diff --git a/core/modules/views/src/Plugin/views/field/NumericField.php b/core/modules/views/src/Plugin/views/field/NumericField.php index 0c514da..a329c9b 100644 --- a/core/modules/views/src/Plugin/views/field/NumericField.php +++ b/core/modules/views/src/Plugin/views/field/NumericField.php @@ -177,9 +177,14 @@ public function render(ResultRow $values) { if (!empty($this->options['format_plural'])) { $value = PluralTranslatableMarkup::createFromTranslatedString($value, $this->options['format_plural_string']); } + else { + // PluralTranslatableMarkup already escapes any markup, otherwise we need + // to sanitize for ourselves. + $value = $this->sanitizeValue($value); + } return $this->sanitizeValue($this->options['prefix'], 'xss') - . $this->sanitizeValue($value) + . $value . $this->sanitizeValue($this->options['suffix'], 'xss'); }