public function render_content() { global $wp_registered_widgets; require_once ABSPATH . '/wp-admin/includes/widgets.php'; $widget = $wp_registered_widgets[$this->widget_id]; if (!isset($widget['params'][0])) { $widget['params'][0] = array(); } $args = array('widget_id' => $widget['id'], 'widget_name' => $widget['name']); $args = wp_list_widget_controls_dynamic_sidebar(array(0 => $args, 1 => $widget['params'][0])); $control = Widget_Customizer::get_widget_control($args); echo $control; // xss ok }