diff --git a/inc/render/class-form-multiple-choice.php b/inc/render/class-form-multiple-choice.php
index ca3cc7cd2..8dac5affa 100644
--- a/inc/render/class-form-multiple-choice.php
+++ b/inc/render/class-form-multiple-choice.php
@@ -89,7 +89,28 @@ public function render_field( $type, $label, $value, $name, $id, $checked = fals
$output = '
';
$output .= '';
- $output .= '';
+
+ $allowed_tags = array(
+ 'a' => array(
+ 'href' => true,
+ 'target' => true,
+ ),
+ 'img' => array(
+ 'src' => true,
+ 'alt' => true,
+ 'width' => true,
+ 'height' => true,
+ ),
+ 'span' => array(),
+ 'em' => array(),
+ 'strong' => array(),
+ 'i' => array(),
+ 'b' => array(),
+ );
+
+ $label = wp_kses( $label, $allowed_tags );
+
+ $output .= '';
$output .= '
';
diff --git a/tests/test-choices-field-block.php b/tests/test-choices-field-block.php
new file mode 100644
index 000000000..aa7e50445
--- /dev/null
+++ b/tests/test-choices-field-block.php
@@ -0,0 +1,37 @@
+';
+ $expected .= '';
+ $expected .= '';
+ $expected .= '';
+
+ $output = $block_render->render_field( 'checkbox', 'Option with link', 'otter-blocks', 'otter-blocks', 'otter-blocks' );
+
+ $this->assertEquals( $expected, $output );
+
+ $malicious_label = 'Option with link';
+ $output = $block_render->render_field( 'checkbox', $malicious_label, 'otter-blocks', 'otter-blocks', 'otter-blocks' );
+
+ $this->assertEquals( $expected, $output );
+
+ $malicious_label = 'Option with link';
+ $output = $block_render->render_field( 'checkbox', $malicious_label, 'otter-blocks', 'otter-blocks', 'otter-blocks' );
+
+ $this->assertEquals( $expected, $output );
+ }
+}