"twentythirteen-admin-header-css\">\n{$css}\n</style>\n";
-	}
+	</style>
+	<?php
 }
 
 /**
diff --git a/src/wp-content/themes/twentytwelve/inc/custom-header.php b/src/wp-content/themes/twentytwelve/inc/custom-header.php
index 5ffdd64fe5f1d..d7297cf0de93f 100644
--- a/src/wp-content/themes/twentytwelve/inc/custom-header.php
+++ b/src/wp-content/themes/twentytwelve/inc/custom-header.php
@@ -66,7 +66,6 @@ function twentytwelve_custom_header_fonts() {
  * get_header_textcolor() options: 515151 is default, hide text (returns 'blank'), or any hex value.
  *
  * @since Twenty Twelve 1.0
- * @since Twenty Twelve 5.0 Added `wp_print_inline_style_tag()` support.
  */
 function twentytwelve_header_style() {
 	$text_color = get_header_textcolor();
@@ -77,45 +76,38 @@ function twentytwelve_header_style() {
 	}
 
 	// If we get this far, we have custom styles.
-	if ( ! display_header_text() ) {
-		// The text has been hidden.
-		$css = <<<CSS
-		.site-title,
-		.site-description {
-			position: absolute;
-			clip-path: inset(50%);
-		}
-CSS;
-	} else {
-		// The user has set a custom color for the text, so use that.
-		// Validate inline since sanitize_hex_color_no_hash() is not available outside the Customizer before WordPress 4.6.
-		$sanitized_text_color = preg_match( '/^([a-f0-9]{3}){1,2}$/i', $text_color ) ? $text_color : '';
-
-		$css = <<<CSS
+	?>
+	<style id="twentytwelve-header-css">
+	<?php
+		// Has the text been hidden?
+	if ( ! display_header_text() ) :
+		?>
+	.site-title,
+	.site-description {
+		position: absolute;
+		clip-path: inset(50%);
+	}
+		<?php
+		// If the user has set a custom color for the text, use that.
+		else :
+			?>
 		.site-header h1 a,
 		.site-header h2 {
-			color: #{$sanitized_text_color};
+			color: #<?php echo $text_color; ?>;
 		}
-CSS;
-	}
-
-	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-		wp_print_inline_style_tag( $css, array( 'id' => 'twentytwelve-header-css' ) );
-	} else {
-		echo "<style id=\"twentytwelve-header-css\">\n{$css}\n</style>\n";
-	}
+	<?php endif; ?>
+	</style>
+	<?php
 }
 
 /**
  * Styles the header image displayed on the Appearance > Header admin panel.
  *
  * @since Twenty Twelve 1.0
- * @since Twenty Twelve 5.0 Added `wp_print_inline_style_tag()` support.
  */
 function twentytwelve_admin_header_style() {
-	$max_width = (int) get_theme_support( 'custom-header', 'max-width' );
-
-	$css = <<<CSS
+	?>
+	<style id="twentytwelve-admin-header-css">
 	.appearance_page_custom-header #headimg {
 		border: none;
 		font-family: "Open Sans", Helvetica, Arial, sans-serif;
@@ -142,15 +134,10 @@ function twentytwelve_admin_header_style() {
 		margin-bottom: 24px;
 	}
 	#headimg img {
-		max-width: {$max_width}px;
-	}
-CSS;
-
-	if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-		wp_print_inline_style_tag( $css, array( 'id' => 'twentytwelve-admin-header-css' ) );
-	} else {
-		echo "<style id=\"twentytwelve-admin-header-css\">\n{$css}\n</style>\n";
+		max-width: <?php echo get_theme_support( 'custom-header', 'max-width' ); ?>px;
 	}
+	</style>
+	<?php
 }
 
 /**
diff --git a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
index 3cdcc105f866f..6644e7d02eeab 100644
--- a/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
+++ b/src/wp-content/themes/twentytwentyone/classes/class-twenty-twenty-one-dark-mode.php
@@ -303,7 +303,6 @@ public function the_switch() {
 	 * Inspired from https://codepen.io/aaroniker/pen/KGpXZo (MIT-licensed)
 	 *
 	 * @since Twenty Twenty-One 1.0
-	 * @since Twenty Twenty-One 3.0 Added `wp_print_inline_style_tag()` support.
 	 *
 	 * @param array $attrs The attributes to add to our <button> element.
 	 * @return void
@@ -329,35 +328,18 @@ public function the_html( $attrs = array() ) {
 			'<span aria-hidden="true"></span>'
 		);
 		echo '</button>';
-
-		/*
-		 * Escape the labels for use in single-quoted CSS strings. HTML character references
-		 * are not decoded in STYLE elements, so esc_attr() would not be appropriate here.
-		 */
-		$escape_css_string = static function ( $text ) {
-			return str_replace(
-				array( '\\', "'", '<', "\n", "\r" ),
-				array( '\\\\', "\\'", '\\3C ', '\\A ', '\\D ' ),
-				$text
-			);
-		};
-
-		$margin_side = is_rtl() ? 'right' : 'left';
-
-		$css = <<<CSS
+		?>
+		<style>
 			#dark-mode-toggler > span {
-				margin-{$margin_side}: 5px;
+				margin-<?php echo is_rtl() ? 'right' : 'left'; ?>: 5px;
 			}
 			#dark-mode-toggler > span::before {
-				content: '{$escape_css_string( __( 'Off', 'twentytwentyone' ) )}';
+				content: '<?php esc_attr_e( 'Off', 'twentytwentyone' ); ?>';
 			}
 			#dark-mode-toggler[aria-pressed="true"] > span::before {
-				content: '{$escape_css_string( __( 'On', 'twentytwentyone' ) )}';
+				content: '<?php esc_attr_e( 'On', 'twentytwentyone' ); ?>';
 			}
-CSS;
-
-		if ( is_admin() || wp_is_json_request() ) {
-			$css .= "\n" . <<<CSS
+			<?php if ( is_admin() || wp_is_json_request() ) : ?>
 				.components-editor-notices__pinned ~ .edit-post-visual-editor #dark-mode-toggler {
 					z-index: 20;
 				}
@@ -369,14 +351,10 @@ public function the_html( $attrs = array() ) {
 						margin-top: 32px;
 					}
 				}
-CSS;
-		}
+			<?php endif; ?>
+		</style>
 
-		if ( function_exists( 'wp_print_inline_style_tag' ) ) {
-			wp_print_inline_style_tag( $css );
-		} else {
-			echo "<style>\n{$css}\n</style>\n";
-		}
+		<?php
 	}
 
 	/**
diff --git a/src/wp-includes/class-wp-customize-manager.php b/src/wp-includes/class-wp-customize-manager.php
index fddfcfc6af189..412f575e3afd0 100644
--- a/src/wp-includes/class-wp-customize-manager.php
+++ b/src/wp-includes/class-wp-customize-manager.php
@@ -2055,8 +2055,8 @@ public function customize_preview_html5() {
 	 * @since 4.2.0
 	 */
 	public function customize_preview_loading_style() {
-		wp_print_inline_style_tag(
-			<<<'CSS'
+		?>
+		<style>
 			body.wp-customizer-unloading {
 				opacity: 0.25;
 				cursor: progress !important;
@@ -2074,8 +2074,8 @@ public function customize_preview_loading_style() {
 			area.customize-unpreviewable {
 				cursor: not-allowed !important;
 			}
-			CSS
-		);
+		</style>
+		<?php
 	}
 
 	/**
diff --git a/src/wp-includes/class-wp-customize-widgets.php b/src/wp-includes/class-wp-customize-widgets.php
index bdb3553c28b20..d7cd0d5de15dd 100644
--- a/src/wp-includes/class-wp-customize-widgets.php
+++ b/src/wp-includes/class-wp-customize-widgets.php
@@ -1283,17 +1283,17 @@ public function customize_preview_enqueue() {
 	 * @since 3.9.0
 	 */
 	public function print_preview_css() {
-		wp_print_inline_style_tag(
-			<<<'CSS'
-			.widget-customizer-highlighted-widget {
-				outline: none;
-				-webkit-box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
-				box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
-				position: relative;
-				z-index: 1;
-			}
-			CSS
-		);
+		?>
+		<style>
+		.widget-customizer-highlighted-widget {
+			outline: none;
+			-webkit-box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
+			box-shadow: 0 0 2px rgba(30, 140, 190, 0.8);
+			position: relative;
+			z-index: 1;
+		}
+		</style>
+		<?php
 	}
 
 	/**
diff --git a/src/wp-includes/customize/class-wp-customize-site-icon-control.php b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
index c86e20b1726e4..e8dd34070d74c 100644
--- a/src/wp-includes/customize/class-wp-customize-site-icon-control.php
+++ b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
@@ -58,15 +58,11 @@ public function content_template() {
 		<# if ( data.attachment && data.attachment.id ) { #>
 			<div class="attachment-media-view">
 				<# if ( data.attachment.sizes ) { #>
-					<?php
-					wp_print_inline_style_tag(
-						<<<'CSS'
+					<style>
 						:root{
-							--site-icon-url: url( "{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" );
+							--site-icon-url: url( '{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}' );
 						}
-						CSS
-					);
-					?>
+					</style>
 					<div class="site-icon-preview customizer">
 						<div class="direction-wrap">
 							<img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" class="app-icon-preview" alt="{{
diff --git a/src/wp-includes/deprecated.php b/src/wp-includes/deprecated.php
index c9cdec64a2818..df621af9267c4 100644
--- a/src/wp-includes/deprecated.php
+++ b/src/wp-includes/deprecated.php
@@ -5946,7 +5946,11 @@ function print_embed_styles() {
 	_deprecated_function( __FUNCTION__, '6.4.0', 'wp_enqueue_embed_styles' );
 
 	$suffix = SCRIPT_DEBUG ? '' : '.min';
-	wp_print_inline_style_tag( (string) file_get_contents( ABSPATH . WPINC . "/css/wp-embed-template$suffix.css" ) );
+	?>
+	<style>
+		<?php echo file_get_contents( ABSPATH . WPINC . "/css/wp-embed-template$suffix.css" ); ?>
+	</style>
+	<?php
 }
 
 /**
@@ -5965,22 +5969,22 @@ function print_emoji_styles() {
 
 	$printed = true;
 
-	wp_print_inline_style_tag(
-		<<<'CSS'
-		img.wp-smiley,
-		img.emoji {
-			display: inline !important;
-			border: none !important;
-			box-shadow: none !important;
-			height: 1em !important;
-			width: 1em !important;
-			margin: 0 0.07em !important;
-			vertical-align: -0.1em !important;
-			background: none !important;
-			padding: 0 !important;
-		}
-		CSS
-	);
+	?>
+	<style>
+	img.wp-smiley,
+	img.emoji {
+		display: inline !important;
+		border: none !important;
+		box-shadow: none !important;
+		height: 1em !important;
+		width: 1em !important;
+		margin: 0 0.07em !important;
+		vertical-align: -0.1em !important;
+		background: none !important;
+		padding: 0 !important;
+	}
+	</style>
+	<?php
 }
 
 /**
@@ -5991,12 +5995,9 @@ function print_emoji_styles() {
  */
 function wp_admin_bar_header() {
 	_deprecated_function( __FUNCTION__, '6.4.0', 'wp_enqueue_admin_bar_header_styles' );
-	wp_print_inline_style_tag(
-		<<<'CSS'
-		#wpadminbar { display:none; }
-		CSS,
-		array( 'media' => 'print' )
-	);
+	?>
+	<style media="print">#wpadminbar { display:none; }</style>
+	<?php
 }
 
 /**
@@ -6007,15 +6008,14 @@ function wp_admin_bar_header() {
  */
 function _admin_bar_bump_cb() {
 	_deprecated_function( __FUNCTION__, '6.4.0', 'wp_enqueue_admin_bar_bump_styles' );
-	wp_print_inline_style_tag(
-		<<<'CSS'
-		html { margin-top: 32px !important; }
-		@media screen and ( max-width: 782px ) {
-		  html { margin-top: 46px !important; }
-		}
-		CSS,
-		array( 'media' => 'screen' )
-	);
+	?>
+	<style media="screen">
+	html { margin-top: 32px !important; }
+	@media screen and ( max-width: 782px ) {
+	  html { margin-top: 46px !important; }
+	}
+	</style>
+	<?php
 }
 
 /**
@@ -6209,8 +6209,8 @@ function the_block_template_skip_link() {
 	/**
 	 * Print the skip-link styles.
 	 */
-	wp_print_inline_style_tag(
-		<<<'CSS'
+	?>
+	<style id="skip-link-styles">
 		.skip-link.screen-reader-text {
 			border: 0;
 			clip-path: inset(50%);
@@ -6240,9 +6240,8 @@ function the_block_template_skip_link() {
 			width: auto;
 			z-index: 100000;
 		}
-		CSS,
-		array( 'id' => 'skip-link-styles' )
-	);
+	</style>
+	<?php
 	/**
 	 * Print the skip-link script.
 	 */
@@ -6531,11 +6530,9 @@ function wp_print_auto_sizes_contain_css_fix() {
 		return;
 	}
 
-	wp_print_inline_style_tag(
-		<<<'CSS'
-		img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }
-		CSS
-	);
+	?>
+	<style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>
+	<?php
 }
 
 /**
diff --git a/src/wp-includes/fonts/class-wp-font-face.php b/src/wp-includes/fonts/class-wp-font-face.php
index efb2eff0f58bf..c8d081b9557b5 100644
--- a/src/wp-includes/fonts/class-wp-font-face.php
+++ b/src/wp-includes/fonts/class-wp-font-face.php
@@ -92,7 +92,10 @@ public function generate_and_print( array $fonts ) {
 			return;
 		}
 
-		wp_print_inline_style_tag( $css, array( 'class' => 'wp-fonts-local' ) );
+		$processor = new WP_HTML_Tag_Processor( '<style class="wp-fonts-local"></style>' );
+		$processor->next_tag();
+		$processor->set_modifiable_text( "\n{$css}\n" );
+		echo "{$processor->get_updated_html()}\n";
 	}
 
 	/**
diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index b9206af605a79..3e7062c4f122b 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -4018,8 +4018,7 @@ function _default_wp_die_handler( $message, $title = '', $args = array() ) {
 		}
 		?>
 	<title><?php echo $title; ?></title>
-		<?php
-		$css = <<<'CSS'
+	<style>
 		html {
 			background: #f1f1f1;
 		}
@@ -4121,18 +4120,13 @@ function _default_wp_die_handler( $message, $title = '', $args = array() ) {
 			-webkit-box-shadow: none;
 			box-shadow: none;
 		}
-		CSS;
-		if ( 'rtl' === $text_direction ) {
-			$css .= "\nbody { font-family: Tahoma, Arial; }";
-		}
 
-		// The wp_die() handler may be called before the inline style tag API has loaded.
-		if ( function_exists( 'wp_print_inline_style_tag' ) && class_exists( 'WP_HTML_Tag_Processor', false ) ) {
-			wp_print_inline_style_tag( $css );
-		} else {
-			echo "<style>\n{$css}\n</style>\n";
+		<?php
+		if ( 'rtl' === $text_direction ) {
+			echo 'body { font-family: Tahoma, Arial; }';
 		}
 		?>
+	</style>
 </head>
 <body id="error-page">
 <?php endif; // ! did_action( 'admin_head' ) ?>
diff --git a/src/wp-includes/media-template.php b/src/wp-includes/media-template.php
index 0a198d8e1ef1a..ee9c6bc21a1c3 100644
--- a/src/wp-includes/media-template.php
+++ b/src/wp-includes/media-template.php
@@ -1561,15 +1561,11 @@ function wp_print_media_templates() {
 
 	<?php // Template for the Site Icon preview, used for example in the Customizer. ?>
 	<script type="text/html" id="tmpl-site-icon-preview-crop">
-		<?php
-		wp_print_inline_style_tag(
-			<<<'CSS'
+		<style>
 			:root{
 				--site-icon-url: url( "{{ data.url }}" );
 			}
-			CSS
-		);
-		?>
+		</style>
 		<h2><?php _ex( 'Site Icon Preview', 'noun' ); ?></h2>
 		<p><?php _e( 'As an app icon and a browser icon.' ); ?></p>
 		<div class="site-icon-preview crop">
diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php
index 251d28ff0b8d9..2ffa92f2edba0 100644
--- a/src/wp-includes/media.php
+++ b/src/wp-includes/media.php
@@ -2989,8 +2989,8 @@ function gallery_shortcode( $attr ) {
 	 *                    Otherwise, defaults to true.
 	 */
 	if ( apply_filters( 'use_default_gallery_style', ! $html5 ) ) {
-		$gallery_style = "\n\t\t" . wp_get_inline_style_tag(
-			<<<CSS
+		$gallery_style = "
+		<style>
 			#{$selector} {
 				margin: auto;
 			}
@@ -3007,8 +3007,7 @@ function gallery_shortcode( $attr ) {
 				margin-left: 0;
 			}
 			/* see gallery_shortcode() in wp-includes/media.php */
-			CSS
-		) . "\t\t";
+		</style>\n\t\t";
 	}
 
 	$size_class  = sanitize_html_class( is_array( $atts['size'] ) ? implode( 'x', $atts['size'] ) : $atts['size'] );
diff --git a/src/wp-includes/ms-deprecated.php b/src/wp-includes/ms-deprecated.php
index 9e9da5e75df71..8b4a1ff6f023f 100644
--- a/src/wp-includes/ms-deprecated.php
+++ b/src/wp-includes/ms-deprecated.php
@@ -96,26 +96,21 @@ function graceful_fail( $message ) {
 <html><head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
 <title>Error!</title>
-' . str_replace( // Escape any '%' from filtered attributes, since this is a sprintf() format.
-	'%',
-	'%%',
-	wp_get_inline_style_tag(
-		<<<'CSS'
-		img {
-			border: 0;
-		}
-		body {
-		line-height: 1.6em; font-family: Georgia, serif; width: 390px; margin: auto;
-		text-align: center;
-		}
-		.message {
-			font-size: 22px;
-			width: 350px;
-			margin: auto;
-		}
-		CSS
-	)
-) . '</head>
+<style>
+img {
+	border: 0;
+}
+body {
+line-height: 1.6em; font-family: Georgia, serif; width: 390px; margin: auto;
+text-align: center;
+}
+.message {
+	font-size: 22px;
+	width: 350px;
+	margin: auto;
+}
+</style>
+</head>
 <body>
 <p class="message">%s</p>
 </body>
diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php
index 18f3b49c3810a..cd905188512b3 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php
@@ -638,17 +638,13 @@ private function render_legacy_widget_preview_iframe( $id_base, $instance ) {
 			<meta name="viewport" content="width=device-width, initial-scale=1" />
 			<link rel="profile" href="https://gmpg.org/xfn/11" />
 			<?php wp_head(); ?>
-			<?php
-			wp_print_inline_style_tag(
-				<<<'CSS'
+			<style>
 				/* Reset theme styles */
 				html, body, #page, #content {
 					padding: 0 !important;
 					margin: 0 !important;
 				}
-				CSS
-			);
-			?>
+			</style>
 		</head>
 		<body <?php body_class(); ?>>
 		<div id="page" class="site">
diff --git a/src/wp-includes/theme-compat/header.php b/src/wp-includes/theme-compat/header.php
index ae5ffe58e274c..340477fb94f1e 100644
--- a/src/wp-includes/theme-compat/header.php
+++ b/src/wp-includes/theme-compat/header.php
@@ -26,23 +26,20 @@
 <link rel="stylesheet" href="<?php bloginfo( 'stylesheet_url' ); ?>" media="screen" />
 <link rel="pingback" href="<?php bloginfo( 'pingback_url' ); ?>" />
 
-<?php
-if ( file_exists( get_stylesheet_directory() . '/images/kubrickbgwide.jpg' ) ) {
+<?php if ( file_exists( get_stylesheet_directory() . '/images/kubrickbgwide.jpg' ) ) { ?>
+<style media="screen">
+
+	<?php
 	// Checks to see whether it needs a sidebar.
 	if ( empty( $withcomments ) && ! is_single() ) {
-		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbg-' . get_bloginfo( 'text_direction', 'display' ) . '.jpg';
-	} else { // No sidebar.
-		$kubrick_background = get_bloginfo( 'stylesheet_directory', 'display' ) . '/images/kubrickbgwide.jpg';
-	}
-	$esc_url_raw = 'esc_url_raw';
-	wp_print_inline_style_tag(
-		<<<CSS
-		#page { background: url( "{$esc_url_raw( $kubrick_background )}" ) repeat-y top; border: none; }
-		CSS,
-		array( 'media' => 'screen' )
-	);
-}
-?>
+		?>
+	#page { background: url("<?php bloginfo( 'stylesheet_directory' ); ?>/images/kubrickbg-<?php bloginfo( 'text_direction' ); ?>.jpg") repeat-y top; border: none; }
+<?php } else { // No sidebar. ?>
+	#page { background: url("<?php bloginfo( 'stylesheet_directory' ); ?>/images/kubrickbgwide.jpg") repeat-y top; border: none; }
+<?php } ?>
+
+</style>
+<?php } ?>
 
 <?php
 if ( is_singular() ) {
diff --git a/src/wp-includes/theme.php b/src/wp-includes/theme.php
index 27492c22509da..d81616c6c552f 100644
--- a/src/wp-includes/theme.php
+++ b/src/wp-includes/theme.php
@@ -1899,7 +1899,7 @@ function _custom_background_cb() {
 
 	if ( ! $background && ! $color ) {
 		if ( is_customize_preview() ) {
-			wp_print_inline_style_tag( '', array( 'id' => 'custom-background-css' ) );
+			echo '<style id="custom-background-css"></style>';
 		}
 		return;
 	}
@@ -1953,10 +1953,12 @@ function _custom_background_cb() {
 		$style .= $image . $position . $size . $repeat . $attachment;
 	}
 
-	wp_print_inline_style_tag(
-		'body.custom-background { ' . trim( $style ) . ' }',
-		array( 'id' => 'custom-background-css' )
-	);
+	$processor = new WP_HTML_Tag_Processor( '<style id="custom-background-css"></style>' );
+	$processor->next_tag();
+
+	$style_tag_content = 'body.custom-background { ' . trim( $style ) . ' }';
+	$processor->set_modifiable_text( "\n{$style_tag_content}\n" );
+	echo "{$processor->get_updated_html()}\n";
 }
 
 /**
@@ -1970,7 +1972,11 @@ function wp_custom_css_cb() {
 		return;
 	}
 
-	wp_print_inline_style_tag( $styles, array( 'id' => 'wp-custom-css' ) );
+	$processor = new WP_HTML_Tag_Processor( '<style></style>' );
+	$processor->next_tag();
+	$processor->set_attribute( 'id', 'wp-custom-css' );
+	$processor->set_modifiable_text( "\n{$styles}\n" );
+	echo "{$processor->get_updated_html()}\n";
 }
 
 /**
@@ -3000,11 +3006,15 @@ function _custom_logo_header_styles() {
 		$classes = (array) get_theme_support( 'custom-logo', 'header-text' );
 		$classes = array_map( 'sanitize_html_class', $classes );
 		$classes = '.' . implode( ', .', $classes );
-		echo "<!-- Custom Logo: hide header text -->\n";
-		wp_print_inline_style_tag(
-			"{$classes} {\n\tposition: absolute;\n\tclip-path: inset(50%);\n}",
-			array( 'id' => 'custom-logo-css' )
-		);
+		?>
+		<!-- Custom Logo: hide header text -->
+		<style id="custom-logo-css">
+			<?php echo $classes; ?> {
+				position: absolute;
+				clip-path: inset(50%);
+			}
+		</style>
+		<?php
 	}
 }
 
diff --git a/src/wp-includes/widgets/class-wp-widget-recent-comments.php b/src/wp-includes/widgets/class-wp-widget-recent-comments.php
index e7fa16c4e0f52..246eac6cf9d72 100644
--- a/src/wp-includes/widgets/class-wp-widget-recent-comments.php
+++ b/src/wp-includes/widgets/class-wp-widget-recent-comments.php
@@ -55,11 +55,7 @@ public function recent_comments_style() {
 			return;
 		}
 
-		wp_print_inline_style_tag(
-			<<<'CSS'
-			.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}
-			CSS
-		);
+		echo '<style>.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}</style>';
 	}
 
 	/**
diff --git a/src/wp-login.php b/src/wp-login.php
index 03faf59f87240..5a8df12b01c5e 100644
--- a/src/wp-login.php
+++ b/src/wp-login.php
@@ -175,11 +175,9 @@ function login_header( $title = null, $message = '', $wp_error = null ) {
 	if ( $interim_login ) {
 		$classes[] = 'interim-login';
 
-		wp_print_inline_style_tag(
-			<<<'CSS'
-			html{background-color: transparent;}
-			CSS
-		);
+		?>
+		<style>html{background-color: transparent;}</style>
+		<?php
 
 		if ( 'success' === $interim_login ) {
 			$classes[] = 'interim-login-success';
diff --git a/src/wp-signup.php b/src/wp-signup.php
index f4c1e40332297..a53013a76b5c6 100644
--- a/src/wp-signup.php
+++ b/src/wp-signup.php
@@ -67,8 +67,8 @@ function do_signup_header() {
  * @since MU (3.0.0)
  */
 function wpmu_signup_stylesheet() {
-	wp_print_inline_style_tag(
-		<<<'CSS'
+	?>
+	<style>
 		.mu_register { width: 90%; margin: 0 auto; text-align: start; padding: 24px; box-sizing: border-box; }
 		.mu_register p { font-size: 18px; }
 		.mu_register form { margin: 24px 0; }
@@ -99,8 +99,8 @@ function wpmu_signup_stylesheet() {
 		.mu_register .privacy-intro .wp-signup-radio-button { margin-right: 0.5em; }
 		.rtl .mu_register .wp-signup-blogname { direction: ltr; text-align: right; }
 		.rtl .mu_register label[for="site-language"] .dashicons { margin-right: 0.5em; margin-left: 0; }
-		CSS
-	);
+	</style>
+	<?php
 }
 add_action( 'wp_head', 'wpmu_signup_stylesheet' );
 
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 2ff7fb7c96b3c..f3a9890bf4c27 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -10,31 +10,6 @@
  */
 class Tests_Dependencies_wpInlineStyleTag extends WP_UnitTestCase {
 
-	/**
-	 * Theme features before each test, since they are not restored automatically.
-	 *
-	 * @var array<string, mixed>
-	 */
-	private array $original_theme_features;
-
-	/**
-	 * @global array<string, mixed> $_wp_theme_features
-	 */
-	public function set_up(): void {
-		global $_wp_theme_features;
-		parent::set_up();
-		$this->original_theme_features = $_wp_theme_features;
-	}
-
-	/**
-	 * @global array<string, mixed> $_wp_theme_features
-	 */
-	public function tear_down(): void {
-		global $_wp_theme_features;
-		$_wp_theme_features = $this->original_theme_features;
-		parent::tear_down();
-	}
-
 	/**
 	 * @ticket 51325
 	 */
@@ -198,115 +173,6 @@ public function test_inline_style_tag_escapes_closing_style_tag() {
 		$this->assertFalse( $processor->next_tag(), 'Expected the CSS to not break out of the STYLE element.' );
 	}
 
-	/**
-	 * Data provider for test_core_inline_styles_have_filtered_attributes().
-	 *
-	 * @return array<non-falsy-string, array{ set_up: Closure(): void, print_callback: callable(): void, attribute_name: non-falsy-string, attribute_value: non-falsy-string }>
-	 */
-	public function data_core_inline_styles(): array {
-		return array(
-			'custom_background' => array(
-				'set_up'          => static function (): void {
-					add_theme_support( 'custom-background' );
-					set_theme_mod( 'background_color', 'ff0000' );
-				},
-				'print_callback'  => '_custom_background_cb',
-				'attribute_name'  => 'id',
-				'attribute_value' => 'custom-background-css',
-			),
-			'custom_css'        => array(
-				'set_up'          => static function (): void {
-					add_filter(
-						'wp_get_custom_css',
-						static function (): string {
-							return 'body { color: #123456; }';
-						}
-					);
-				},
-				'print_callback'  => 'wp_custom_css_cb',
-				'attribute_name'  => 'id',
-				'attribute_value' => 'wp-custom-css',
-			),
-			'custom_logo'       => array(
-				'set_up'          => static function (): void {
-					remove_theme_support( 'custom-header' );
-					add_theme_support( 'custom-logo', array( 'header-text' => array( 'site-title' ) ) );
-					set_theme_mod( 'header_text', false );
-				},
-				'print_callback'  => '_custom_logo_header_styles',
-				'attribute_name'  => 'id',
-				'attribute_value' => 'custom-logo-css',
-			),
-			'font_faces'        => array(
-				'set_up'          => static function (): void {},
-				'print_callback'  => static function (): void {
-					wp_print_font_faces(
-						array(
-							'Inter' => array(
-								array(
-									'font-family' => 'Inter',
-									'src'         => array( 'https://example.com/inter.woff2' ),
-								),
-							),
-						)
-					);
-				},
-				'attribute_name'  => 'class',
-				'attribute_value' => 'wp-fonts-local',
-			),
-			'recent_comments'   => array(
-				'set_up'          => static function (): void {
-					add_theme_support( 'widgets' );
-				},
-				'print_callback'  => static function (): void {
-					( new WP_Widget_Recent_Comments() )->recent_comments_style();
-				},
-				'attribute_name'  => 'nonce',
-				'attribute_value' => 'test-nonce',
-			),
-		);
-	}
-
-	/**
-	 * Tests that inline styles printed by core outside of WP_Styles have filtered attributes.
-	 *
-	 * @ticket 51325
-	 *
-	 * @covers ::_custom_background_cb
-	 * @covers ::wp_custom_css_cb
-	 * @covers ::_custom_logo_header_styles
-	 * @covers WP_Font_Face::generate_and_print
-	 * @covers WP_Widget_Recent_Comments::recent_comments_style
-	 *
-	 * @dataProvider data_core_inline_styles
-	 *
-	 * @param Closure(): void    $set_up          Set up callback.
-	 * @param callable(): void   $print_callback  Callback which prints the inline style.
-	 * @param non-falsy-string   $attribute_name  Name of an attribute the STYLE tag is expected to have.
-	 * @param non-falsy-string   $attribute_value Expected value of the attribute.
-	 */
-	public function test_core_inline_styles_have_filtered_attributes( Closure $set_up, callable $print_callback, string $attribute_name, string $attribute_value ): void {
-		$set_up();
-
-		$filter = new MockAction();
-		add_filter( 'wp_inline_style_attributes', array( $filter, 'filter' ) );
-		add_filter(
-			'wp_inline_style_attributes',
-			static function ( array $attributes ): array {
-				$attributes['nonce'] = 'test-nonce';
-				return $attributes;
-			}
-		);
-
-		$processor = new WP_HTML_Tag_Processor( get_echo( $print_callback ) );
-
-		$this->assertTrue( $processor->next_tag( 'STYLE' ), 'Expected a STYLE tag to be printed.' );
-		$this->assertSame( $attribute_value, $processor->get_attribute( $attribute_name ) );
-		$this->assertSame( 'test-nonce', $processor->get_attribute( 'nonce' ) );
-		$this->assertFalse( $processor->next_tag(), 'Expected only one tag to be printed.' );
-		$this->assertSame( 1, $filter->get_call_count(), 'Expected the filter to be applied once.' );
-	}
-
 	/**
 	 * Gets test CSS code.
 	 *
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index 1547aab02a179..13b78040b9cf9 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1767,58 +1767,6 @@ static function () {
 				},
 			),
 
-			'standard_classic_theme_config_extra_block_library_inline_style_with_filtered_attributes' => array(
-				'set_up'            => static function () {
-					add_action(
-						'enqueue_block_assets',
-						static function () {
-							// Extra CSS which prevents empty inline style containing placeholder from being removed.
-							wp_add_inline_style( 'wp-block-library', '.wp-block-separator{ outline:solid 1px lime; }' );
-						}
-					);
-					add_filter(
-						'wp_inline_style_attributes',
-						static function ( array $attributes ): array {
-							$attributes['nonce'] = 'test-nonce';
-							return $attributes;
-						}
-					);
-				},
-				'content'           => $blocks_content,
-				'inline_size_limit' => 0,
-				'expected_styles'   => array(
-					'HEAD' => array_merge(
-						$early_common_styles,
-						array(
-							'wp-block-library-css',
-							'wp-block-separator-css',
-							'wp-block-library-inline-css-extra',
-							'classic-theme-styles-css',
-							'third-party-test-block-css',
-							'custom-block-styles-css',
-							'global-styles-inline-css',
-						),
-						$common_at_wp_enqueue_scripts,
-						$common_late_in_head,
-						$common_late_in_body
-					),
-					'BODY' => array(),
-				),
-				'assert'            => function ( string $buffer, string $filtered_buffer ) {
-					$processor = new WP_HTML_Tag_Processor( $filtered_buffer );
-					$found     = false;
-					while ( $processor->next_tag( 'STYLE' ) ) {
-						$id = $processor->get_attribute( 'id' );
-						$this->assertSame( 'test-nonce', $processor->get_attribute( 'nonce' ), sprintf( 'Expected the STYLE tag with ID "%s" to have the filtered attributes.', is_string( $id ) ? $id : '' ) );
-						if ( 'wp-block-library-inline-css-extra' === $id ) {
-							$found = true;
-							$this->assertStringContainsString( '.wp-block-separator{ outline:solid 1px lime; }', $processor->get_modifiable_text() );
-						}
-					}
-					$this->assertTrue( $found, 'Expected the hoisted extra inline style to be present.' );
-				},
-			),
-
 			'classic_theme_opt_out_separate_block_styles' => array(
 				'set_up'            => static function () {
 					add_filter( 'should_load_separate_core_block_assets', '__return_false' );
@@ -2118,7 +2066,7 @@ static function () {
 		// Create a simulated output buffer.
 		$buffer = '<html lang="en"><head><meta charset="utf-8">' . $head_output . '</head><body><main>' . $content . '</main>' . $footer_output . '</body></html>';
 
-		$global_styles_placeholder_regexp = '#<style id="wp-global-styles-placeholder-inline-css"[\s>]#';
+		$global_styles_placeholder_regexp = '#<style id="wp-global-styles-placeholder-inline-css">#';
 		$block_library_placeholder_regexp = '#/\*wp_block_styles_on_demand_placeholder:[a-f0-9]+\*/#';
 		if ( has_action( 'wp_template_enhancement_output_buffer_started', 'wp_hoist_late_printed_styles' ) ) {
 			if ( wp_style_is( 'global-styles', 'enqueued' ) ) {

From bfdccf978174a1068f17209baa2921b1413f3b08 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Mon, 12 Oct 2026 10:58:19 -0700
Subject: [PATCH 51/68] Trim all CSS whitespace from inline style tag data

Trim the complete set of whitespace characters defined by CSS (space,
tab, form feed, carriage return and line feed) from the start and end of
the CSS passed to wp_get_inline_style_tag(), rather than an arbitrary
subset. This is the same set, in the same order, that the HTML API uses.

Co-Authored-By: Jon Surrell <jonsurrell@git.wordpress.org>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index cfad689a740e6..90068ae691e2c 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3677,7 +3677,7 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
  * @phpstan-return non-falsy-string
  */
 function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
-	$data = "\n" . trim( (string) $data, "\n\r " ) . "\n";
+	$data = "\n" . trim( (string) $data, " \t\f\r\n" ) . "\n";
 
 	/**
 	 * Filters attributes to be added to an inline style tag.

From af978bdf6631dad7e8f0bb9d58bf892bf14ee417 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Mon, 12 Oct 2026 10:58:53 -0700
Subject: [PATCH 52/68] Test whitespace normalization of inline style tag data

Add a test that leading and trailing CSS whitespace always becomes a
single newline wrapping the contents of the STYLE element, with the
handling of null data from a misbehaving filter folded into it.

Remove the test that a closing STYLE tag in the CSS is escaped, since
that is the HTML API's responsibility and is already covered by the
tests for WP_HTML_Tag_Processor::set_modifiable_text().

Co-Authored-By: Jon Surrell <jonsurrell@git.wordpress.org>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../tests/dependencies/wpInlineStyleTag.php   | 40 +++++++++++--------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index f3a9890bf4c27..75c081b175cce 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -147,30 +147,38 @@ public function test_inline_style_tag_repeat_attributes() {
 	}
 
 	/**
-	 * Tests that a non-string value, such as from a misbehaving filter, does not cause a fatal error.
+	 * Data provider for test_inline_style_tag_normalizes_whitespace().
 	 *
-	 * @ticket 51325
+	 * @return array<non-falsy-string, array{ 0: string|null, 1: string }>
 	 */
-	public function test_inline_style_tag_with_null_data() {
-		$this->assertEqualHTML(
-			"<style>\n\n</style>\n",
-			wp_get_inline_style_tag( null ) // @phpstan-ignore argument.type
+	public function data_inline_style_tag_whitespace(): array {
+		return array(
+			'no whitespace'            => array( 'a{}', "\na{}\n" ),
+			'newlines'                 => array( "\n\na{}\n\n", "\na{}\n" ),
+			'all CSS whitespace'       => array( " \t\f\r\na{}\n\r\f\t ", "\na{}\n" ),
+			'inner whitespace kept'    => array( "\ta{}\n\n\tb{}\t", "\na{}\n\n\tb{}\n" ),
+			'only whitespace'          => array( " \t\f\r\n", "\n\n" ),
+			'empty string'             => array( '', "\n\n" ),
+			'null from a filter'       => array( null, "\n\n" ),
+			'non-whitespace preserved' => array( "\u{00A0}a{}\u{00A0}", "\n\u{00A0}a{}\u{00A0}\n" ),
 		);
 	}
 
 	/**
+	 * Tests that leading and trailing CSS whitespace is replaced by a single newline.
+	 *
 	 * @ticket 51325
+	 *
+	 * @dataProvider data_inline_style_tag_whitespace
+	 *
+	 * @param string|null $data     CSS passed to the function.
+	 * @param string      $expected Expected contents of the STYLE element.
 	 */
-	public function test_inline_style_tag_escapes_closing_style_tag() {
-		$css       = 'body::after { content: "</style>"; } body::before { content: "<script>"; }';
-		$processor = new WP_HTML_Tag_Processor( wp_get_inline_style_tag( $css ) );
-
-		$this->assertTrue( $processor->next_tag(), 'Expected a STYLE tag.' );
-		$this->assertSame( 'STYLE', $processor->get_tag() );
-		$text = $processor->get_modifiable_text();
-		$this->assertStringNotContainsStringIgnoringCase( '</style', $text, 'Expected the closing STYLE tag to be escaped.' );
-		$this->assertStringContainsString( 'body::before { content: "<script>"; }', $text, 'Expected the rest of the CSS to be preserved.' );
-		$this->assertFalse( $processor->next_tag(), 'Expected the CSS to not break out of the STYLE element.' );
+	public function test_inline_style_tag_normalizes_whitespace( ?string $data, string $expected ): void {
+		$processor = new WP_HTML_Tag_Processor( wp_get_inline_style_tag( $data ) ); // @phpstan-ignore argument.type
+
+		$this->assertTrue( $processor->next_tag( 'STYLE' ), 'Expected a STYLE tag.' );
+		$this->assertSame( $expected, $processor->get_modifiable_text() );
 	}
 
 	/**

From 1aa54cc28f703164b1709024aa69eaf0ba3edfca Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Mon, 12 Oct 2026 10:59:17 -0700
Subject: [PATCH 53/68] Remove redundant test for filtered inline style
 attributes

The test for calling WP_Styles::print_inline_style() directly exercised
the same path as the test for normal style output, since that is how
inline styles are printed when concatenation is off.

Co-Authored-By: Jon Surrell <jonsurrell@git.wordpress.org>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/phpunit/tests/dependencies/styles.php | 31 ---------------------
 1 file changed, 31 deletions(-)

diff --git a/tests/phpunit/tests/dependencies/styles.php b/tests/phpunit/tests/dependencies/styles.php
index 3786da4e2070c..51baacd05c627 100644
--- a/tests/phpunit/tests/dependencies/styles.php
+++ b/tests/phpunit/tests/dependencies/styles.php
@@ -259,37 +259,6 @@ static function ( array $attributes ) {
 		$this->assertSame( array( 'id' => 'handle-inline-css' ), $mock_action->get_args()[0][0] );
 	}
 
-	/**
-	 * Tests that inline style attributes are filtered when print_inline_style() is called directly.
-	 *
-	 * @ticket 51325
-	 */
-	public function test_inline_style_attributes_filter_with_direct_call() {
-		add_filter(
-			'wp_inline_style_attributes',
-			static function ( array $attributes ) {
-				$attributes['nonce'] = 'test-nonce';
-				return $attributes;
-			}
-		);
-
-		wp_register_style( 'handle', 'http://example.com' );
-		wp_add_inline_style( 'handle', 'body { color: #123456; }' );
-
-		$expected = <<<'HTML'
-			<style id="handle-inline-css" nonce="test-nonce">
-			body { color: #123456; }
-			/*# sourceURL=handle-inline-css */
-			</style>
-
-			HTML;
-
-		$this->assertEqualHTML(
-			$expected,
-			get_echo( array( wp_styles(), 'print_inline_style' ), array( 'handle' ) )
-		);
-	}
-
 	/**
 	 * Tests that inline style attributes are filtered for a concatenated non-core stylesheet.
 	 *

From 9fb547f861791b960c94d73db18407ffd36c771b Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Mon, 12 Oct 2026 11:01:13 -0700
Subject: [PATCH 54/68] Narrow types

---
 tests/phpunit/tests/dependencies/wpInlineStyleTag.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 75c081b175cce..074112729b515 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -147,9 +147,9 @@ public function test_inline_style_tag_repeat_attributes() {
 	}
 
 	/**
-	 * Data provider for test_inline_style_tag_normalizes_whitespace().
+	 * Data provider for {@see self::test_inline_style_tag_normalizes_whitespace()}.
 	 *
-	 * @return array<non-falsy-string, array{ 0: string|null, 1: string }>
+	 * @return array<non-falsy-string, array{ 0: string|null, 1: non-empty-string }>
 	 */
 	public function data_inline_style_tag_whitespace(): array {
 		return array(
@@ -171,8 +171,8 @@ public function data_inline_style_tag_whitespace(): array {
 	 *
 	 * @dataProvider data_inline_style_tag_whitespace
 	 *
-	 * @param string|null $data     CSS passed to the function.
-	 * @param string      $expected Expected contents of the STYLE element.
+	 * @param string|null      $data     CSS passed to the function.
+	 * @param non-empty-string $expected Expected contents of the STYLE element.
 	 */
 	public function test_inline_style_tag_normalizes_whitespace( ?string $data, string $expected ): void {
 		$processor = new WP_HTML_Tag_Processor( wp_get_inline_style_tag( $data ) ); // @phpstan-ignore argument.type

From 770dc4eb715ca0362b136f9ae48fc2b3ae55e915 Mon Sep 17 00:00:00 2001
From: Sukhendu Sekhar Guria <sukhenduguria2017@gmail.com>
Date: Thu, 15 Oct 2026 12:57:18 +0530
Subject: [PATCH 55/68] Pass escaped CSS to the inline style attributes filter

---
 src/wp-includes/script-loader.php             | 20 ++++++++------
 .../tests/dependencies/wpInlineStyleTag.php   | 27 +++++++++++++++++++
 2 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 90068ae691e2c..4d1c60085aae4 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3671,14 +3671,22 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
  *
  * @param string                     $data       CSS for the style tag.
  * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
- * @return string HTML style tag containing the provided CSS.
+ * @return string HTML style tag containing the provided CSS or the empty string `""` if the CSS cannot be safely embedded in a style tag.
  *
  * @phpstan-param array<non-falsy-string, string|bool> $attributes
- * @phpstan-return non-falsy-string
+ * @phpstan-return non-falsy-string|''
  */
 function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	$data = "\n" . trim( (string) $data, " \t\f\r\n" ) . "\n";
 
+	$processor = new WP_HTML_Tag_Processor( '<style></style>' );
+	$processor->next_tag();
+
+	// Set the text first so the filter receives the CSS as it will be printed, which may differ from $data after escaping.
+	if ( ! $processor->set_modifiable_text( $data ) ) {
+		return '';
+	}
+
 	/**
 	 * Filters attributes to be added to an inline style tag.
 	 *
@@ -3687,12 +3695,10 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	 * @param array<string, string|bool> $attributes Key-value pairs representing `<style>` tag attributes.
 	 *                                               Only the attribute name is added to the `<style>` tag for
 	 *                                               entries with a boolean value, and that are true.
-	 * @param string                     $data       Inline CSS.
+	 * @param string                     $data       Inline CSS, as it will be printed in the `<style>` tag.
 	 */
-	$attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $data );
+	$attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $processor->get_modifiable_text() );
 
-	$processor = new WP_HTML_Tag_Processor( '<style></style>' );
-	$processor->next_tag();
 	foreach ( $attributes as $name => $value ) {
 		/*
 		 * Lexical variations of an attribute name may represent the
@@ -3716,8 +3722,6 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 		$processor->set_attribute( $name, $value ?? true );
 	}
 
-	$processor->set_modifiable_text( $data );
-
 	return "{$processor->get_updated_html()}\n";
 }
 
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 074112729b515..d11fe764ac50c 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -76,6 +76,33 @@ static function ( array $attributes, string $data ) use ( &$filtered_data ) {
 		$this->assertSame( "\n{$this->get_test_css()}\n", $filtered_data );
 	}
 
+	/**
+	 * Tests that the attributes filter receives the CSS as printed, after any escaping.
+	 *
+	 * This allows a filter to compute a CSP hash which matches the printed STYLE contents.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter_receives_escaped_data() {
+		$filtered_data = null;
+
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( array $attributes, string $data ) use ( &$filtered_data ) {
+				$filtered_data = $data;
+				return $attributes;
+			},
+			10,
+			2
+		);
+
+		$processor = new WP_HTML_Tag_Processor( wp_get_inline_style_tag( 'a::after { content: "</style>"; }' ) );
+
+		$this->assertTrue( $processor->next_tag( 'STYLE' ), 'Expected a STYLE tag.' );
+		$this->assertStringNotContainsString( '</style>', $filtered_data, 'Expected the filtered data to be escaped.' );
+		$this->assertSame( $processor->get_modifiable_text(), $filtered_data );
+	}
+
 	/**
 	 * Test the behavior of generated style tag attributes passed different values and types of values.
 	 *

From 6655639feca6dbe649962647a987b2fb4034aa94 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 22:56:47 -0700
Subject: [PATCH 56/68] Tests: Use MockAction to capture inline style
 attributes filter args.

Replace the closures that wrote the filter arguments to a by-reference variable with a `MockAction`, which records the arguments and call count. Where a closure is still needed to add the `nonce` attribute, a separate `MockAction` at a later priority captures what the filter is passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../tests/dependencies/wpInlineStyleTag.php   | 38 +++++++++----------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index d11fe764ac50c..2d9b22dfb2fef 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -52,19 +52,17 @@ public function test_print_inline_style_tag_prints_get_inline_style_tag() {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_attributes_filter() {
-		$filtered_data = null;
-
 		add_filter(
 			'wp_inline_style_attributes',
-			static function ( array $attributes, string $data ) use ( &$filtered_data ) {
+			static function ( array $attributes ) {
 				$attributes['nonce'] = 'test-nonce';
-				$filtered_data       = $data;
 				return $attributes;
-			},
-			10,
-			2
+			}
 		);
 
+		$filter = new MockAction();
+		add_filter( 'wp_inline_style_attributes', array( $filter, 'filter' ), 20, 2 );
+
 		$expected = <<<'HTML'
 			<style nonce="test-nonce">
 			body { color: #123456; }
@@ -73,7 +71,15 @@ static function ( array $attributes, string $data ) use ( &$filtered_data ) {
 			HTML;
 
 		$this->assertEqualHTML( $expected, wp_get_inline_style_tag( $this->get_test_css() ) );
-		$this->assertSame( "\n{$this->get_test_css()}\n", $filtered_data );
+		$this->assertSame(
+			array(
+				array(
+					array( 'nonce' => 'test-nonce' ),
+					"\n{$this->get_test_css()}\n",
+				),
+			),
+			$filter->get_args()
+		);
 	}
 
 	/**
@@ -84,20 +90,14 @@ static function ( array $attributes, string $data ) use ( &$filtered_data ) {
 	 * @ticket 51325
 	 */
 	public function test_inline_style_attributes_filter_receives_escaped_data() {
-		$filtered_data = null;
-
-		add_filter(
-			'wp_inline_style_attributes',
-			static function ( array $attributes, string $data ) use ( &$filtered_data ) {
-				$filtered_data = $data;
-				return $attributes;
-			},
-			10,
-			2
-		);
+		$filter = new MockAction();
+		add_filter( 'wp_inline_style_attributes', array( $filter, 'filter' ), 10, 2 );
 
 		$processor = new WP_HTML_Tag_Processor( wp_get_inline_style_tag( 'a::after { content: "</style>"; }' ) );
 
+		$this->assertSame( 1, $filter->get_call_count(), 'Expected the filter to be called once.' );
+		$filtered_data = $filter->get_args()[0][1];
+		$this->assertIsString( $filtered_data, 'Expected the filtered data to be a string.' );
 		$this->assertTrue( $processor->next_tag( 'STYLE' ), 'Expected a STYLE tag.' );
 		$this->assertStringNotContainsString( '</style>', $filtered_data, 'Expected the filtered data to be escaped.' );
 		$this->assertSame( $processor->get_modifiable_text(), $filtered_data );

From d028d71ebf45d12b016c038f76f447713347bd96 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:09:57 -0700
Subject: [PATCH 57/68] Script Loader: Remove unreachable failure branch from
 `wp_get_inline_style_tag()`.

For a STYLE tag, `WP_HTML_Tag_Processor::set_modifiable_text()` escapes any `</style` in the text rather than rejecting it, so it always returns true. The branch returning an empty string could never run, so remove it and document the escaping instead of a failure case that does not happen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index fdc05d3f65cbd..139989f2eb35d 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3678,10 +3678,10 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
  *
  * @param string                     $data       CSS for the style tag.
  * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
- * @return string HTML style tag containing the provided CSS or the empty string `""` if the CSS cannot be safely embedded in a style tag.
+ * @return string HTML style tag containing the provided CSS. Any `</style` in the CSS is escaped as `\3c\2fstyle`.
  *
  * @phpstan-param array<non-falsy-string, string|bool> $attributes
- * @phpstan-return non-falsy-string|''
+ * @phpstan-return non-falsy-string
  */
 function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	$data = "\n" . trim( (string) $data, " \t\f\r\n" ) . "\n";
@@ -3689,10 +3689,11 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	$processor = new WP_HTML_Tag_Processor( '<style></style>' );
 	$processor->next_tag();
 
-	// Set the text first so the filter receives the CSS as it will be printed, which may differ from $data after escaping.
-	if ( ! $processor->set_modifiable_text( $data ) ) {
-		return '';
-	}
+	/*
+	 * Set the text first so the filter receives the CSS as it will be printed, which may differ from $data after escaping.
+	 * This cannot fail for a STYLE tag, since any closing tag in the CSS is escaped rather than rejected.
+	 */
+	$processor->set_modifiable_text( $data );
 
 	/**
 	 * Filters attributes to be added to an inline style tag.

From 8841042ea13fb6967308e10dbb3a573dbd755be7 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:10:10 -0700
Subject: [PATCH 58/68] Script Loader: Ignore a non-array return from the
 `wp_inline_style_attributes` filter.

A filter callback that forgets to return its value makes `$attributes` null, which caused a warning when iterating it and dropped every attribute, including the `id`. Fall back to the unfiltered attributes in that case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php             |  7 ++++++-
 .../tests/dependencies/wpInlineStyleTag.php   | 21 +++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 139989f2eb35d..3052cd41da57e 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3705,7 +3705,12 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	 *                                               entries with a boolean value, and that are true.
 	 * @param string                     $data       Inline CSS, as it will be printed in the `<style>` tag.
 	 */
-	$attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $processor->get_modifiable_text() );
+	$filtered_attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $processor->get_modifiable_text() );
+
+	// Fall back to the unfiltered attributes if a filter callback failed to return an array, such as by omitting a return statement.
+	if ( is_array( $filtered_attributes ) ) {
+		$attributes = $filtered_attributes;
+	}
 
 	foreach ( $attributes as $name => $value ) {
 		/*
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 2d9b22dfb2fef..e74a65be01317 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -82,6 +82,27 @@ static function ( array $attributes ) {
 		);
 	}
 
+	/**
+	 * Tests that the unfiltered attributes are used when a filter callback fails to return an array.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter_returning_non_array() {
+		add_filter( 'wp_inline_style_attributes', '__return_null' );
+
+		$expected = <<<'HTML'
+			<style id="test-inline-css">
+			body { color: #123456; }
+			</style>
+
+			HTML;
+
+		$this->assertEqualHTML(
+			$expected,
+			wp_get_inline_style_tag( $this->get_test_css(), array( 'id' => 'test-inline-css' ) )
+		);
+	}
+
 	/**
 	 * Tests that the attributes filter receives the CSS as printed, after any escaping.
 	 *

From 8db7a9c208b80bd58eba6048fcdd449eee617568 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:10:17 -0700
Subject: [PATCH 59/68] Script Loader: Keep hoisted block library inline style
 consistent with `wp_inline_style_attributes`.

When `wp_hoist_late_printed_styles()` removed the placeholder from the `wp-block-library` inline style, it replaced only the text of the STYLE tag. The `wp_inline_style_attributes` filter had already run on the original text, so any attribute derived from the CSS, such as a hash for a Content Security Policy, no longer matched what was printed. Rebuild the tag with `wp_get_inline_style_tag()` so that the filter runs again on the new CSS.

The STYLE tag was also located by its `id`, which the filter can change or remove. In that case the placeholder was left in the page and the block styles were not inserted after the block library styles. Locate the tag by the placeholder in its text instead.

Tests are added for both cases. The regular expression the test uses to find the global styles placeholder no longer assumes `id` is the first attribute.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 20 ++++++--
 tests/phpunit/tests/template.php  | 84 ++++++++++++++++++++++++++++++-
 2 files changed, 100 insertions(+), 4 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 3052cd41da57e..0a7ae6eb04856 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -4599,9 +4599,12 @@ public function replace( string $text ): void {
 					$processor->set_bookmark( 'wp_block_styles_placeholder' );
 				} elseif (
 					'STYLE' === $processor->get_tag() &&
-					'wp-block-library-inline-css' === $processor->get_attribute( 'id' )
+					str_contains( $processor->get_modifiable_text(), $placeholder )
 				) {
-					/** This is added here in {@see wp_hoist_late_printed_styles()} */
+					/*
+					 * The placeholder is added to the wp-block-library inline style above. It is located by the placeholder
+					 * rather than by the ID, since the ID may have been changed by the 'wp_inline_style_attributes' filter.
+					 */
 					$processor->set_bookmark( 'wp_block_library' );
 				} elseif ( 'HEAD' === $processor->get_tag() && $processor->is_tag_closer() ) {
 					$processor->set_bookmark( 'head_end' );
@@ -4663,7 +4666,18 @@ public function replace( string $text ): void {
 				if ( '' === trim( $css_text ) ) {
 					$processor->remove();
 				} else {
-					$processor->set_modifiable_text( $css_text );
+					/*
+					 * Rebuild the STYLE tag rather than only replacing its text, so that the 'wp_inline_style_attributes'
+					 * filter runs again with the CSS as it is now printed. Otherwise, any attribute derived from the CSS,
+					 * such as a hash for a Content Security Policy, would no longer match it. The trailing newline is
+					 * removed since the newline which followed the original tag remains in the buffer.
+					 */
+					$processor->replace(
+						rtrim(
+							wp_get_inline_style_tag( $css_text, array( 'id' => 'wp-block-library-inline-css' ) ),
+							"\n"
+						)
+					);
 				}
 
 				$inserted_after            = $printed_core_block_styles;
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index 767d84e7a52a4..57c2c2def3da1 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1599,6 +1599,88 @@ public function data_wp_hoist_late_printed_styles(): array {
 				),
 			),
 
+			'inline_style_attributes_filter_adds_hash'    => array(
+				'set_up'            => static function () {
+					add_filter(
+						'wp_inline_style_attributes',
+						static function ( array $attributes, string $data ): array {
+							$attributes['data-hash'] = hash( 'sha256', $data );
+							return $attributes;
+						},
+						10,
+						2
+					);
+				},
+				'content'           => $blocks_content,
+				'inline_size_limit' => PHP_INT_MAX,
+				'expected_styles'   => array(
+					'HEAD' => array_merge(
+						$early_common_styles,
+						array(
+							'wp-block-library-inline-css',
+							'wp-block-separator-inline-css',
+							'classic-theme-styles-inline-css',
+							'third-party-test-block-css',
+							'custom-block-styles-css',
+							'global-styles-inline-css',
+						),
+						$common_at_wp_enqueue_scripts,
+						$common_late_in_head,
+						$common_late_in_body
+					),
+					'BODY' => array(),
+				),
+				'assert'            => function ( string $buffer, string $filtered_buffer ) {
+					$processor = new WP_HTML_Tag_Processor( $filtered_buffer );
+					$found     = false;
+					while ( $processor->next_tag( 'STYLE' ) ) {
+						$hash = $processor->get_attribute( 'data-hash' );
+						if ( null === $hash ) {
+							continue;
+						}
+						$id = $processor->get_attribute( 'id' );
+						$this->assertSame( hash( 'sha256', $processor->get_modifiable_text() ), $hash, "Expected the hash to match the printed CSS for the STYLE with ID: $id" );
+						if ( 'wp-block-library-inline-css' === $id ) {
+							$found = true;
+						}
+					}
+					$this->assertTrue( $found, 'Expected the hoisted wp-block-library inline style to have a hash.' );
+				},
+			),
+
+			'inline_style_attributes_filter_changes_block_library_id' => array(
+				'set_up'            => static function () {
+					add_filter(
+						'wp_inline_style_attributes',
+						static function ( array $attributes ): array {
+							if ( isset( $attributes['id'] ) && 'wp-block-library-inline-css' === $attributes['id'] ) {
+								$attributes['id'] = 'renamed-block-library-inline-css';
+							}
+							return $attributes;
+						}
+					);
+				},
+				'content'           => $blocks_content,
+				'inline_size_limit' => PHP_INT_MAX,
+				'expected_styles'   => array(
+					'HEAD' => array_merge(
+						$early_common_styles,
+						array(
+							'renamed-block-library-inline-css',
+							'wp-block-separator-inline-css',
+							'classic-theme-styles-inline-css',
+							'third-party-test-block-css',
+							'custom-block-styles-css',
+							'global-styles-inline-css',
+						),
+						$common_at_wp_enqueue_scripts,
+						$common_late_in_head,
+						$common_late_in_body
+					),
+					'BODY' => array(),
+				),
+			),
+
 			'classic_theme_styles_omitted'                => array(
 				'set_up'            => static function () {
 					// Note that wp_enqueue_scripts is used instead of enqueue_block_assets because it runs again at the former action.
@@ -2089,7 +2171,7 @@ static function () {
 		// Create a simulated output buffer.
 		$buffer = '<html lang="en"><head><meta charset="utf-8">' . $head_output . '</head><body><main>' . $content . '</main>' . $footer_output . '</body></html>';
 
-		$global_styles_placeholder_regexp = '#<style id="wp-global-styles-placeholder-inline-css">#';
+		$global_styles_placeholder_regexp = '#<style\s[^>]*\bid="wp-global-styles-placeholder-inline-css"#';
 		$block_library_placeholder_regexp = '#/\*wp_block_styles_on_demand_placeholder:[a-f0-9]+\*/#';
 		if ( has_action( 'wp_template_enhancement_output_buffer_started', 'wp_hoist_late_printed_styles' ) ) {
 			if ( wp_style_is( 'global-styles', 'enqueued' ) ) {

From 243adb5e6377b07d93154c614331e6e95c69cb9a Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:22:54 -0700
Subject: [PATCH 60/68] Revert "Script Loader: Ignore a non-array return from
 the `wp_inline_style_attributes` filter."

This reverts commit 8841042ea1. Guarding against a non-array return is only a partial validation of the filtered value, which would also need its keys and values checked to satisfy `WP_HTML_Tag_Processor::set_attribute()`. The equivalent `wp_inline_script_attributes` filter has no such guard and no errors have been reported from it, so the guard is unnecessary here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php             |  7 +------
 .../tests/dependencies/wpInlineStyleTag.php   | 21 -------------------
 2 files changed, 1 insertion(+), 27 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 0a7ae6eb04856..49fc602c007a0 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3705,12 +3705,7 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	 *                                               entries with a boolean value, and that are true.
 	 * @param string                     $data       Inline CSS, as it will be printed in the `<style>` tag.
 	 */
-	$filtered_attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $processor->get_modifiable_text() );
-
-	// Fall back to the unfiltered attributes if a filter callback failed to return an array, such as by omitting a return statement.
-	if ( is_array( $filtered_attributes ) ) {
-		$attributes = $filtered_attributes;
-	}
+	$attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $processor->get_modifiable_text() );
 
 	foreach ( $attributes as $name => $value ) {
 		/*
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index e74a65be01317..2d9b22dfb2fef 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -82,27 +82,6 @@ static function ( array $attributes ) {
 		);
 	}
 
-	/**
-	 * Tests that the unfiltered attributes are used when a filter callback fails to return an array.
-	 *
-	 * @ticket 51325
-	 */
-	public function test_inline_style_attributes_filter_returning_non_array() {
-		add_filter( 'wp_inline_style_attributes', '__return_null' );
-
-		$expected = <<<'HTML'
-			<style id="test-inline-css">
-			body { color: #123456; }
-			</style>
-
-			HTML;
-
-		$this->assertEqualHTML(
-			$expected,
-			wp_get_inline_style_tag( $this->get_test_css(), array( 'id' => 'test-inline-css' ) )
-		);
-	}
-
 	/**
 	 * Tests that the attributes filter receives the CSS as printed, after any escaping.
 	 *

From ea09b6e9de348aada19d7034db65f4fb1d7c5314 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:36:31 -0700
Subject: [PATCH 61/68] Script Loader: Locate the hoisting placeholder STYLE
 tags by their CSS rather than their IDs.

The global styles and block styles placeholder STYLE tags were located by their `id` attributes, which the `wp_inline_style_attributes` filter can change. If it did, the placeholder CSS was left in the page, and the global styles and block styles were printed at the end of HEAD instead of at their normal positions. Locate them by their placeholder CSS instead, as is now done for the block library inline style.

The test now renames all three IDs, and it checks for the placeholders by their CSS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 40 +++++++++++++++----------------
 tests/phpunit/tests/template.php  | 16 +++++++++----
 2 files changed, 31 insertions(+), 25 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 49fc602c007a0..6c918636b6dc8 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -4578,29 +4578,27 @@ public function replace( string $text ): void {
 				}
 			};
 
+			/*
+			 * The CSS of the placeholder STYLE tags, by which they are located below. They are not located by their IDs,
+			 * since the IDs may have been changed by the 'wp_inline_style_attributes' filter.
+			 */
+			$global_styles_placeholder = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the global-styles printed at wp_footer." }';
+			$block_styles_placeholder  = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the block styles printed at wp_footer." }';
+
 			// Locate the insertion points in the HEAD.
 			while ( $processor->next_tag( array( 'tag_closers' => 'visit' ) ) ) {
-				if (
-					'STYLE' === $processor->get_tag() &&
-					'wp-global-styles-placeholder-inline-css' === $processor->get_attribute( 'id' )
-				) {
-					/** This is added in {@see wp_enqueue_global_styles()} */
-					$processor->set_bookmark( 'wp_global_styles_placeholder' );
-				} elseif (
-					'STYLE' === $processor->get_tag() &&
-					'wp-block-styles-placeholder-inline-css' === $processor->get_attribute( 'id' )
-				) {
-					/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
-					$processor->set_bookmark( 'wp_block_styles_placeholder' );
-				} elseif (
-					'STYLE' === $processor->get_tag() &&
-					str_contains( $processor->get_modifiable_text(), $placeholder )
-				) {
-					/*
-					 * The placeholder is added to the wp-block-library inline style above. It is located by the placeholder
-					 * rather than by the ID, since the ID may have been changed by the 'wp_inline_style_attributes' filter.
-					 */
-					$processor->set_bookmark( 'wp_block_library' );
+				if ( 'STYLE' === $processor->get_tag() ) {
+					$style_text = $processor->get_modifiable_text();
+					if ( str_contains( $style_text, $global_styles_placeholder ) ) {
+						/** This is added in {@see wp_enqueue_global_styles()} */
+						$processor->set_bookmark( 'wp_global_styles_placeholder' );
+					} elseif ( str_contains( $style_text, $block_styles_placeholder ) ) {
+						/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
+						$processor->set_bookmark( 'wp_block_styles_placeholder' );
+					} elseif ( str_contains( $style_text, $placeholder ) ) {
+						// This is added to the wp-block-library inline style above.
+						$processor->set_bookmark( 'wp_block_library' );
+					}
 				} elseif ( 'HEAD' === $processor->get_tag() && $processor->is_tag_closer() ) {
 					$processor->set_bookmark( 'head_end' );
 					break;
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index 57c2c2def3da1..faa7283528e8d 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1648,13 +1648,18 @@ static function ( array $attributes, string $data ): array {
 				},
 			),
 
-			'inline_style_attributes_filter_changes_block_library_id' => array(
+			'inline_style_attributes_filter_changes_placeholder_ids' => array(
 				'set_up'            => static function () {
 					add_filter(
 						'wp_inline_style_attributes',
 						static function ( array $attributes ): array {
-							if ( isset( $attributes['id'] ) && 'wp-block-library-inline-css' === $attributes['id'] ) {
-								$attributes['id'] = 'renamed-block-library-inline-css';
+							$ids = array(
+								'wp-block-library-inline-css'             => 'renamed-block-library-inline-css',
+								'wp-block-styles-placeholder-inline-css'  => 'renamed-block-styles-placeholder-inline-css',
+								'wp-global-styles-placeholder-inline-css' => 'renamed-global-styles-placeholder-inline-css',
+							);
+							if ( isset( $attributes['id'] ) && is_string( $attributes['id'] ) && isset( $ids[ $attributes['id'] ] ) ) {
+								$attributes['id'] = $ids[ $attributes['id'] ];
 							}
 							return $attributes;
 						}
@@ -2171,7 +2176,8 @@ static function () {
 		// Create a simulated output buffer.
 		$buffer = '<html lang="en"><head><meta charset="utf-8">' . $head_output . '</head><body><main>' . $content . '</main>' . $footer_output . '</body></html>';
 
-		$global_styles_placeholder_regexp = '#<style\s[^>]*\bid="wp-global-styles-placeholder-inline-css"#';
+		$global_styles_placeholder_regexp = '#Placeholder for wp_hoist_late_printed_styles\(\) to replace with the global-styles#';
+		$block_styles_placeholder_regexp  = '#Placeholder for wp_hoist_late_printed_styles\(\) to replace with the block styles#';
 		$block_library_placeholder_regexp = '#/\*wp_block_styles_on_demand_placeholder:[a-f0-9]+\*/#';
 		if ( has_action( 'wp_template_enhancement_output_buffer_started', 'wp_hoist_late_printed_styles' ) ) {
 			if ( wp_style_is( 'global-styles', 'enqueued' ) ) {
@@ -2184,11 +2190,13 @@ static function () {
 
 		// Apply the output buffer filter.
 		$filtered_buffer = apply_filters( 'wp_template_enhancement_output_buffer', $buffer );
+		$this->assertIsString( $filtered_buffer, 'Expected the filtered buffer to be a string.' );
 
 		$this->assertStringContainsString( '</head>', $filtered_buffer, 'Expected the closing HEAD tag to be in the response.' );
 
 		$this->assertDoesNotMatchRegularExpression( $global_styles_placeholder_regexp, $filtered_buffer, 'Expected the global-styles placeholder to be removed.' );
 		$this->assertDoesNotMatchRegularExpression( $block_library_placeholder_regexp, $filtered_buffer, 'Expected the wp-block-library placeholder to be removed.' );
+		$this->assertDoesNotMatchRegularExpression( $block_styles_placeholder_regexp, $filtered_buffer, 'Expected the block styles placeholder to be removed.' );
 		$found_styles = array(
 			'HEAD' => array(),
 			'BODY' => array(),

From aa46626c9a36d9392e777e2879952e75fec76ecf Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:37:57 -0700
Subject: [PATCH 62/68] Script Loader: Preserve existing attributes when
 rebuilding the hoisted block library inline style.

The block library inline style was rebuilt with only its `id`, so any other attributes already on the tag in the output buffer were lost unless the `wp_inline_style_attributes` filter happened to add them again, for example ones added by an earlier `wp_template_enhancement_output_buffer` filter. Pass the existing attributes when rebuilding the tag, so that they are kept while the filter may still override them. This also keeps an `id` that the filter had changed.

The attribute names are narrowed from `non-falsy-string` to `non-empty-string` in the PHPStan types of `wp_get_inline_style_tag()` and `wp_print_inline_style_tag()`, since `0` is a valid attribute name and the names read from the tag are typed this way.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 18 ++++++++----
 tests/phpunit/tests/template.php  | 49 +++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 5 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 6c918636b6dc8..b18777d9162b5 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3680,7 +3680,7 @@ function wp_print_inline_script_tag( $data, $attributes = array() ) {
  * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
  * @return string HTML style tag containing the provided CSS. Any `</style` in the CSS is escaped as `\3c\2fstyle`.
  *
- * @phpstan-param array<non-falsy-string, string|bool> $attributes
+ * @phpstan-param array<non-empty-string, string|bool> $attributes
  * @phpstan-return non-falsy-string
  */
 function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
@@ -3743,7 +3743,7 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
  * @param string                     $data       CSS for the style tag.
  * @param array<string, string|bool> $attributes Optional. Key-value pairs representing `<style>` tag attributes.
  *
- * @phpstan-param array<non-falsy-string, string|bool> $attributes
+ * @phpstan-param array<non-empty-string, string|bool> $attributes
  */
 function wp_print_inline_style_tag( $data, array $attributes = array() ): void {
 	echo wp_get_inline_style_tag( $data, $attributes );
@@ -4662,12 +4662,20 @@ public function replace( string $text ): void {
 					/*
 					 * Rebuild the STYLE tag rather than only replacing its text, so that the 'wp_inline_style_attributes'
 					 * filter runs again with the CSS as it is now printed. Otherwise, any attribute derived from the CSS,
-					 * such as a hash for a Content Security Policy, would no longer match it. The trailing newline is
-					 * removed since the newline which followed the original tag remains in the buffer.
+					 * such as a hash for a Content Security Policy, would no longer match it. The attributes already on
+					 * the tag are passed along so that they are preserved, while the filter may still override them. The
+					 * trailing newline is removed since the newline which followed the original tag remains in the buffer.
 					 */
+					$attributes = array();
+					foreach ( $processor->get_attribute_names_with_prefix( '' ) ?? array() as $attribute_name ) {
+						$attribute_value = $processor->get_attribute( $attribute_name );
+						if ( null !== $attribute_value ) {
+							$attributes[ $attribute_name ] = $attribute_value;
+						}
+					}
 					$processor->replace(
 						rtrim(
-							wp_get_inline_style_tag( $css_text, array( 'id' => 'wp-block-library-inline-css' ) ),
+							wp_get_inline_style_tag( $css_text, $attributes ),
 							"\n"
 						)
 					);
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index faa7283528e8d..9b5b9f20407b1 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1648,6 +1648,55 @@ static function ( array $attributes, string $data ): array {
 				},
 			),
 
+			'block_library_inline_style_attributes_preserved' => array(
+				'set_up'            => static function () {
+					// Add an attribute to the block library inline style before wp_hoist_late_printed_styles() rebuilds it.
+					add_filter(
+						'wp_template_enhancement_output_buffer',
+						static function ( string $buffer ): string {
+							$processor = new WP_HTML_Tag_Processor( $buffer );
+							while ( $processor->next_tag( 'STYLE' ) ) {
+								if ( 'wp-block-library-inline-css' === $processor->get_attribute( 'id' ) ) {
+									$processor->set_attribute( 'data-preserved', 'yes' );
+								}
+							}
+							return $processor->get_updated_html();
+						},
+						0
+					);
+				},
+				'content'           => $blocks_content,
+				'inline_size_limit' => PHP_INT_MAX,
+				'expected_styles'   => array(
+					'HEAD' => array_merge(
+						$early_common_styles,
+						array(
+							'wp-block-library-inline-css',
+							'wp-block-separator-inline-css',
+							'classic-theme-styles-inline-css',
+							'third-party-test-block-css',
+							'custom-block-styles-css',
+							'global-styles-inline-css',
+						),
+						$common_at_wp_enqueue_scripts,
+						$common_late_in_head,
+						$common_late_in_body
+					),
+					'BODY' => array(),
+				),
+				'assert'            => function ( string $buffer, string $filtered_buffer ) {
+					$processor = new WP_HTML_Tag_Processor( $filtered_buffer );
+					$found     = false;
+					while ( $processor->next_tag( 'STYLE' ) ) {
+						if ( 'wp-block-library-inline-css' === $processor->get_attribute( 'id' ) ) {
+							$found = true;
+							$this->assertSame( 'yes', $processor->get_attribute( 'data-preserved' ), 'Expected the existing attribute to be preserved.' );
+						}
+					}
+					$this->assertTrue( $found, 'Expected the wp-block-library inline style to be present.' );
+				},
+			),
+
 			'inline_style_attributes_filter_changes_placeholder_ids' => array(
 				'set_up'            => static function () {
 					add_filter(

From 14343999bdff40ed02bb206549857e315bf40995 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:38:15 -0700
Subject: [PATCH 63/68] Docs: Note that `wp_inline_style_attributes` may run
 more than once for an inline style.

Since `wp_hoist_late_printed_styles()` rebuilds the `wp-block-library` inline style after removing a placeholder from its CSS, the filter first runs on CSS that is never printed. Document this so that a filter which collects values per call, such as hashes for a Content Security Policy, can account for it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index b18777d9162b5..0cb37f15cc78d 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3698,6 +3698,10 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	/**
 	 * Filters attributes to be added to an inline style tag.
 	 *
+	 * This filter may run more than once for the same inline style, in which case only the last result is printed.
+	 * For example, the `wp-block-library` inline style is built again by {@see wp_hoist_late_printed_styles()}
+	 * after a placeholder is removed from its CSS.
+	 *
 	 * @since 7.2.0
 	 *
 	 * @param array<string, string|bool> $attributes Key-value pairs representing `<style>` tag attributes.

From 44dfa2b2584bb8941f07744e0285a5e7a487d6bc Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:38:59 -0700
Subject: [PATCH 64/68] Script Loader: Stop reading STYLE contents once all
 hoisting placeholders are located.

Locating the placeholder STYLE tags by their CSS means reading the text of each STYLE tag in HEAD, which copies it. Once all of the placeholders have been found, skip reading the text of the remaining STYLE tags, such as the Customizer's Additional CSS, while still looking for the end of HEAD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 37 ++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 0cb37f15cc78d..13868ecd0bda3 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -4583,25 +4583,36 @@ public function replace( string $text ): void {
 			};
 
 			/*
-			 * The CSS of the placeholder STYLE tags, by which they are located below. They are not located by their IDs,
-			 * since the IDs may have been changed by the 'wp_inline_style_attributes' filter.
+			 * The CSS of the placeholder STYLE tags, keyed by the name of the bookmark for each. They are located by
+			 * their CSS rather than by their IDs, since the IDs may have been changed by the 'wp_inline_style_attributes'
+			 * filter.
 			 */
-			$global_styles_placeholder = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the global-styles printed at wp_footer." }';
-			$block_styles_placeholder  = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the block styles printed at wp_footer." }';
+			$style_placeholders = array(
+				/** This is added in {@see wp_enqueue_global_styles()} */
+				'wp_global_styles_placeholder' => ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the global-styles printed at wp_footer." }',
+
+				/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
+				'wp_block_styles_placeholder'  => ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the block styles printed at wp_footer." }',
+
+				// This is added to the wp-block-library inline style above.
+				'wp_block_library'             => $placeholder,
+			);
 
 			// Locate the insertion points in the HEAD.
 			while ( $processor->next_tag( array( 'tag_closers' => 'visit' ) ) ) {
 				if ( 'STYLE' === $processor->get_tag() ) {
+					// Once all placeholders have been located, avoid needlessly reading the CSS of the remaining STYLE tags.
+					if ( count( $style_placeholders ) === 0 ) {
+						continue;
+					}
+
 					$style_text = $processor->get_modifiable_text();
-					if ( str_contains( $style_text, $global_styles_placeholder ) ) {
-						/** This is added in {@see wp_enqueue_global_styles()} */
-						$processor->set_bookmark( 'wp_global_styles_placeholder' );
-					} elseif ( str_contains( $style_text, $block_styles_placeholder ) ) {
-						/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
-						$processor->set_bookmark( 'wp_block_styles_placeholder' );
-					} elseif ( str_contains( $style_text, $placeholder ) ) {
-						// This is added to the wp-block-library inline style above.
-						$processor->set_bookmark( 'wp_block_library' );
+					foreach ( $style_placeholders as $bookmark_name => $style_placeholder ) {
+						if ( str_contains( $style_text, $style_placeholder ) ) {
+							$processor->set_bookmark( $bookmark_name );
+							unset( $style_placeholders[ $bookmark_name ] );
+							break;
+						}
 					}
 				} elseif ( 'HEAD' === $processor->get_tag() && $processor->is_tag_closer() ) {
 					$processor->set_bookmark( 'head_end' );

From 58fc9608474dc1ed96844c9a9972925e0fa9a326 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:43:47 -0700
Subject: [PATCH 65/68] Revert "Script Loader: Stop reading STYLE contents once
 all hoisting placeholders are located."

This reverts commit 44dfa2b258. The placeholder STYLE tags will again be located by their IDs, which are being made immutable in the `wp_inline_style_attributes` filter, so their CSS no longer needs to be read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 37 +++++++++++--------------------
 1 file changed, 13 insertions(+), 24 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 13868ecd0bda3..0cb37f15cc78d 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -4583,36 +4583,25 @@ public function replace( string $text ): void {
 			};
 
 			/*
-			 * The CSS of the placeholder STYLE tags, keyed by the name of the bookmark for each. They are located by
-			 * their CSS rather than by their IDs, since the IDs may have been changed by the 'wp_inline_style_attributes'
-			 * filter.
+			 * The CSS of the placeholder STYLE tags, by which they are located below. They are not located by their IDs,
+			 * since the IDs may have been changed by the 'wp_inline_style_attributes' filter.
 			 */
-			$style_placeholders = array(
-				/** This is added in {@see wp_enqueue_global_styles()} */
-				'wp_global_styles_placeholder' => ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the global-styles printed at wp_footer." }',
-
-				/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
-				'wp_block_styles_placeholder'  => ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the block styles printed at wp_footer." }',
-
-				// This is added to the wp-block-library inline style above.
-				'wp_block_library'             => $placeholder,
-			);
+			$global_styles_placeholder = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the global-styles printed at wp_footer." }';
+			$block_styles_placeholder  = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the block styles printed at wp_footer." }';
 
 			// Locate the insertion points in the HEAD.
 			while ( $processor->next_tag( array( 'tag_closers' => 'visit' ) ) ) {
 				if ( 'STYLE' === $processor->get_tag() ) {
-					// Once all placeholders have been located, avoid needlessly reading the CSS of the remaining STYLE tags.
-					if ( count( $style_placeholders ) === 0 ) {
-						continue;
-					}
-
 					$style_text = $processor->get_modifiable_text();
-					foreach ( $style_placeholders as $bookmark_name => $style_placeholder ) {
-						if ( str_contains( $style_text, $style_placeholder ) ) {
-							$processor->set_bookmark( $bookmark_name );
-							unset( $style_placeholders[ $bookmark_name ] );
-							break;
-						}
+					if ( str_contains( $style_text, $global_styles_placeholder ) ) {
+						/** This is added in {@see wp_enqueue_global_styles()} */
+						$processor->set_bookmark( 'wp_global_styles_placeholder' );
+					} elseif ( str_contains( $style_text, $block_styles_placeholder ) ) {
+						/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
+						$processor->set_bookmark( 'wp_block_styles_placeholder' );
+					} elseif ( str_contains( $style_text, $placeholder ) ) {
+						// This is added to the wp-block-library inline style above.
+						$processor->set_bookmark( 'wp_block_library' );
 					}
 				} elseif ( 'HEAD' === $processor->get_tag() && $processor->is_tag_closer() ) {
 					$processor->set_bookmark( 'head_end' );

From d1adb85db51d7b9c6a951db32cb080456db692c9 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:44:05 -0700
Subject: [PATCH 66/68] Revert "Script Loader: Locate the hoisting placeholder
 STYLE tags by their CSS rather than their IDs."

This reverts commit ea09b6e9de. The IDs of inline STYLE tags are being made immutable in the `wp_inline_style_attributes` filter, since other code locates the tags by them, such as the Customizer preview with `wp-custom-css`. So the placeholder STYLE tags can be located by their IDs again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 40 ++++++++++++++++---------------
 tests/phpunit/tests/template.php  | 16 ++++---------
 2 files changed, 25 insertions(+), 31 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 0cb37f15cc78d..a990a130a313c 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -4582,27 +4582,29 @@ public function replace( string $text ): void {
 				}
 			};
 
-			/*
-			 * The CSS of the placeholder STYLE tags, by which they are located below. They are not located by their IDs,
-			 * since the IDs may have been changed by the 'wp_inline_style_attributes' filter.
-			 */
-			$global_styles_placeholder = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the global-styles printed at wp_footer." }';
-			$block_styles_placeholder  = ':root { --wp-internal-comment: "Placeholder for wp_hoist_late_printed_styles() to replace with the block styles printed at wp_footer." }';
-
 			// Locate the insertion points in the HEAD.
 			while ( $processor->next_tag( array( 'tag_closers' => 'visit' ) ) ) {
-				if ( 'STYLE' === $processor->get_tag() ) {
-					$style_text = $processor->get_modifiable_text();
-					if ( str_contains( $style_text, $global_styles_placeholder ) ) {
-						/** This is added in {@see wp_enqueue_global_styles()} */
-						$processor->set_bookmark( 'wp_global_styles_placeholder' );
-					} elseif ( str_contains( $style_text, $block_styles_placeholder ) ) {
-						/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
-						$processor->set_bookmark( 'wp_block_styles_placeholder' );
-					} elseif ( str_contains( $style_text, $placeholder ) ) {
-						// This is added to the wp-block-library inline style above.
-						$processor->set_bookmark( 'wp_block_library' );
-					}
+				if (
+					'STYLE' === $processor->get_tag() &&
+					'wp-global-styles-placeholder-inline-css' === $processor->get_attribute( 'id' )
+				) {
+					/** This is added in {@see wp_enqueue_global_styles()} */
+					$processor->set_bookmark( 'wp_global_styles_placeholder' );
+				} elseif (
+					'STYLE' === $processor->get_tag() &&
+					'wp-block-styles-placeholder-inline-css' === $processor->get_attribute( 'id' )
+				) {
+					/** This is added in {@see wp_enqueue_registered_block_scripts_and_styles()} */
+					$processor->set_bookmark( 'wp_block_styles_placeholder' );
+				} elseif (
+					'STYLE' === $processor->get_tag() &&
+					str_contains( $processor->get_modifiable_text(), $placeholder )
+				) {
+					/*
+					 * The placeholder is added to the wp-block-library inline style above. It is located by the placeholder
+					 * rather than by the ID, since the ID may have been changed by the 'wp_inline_style_attributes' filter.
+					 */
+					$processor->set_bookmark( 'wp_block_library' );
 				} elseif ( 'HEAD' === $processor->get_tag() && $processor->is_tag_closer() ) {
 					$processor->set_bookmark( 'head_end' );
 					break;
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index 9b5b9f20407b1..c9c2a05bf1520 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1697,18 +1697,13 @@ static function ( string $buffer ): string {
 				},
 			),
 
-			'inline_style_attributes_filter_changes_placeholder_ids' => array(
+			'inline_style_attributes_filter_changes_block_library_id' => array(
 				'set_up'            => static function () {
 					add_filter(
 						'wp_inline_style_attributes',
 						static function ( array $attributes ): array {
-							$ids = array(
-								'wp-block-library-inline-css'             => 'renamed-block-library-inline-css',
-								'wp-block-styles-placeholder-inline-css'  => 'renamed-block-styles-placeholder-inline-css',
-								'wp-global-styles-placeholder-inline-css' => 'renamed-global-styles-placeholder-inline-css',
-							);
-							if ( isset( $attributes['id'] ) && is_string( $attributes['id'] ) && isset( $ids[ $attributes['id'] ] ) ) {
-								$attributes['id'] = $ids[ $attributes['id'] ];
+							if ( isset( $attributes['id'] ) && 'wp-block-library-inline-css' === $attributes['id'] ) {
+								$attributes['id'] = 'renamed-block-library-inline-css';
 							}
 							return $attributes;
 						}
@@ -2225,8 +2220,7 @@ static function () {
 		// Create a simulated output buffer.
 		$buffer = '<html lang="en"><head><meta charset="utf-8">' . $head_output . '</head><body><main>' . $content . '</main>' . $footer_output . '</body></html>';
 
-		$global_styles_placeholder_regexp = '#Placeholder for wp_hoist_late_printed_styles\(\) to replace with the global-styles#';
-		$block_styles_placeholder_regexp  = '#Placeholder for wp_hoist_late_printed_styles\(\) to replace with the block styles#';
+		$global_styles_placeholder_regexp = '#<style\s[^>]*\bid="wp-global-styles-placeholder-inline-css"#';
 		$block_library_placeholder_regexp = '#/\*wp_block_styles_on_demand_placeholder:[a-f0-9]+\*/#';
 		if ( has_action( 'wp_template_enhancement_output_buffer_started', 'wp_hoist_late_printed_styles' ) ) {
 			if ( wp_style_is( 'global-styles', 'enqueued' ) ) {
@@ -2239,13 +2233,11 @@ static function () {
 
 		// Apply the output buffer filter.
 		$filtered_buffer = apply_filters( 'wp_template_enhancement_output_buffer', $buffer );
-		$this->assertIsString( $filtered_buffer, 'Expected the filtered buffer to be a string.' );
 
 		$this->assertStringContainsString( '</head>', $filtered_buffer, 'Expected the closing HEAD tag to be in the response.' );
 
 		$this->assertDoesNotMatchRegularExpression( $global_styles_placeholder_regexp, $filtered_buffer, 'Expected the global-styles placeholder to be removed.' );
 		$this->assertDoesNotMatchRegularExpression( $block_library_placeholder_regexp, $filtered_buffer, 'Expected the wp-block-library placeholder to be removed.' );
-		$this->assertDoesNotMatchRegularExpression( $block_styles_placeholder_regexp, $filtered_buffer, 'Expected the block styles placeholder to be removed.' );
 		$found_styles = array(
 			'HEAD' => array(),
 			'BODY' => array(),

From 269304aa232bb33b28e9c7fba88da17a273d7edc Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:45:09 -0700
Subject: [PATCH 67/68] Script Loader: Prevent the `wp_inline_style_attributes`
 filter from changing a supplied ID.

Other code locates inline STYLE tags by their IDs, such as the Customizer preview with `wp-custom-css` and `wp_hoist_late_printed_styles()` with its placeholders, so changing or removing an ID with the filter breaks them. When an `id` is supplied to `wp_get_inline_style_tag()`, it is now always printed, and a `_doing_it_wrong()` is issued if the filter changed or removed it. The ID is set before the filtered attributes, so a lexical variation of the name such as `ID` cannot override it either. The filter may still add an ID when none is supplied.

The hoisting test case which renamed the block library ID is removed, since the rename is now ignored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php             | 24 +++++-
 .../tests/dependencies/wpInlineStyleTag.php   | 80 +++++++++++++++++++
 tests/phpunit/tests/template.php              | 33 --------
 3 files changed, 102 insertions(+), 35 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index a990a130a313c..9811d8b569ae5 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -3702,6 +3702,9 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	 * For example, the `wp-block-library` inline style is built again by {@see wp_hoist_late_printed_styles()}
 	 * after a placeholder is removed from its CSS.
 	 *
+	 * The `id` attribute, when supplied, cannot be changed or removed by this filter, since other code may locate the
+	 * `<style>` tag by it. For example, the Customizer preview locates the `wp-custom-css` style to update it.
+	 *
 	 * @since 7.2.0
 	 *
 	 * @param array<string, string|bool> $attributes Key-value pairs representing `<style>` tag attributes.
@@ -3709,9 +3712,26 @@ function wp_get_inline_style_tag( $data, array $attributes = array() ): string {
 	 *                                               entries with a boolean value, and that are true.
 	 * @param string                     $data       Inline CSS, as it will be printed in the `<style>` tag.
 	 */
-	$attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $processor->get_modifiable_text() );
+	$filtered_attributes = apply_filters( 'wp_inline_style_attributes', $attributes, $processor->get_modifiable_text() );
 
-	foreach ( $attributes as $name => $value ) {
+	// Ensure the supplied ID is retained. Setting it first also prevents a lexical variation of the name from overriding it.
+	if ( isset( $attributes['id'] ) ) {
+		if ( ( $filtered_attributes['id'] ?? null ) !== $attributes['id'] ) {
+			_doing_it_wrong(
+				__FUNCTION__,
+				sprintf(
+					/* translators: 1: id, 2: wp_inline_style_attributes */
+					__( 'The %1$s attribute cannot be changed by the %2$s filter.' ),
+					'<code>id</code>',
+					'<code>wp_inline_style_attributes</code>'
+				),
+				'7.2.0'
+			);
+		}
+		$processor->set_attribute( 'id', $attributes['id'] );
+	}
+
+	foreach ( $filtered_attributes as $name => $value ) {
 		/*
 		 * Lexical variations of an attribute name may represent the
 		 * same attribute in HTML, therefore it is possible that the
diff --git a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
index 2d9b22dfb2fef..a22a2463803e2 100644
--- a/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
+++ b/tests/phpunit/tests/dependencies/wpInlineStyleTag.php
@@ -82,6 +82,86 @@ static function ( array $attributes ) {
 		);
 	}
 
+	/**
+	 * Data provider.
+	 *
+	 * @return array<non-falsy-string, array{ 0: Closure( array<string, string|bool> ): array<string, string|bool> }>
+	 */
+	public function data_inline_style_attributes_filter_changing_id(): array {
+		return array(
+			'changed'           => array(
+				static function ( array $attributes ): array {
+					$attributes['id'] = 'changed-inline-css';
+					return $attributes;
+				},
+			),
+			'removed'           => array(
+				static function ( array $attributes ): array {
+					unset( $attributes['id'] );
+					return $attributes;
+				},
+			),
+			'lexical_variation' => array(
+				static function ( array $attributes ): array {
+					unset( $attributes['id'] );
+					$attributes['ID'] = 'changed-inline-css';
+					return $attributes;
+				},
+			),
+		);
+	}
+
+	/**
+	 * Tests that the attributes filter cannot change or remove the supplied ID.
+	 *
+	 * @ticket 51325
+	 *
+	 * @dataProvider data_inline_style_attributes_filter_changing_id
+	 *
+	 * @param Closure $filter Filter callback for the attributes.
+	 */
+	public function test_inline_style_attributes_filter_cannot_change_id( Closure $filter ) {
+		$this->setExpectedIncorrectUsage( 'wp_get_inline_style_tag' );
+
+		add_filter( 'wp_inline_style_attributes', $filter );
+
+		$expected = <<<'HTML'
+			<style id="test-inline-css">
+			body { color: #123456; }
+			</style>
+
+			HTML;
+
+		$this->assertEqualHTML(
+			$expected,
+			wp_get_inline_style_tag( $this->get_test_css(), array( 'id' => 'test-inline-css' ) )
+		);
+	}
+
+	/**
+	 * Tests that the attributes filter can add an ID when none is supplied.
+	 *
+	 * @ticket 51325
+	 */
+	public function test_inline_style_attributes_filter_can_add_id() {
+		add_filter(
+			'wp_inline_style_attributes',
+			static function ( array $attributes ): array {
+				$attributes['id'] = 'added-inline-css';
+				return $attributes;
+			}
+		);
+
+		$expected = <<<'HTML'
+			<style id="added-inline-css">
+			body { color: #123456; }
+			</style>
+
+			HTML;
+
+		$this->assertEqualHTML( $expected, wp_get_inline_style_tag( $this->get_test_css() ) );
+	}
+
 	/**
 	 * Tests that the attributes filter receives the CSS as printed, after any escaping.
 	 *
diff --git a/tests/phpunit/tests/template.php b/tests/phpunit/tests/template.php
index c9c2a05bf1520..f0231e2df437f 100644
--- a/tests/phpunit/tests/template.php
+++ b/tests/phpunit/tests/template.php
@@ -1697,39 +1697,6 @@ static function ( string $buffer ): string {
 				},
 			),
 
-			'inline_style_attributes_filter_changes_block_library_id' => array(
-				'set_up'            => static function () {
-					add_filter(
-						'wp_inline_style_attributes',
-						static function ( array $attributes ): array {
-							if ( isset( $attributes['id'] ) && 'wp-block-library-inline-css' === $attributes['id'] ) {
-								$attributes['id'] = 'renamed-block-library-inline-css';
-							}
-							return $attributes;
-						}
-					);
-				},
-				'content'           => $blocks_content,
-				'inline_size_limit' => PHP_INT_MAX,
-				'expected_styles'   => array(
-					'HEAD' => array_merge(
-						$early_common_styles,
-						array(
-							'renamed-block-library-inline-css',
-							'wp-block-separator-inline-css',
-							'classic-theme-styles-inline-css',
-							'third-party-test-block-css',
-							'custom-block-styles-css',
-							'global-styles-inline-css',
-						),
-						$common_at_wp_enqueue_scripts,
-						$common_late_in_head,
-						$common_late_in_body
-					),
-					'BODY' => array(),
-				),
-			),
-
 			'classic_theme_styles_omitted'                => array(
 				'set_up'            => static function () {
 					// Note that wp_enqueue_scripts is used instead of enqueue_block_assets because it runs again at the former action.

From c159a882910ba2b45693912c822605b7c080825b Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Fri, 16 Oct 2026 23:45:37 -0700
Subject: [PATCH 68/68] Script Loader: Locate the block library inline style by
 its ID again when hoisting styles.

The block library inline style was located by its placeholder CSS in 8db7a9c208 because the `wp_inline_style_attributes` filter could change its ID. Now that the filter cannot change a supplied ID, go back to locating it by ID, consistent with the other placeholder STYLE tags, and without reading the CSS of each STYLE tag in HEAD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/script-loader.php | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 9811d8b569ae5..e4b07847185e3 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -4618,12 +4618,9 @@ public function replace( string $text ): void {
 					$processor->set_bookmark( 'wp_block_styles_placeholder' );
 				} elseif (
 					'STYLE' === $processor->get_tag() &&
-					str_contains( $processor->get_modifiable_text(), $placeholder )
+					'wp-block-library-inline-css' === $processor->get_attribute( 'id' )
 				) {
-					/*
-					 * The placeholder is added to the wp-block-library inline style above. It is located by the placeholder
-					 * rather than by the ID, since the ID may have been changed by the 'wp_inline_style_attributes' filter.
-					 */
+					/** This is added here in {@see wp_hoist_late_printed_styles()} */
 					$processor->set_bookmark( 'wp_block_library' );
 				} elseif ( 'HEAD' === $processor->get_tag() && $processor->is_tag_closer() ) {
 					$processor->set_bookmark( 'head_end' );