@@ -618,13 +618,20 @@ public function add_css() {
 		 *
 		 * @since 1.0
 		 *
-		 * @param string $files CSS code (without `<style>` tag).
+		 * @param string $files CSS styles (without `<style>` tag).
 		 */
 		$css = trim( apply_filters( 'c2c_add_admin_css', $css ) );
 
-		if ( $css ) {
+		if ( $css && is_string( $css ) ) {
+			// Encode '<' to prevent tag injection.
+			$sanitized_css = str_replace( '<', '&lt;', wp_check_invalid_utf8( $css ) );
+			// Allow use of '<' in comparators.
+			$sanitized_css = str_replace( '&lt; ', '< ', $sanitized_css );
+			$sanitized_css = str_replace( '&lt;= ', '<= ', $sanitized_css );
+
 			echo "<style>\n";
-			echo str_replace( '<', '&lt;', wp_check_invalid_utf8( $css ) ) . "\n";
+			// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Sanitized above.
+			echo $sanitized_css . "\n";
 			echo "</style>\n";
 		}
 	}
 
@@ -98,6 +98,15 @@ public static function get_css_file_links2() {
 		);
 	}
 
+	public static function get_css_with_special_characters() {
+		return [
+			[ '.button { &:hover { background-color: #000; } }' ],
+			[ '@media (width < 600px) { .button { background-color: #0f0; } }' ],
+			[ '@media (width >= 600px) { .button { background-color: #f00; } }' ],
+			[ '.quote { font-family: "Comic Sans MS", cursive; }' ],
+			[ "a[target='_blank'] { color: blue; }" ],
+		];
+	}
 
 	//
 	//
@@ -452,6 +461,27 @@ public function test_add_css_to_head_with_just_css( $expected = false ) {
 		return $out;
 	}
 
+	/**
+	 * @dataProvider get_css_with_special_characters
+	 */
+	public function test_add_css_allows_valid_css_characters( $css ) {
+		$this->set_option( [ 'css' => $css, 'files' => [] ] );
+		$this->test_turn_on_admin();
+
+		$this->assertStringContainsString( $css, $this->get_action_output() );
+	}
+
+	public function test_add_css_prevents_markup_injection() {
+		$injection = '<script>alert("Hello, world!");</script>';
+		$css = $this->add_css( $injection, '' );
+
+		$this->set_option( [ 'css' => $css, 'files' => [] ] );
+		$this->test_turn_on_admin();
+
+		$this->assertStringNotContainsString( $injection, $this->get_action_output() );
+		$this->assertStringContainsString( str_replace( '<', '&lt;', $injection ), $this->get_action_output() );
+	}
+
 	public function test_add_css_to_head_with_just_files( $expected = false ) {
 		// Examples of different types of references.
 		$files = array(
Original file line number	Diff line number	Diff line change
`@@ -618,13 +618,20 @@ public function add_css() {`
`618`	`618`	`*`
`619`	`619`	`* @since 1.0`
`620`	`620`	`*`
`621`		- * @param string $files CSS code (without `<style>` tag).
	`621`	+ * @param string $files CSS styles (without `<style>` tag).
`622`	`622`	`*/`
`623`	`623`	`$css = trim( apply_filters( 'c2c_add_admin_css', $css ) );`
`624`	`624`
`625`		`- if ( $css ) {`
	`625`	`+ if ( $css && is_string( $css ) ) {`
	`626`	`+ // Encode '<' to prevent tag injection.`
	`627`	`+ $sanitized_css = str_replace( '<', '<', wp_check_invalid_utf8( $css ) );`
	`628`	`+ // Allow use of '<' in comparators.`
	`629`	`+ $sanitized_css = str_replace( '< ', '< ', $sanitized_css );`
	`630`	`+ $sanitized_css = str_replace( '<= ', '<= ', $sanitized_css );`
	`631`	`+`
`626`	`632`	`echo "<style>\n";`
`627`		`- echo str_replace( '<', '<', wp_check_invalid_utf8( $css ) ) . "\n";`
	`633`	`+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Sanitized above.`
	`634`	`+ echo $sanitized_css . "\n";`
`628`	`635`	`echo "</style>\n";`
`629`	`636`	`}`
`630`	`637`	`}`