diff --git a/src/Plugin/Filter/UrlReplaceFilter.php b/src/Plugin/Filter/UrlReplaceFilter.php
index f1e1b92..3905298 100644
--- a/src/Plugin/Filter/UrlReplaceFilter.php
+++ b/src/Plugin/Filter/UrlReplaceFilter.php
@@ -280,7 +280,7 @@ class UrlReplaceFilter extends FilterBase implements ContainerFactoryPluginInter
    * {@inheritdoc}
    */
   public function process($text, $langcode) {
-    $settings = unserialize($this->settings['replacements']);
+    $settings = unserialize($this->settings['replacements'], ['allowed_classes' => FALSE]);
     foreach ($settings as $setting) {
       if (!empty($setting['original'])) {
         $pattern = '!((<a\s[^>]*href)|(<img\s[^>]*src))\s*=\s*"' . preg_quote($setting['original']) . '!iU';