diff --git a/admin/admin-active-setting-page.php b/admin/admin-active-setting-page.php
index 6644fc5c..c5dddb8b 100644
--- a/admin/admin-active-setting-page.php
+++ b/admin/admin-active-setting-page.php
@@ -41,8 +41,8 @@
 ?>
 " >
 			<th scope='row' class='check-column'>
-				<label class='screen-reader-text' for='checkbox_active_<?php echo $package['name']; ?>' ><?php echo $package['title']; ?></label>
-				<input type="checkbox" name="vkExUnit_common_options[active_<?php echo $package['name']; ?>]" id="checkbox_active_<?php echo $package['name']; ?>" value="true" <?php if(!$package['hidden']){echo 'class="vew-module-checkbox"';}; ?>
+				<label class='screen-reader-text' for='checkbox_active_<?php echo esc_attr( $package['name'] ); ?>' ><?php echo esc_html( $package['title'] ); ?></label>
+				<input type="checkbox" name="vkExUnit_common_options[active_<?php echo asc_attr( $package['name'] ); ?>]" id="checkbox_active_<?php echo esc_attr( $package['name'] ); ?>" value="true" <?php if(!$package['hidden']){echo 'class="vew-module-checkbox"';}; ?>
 																						<?php
 																						if ( $active ) {
 																							echo 'checked'; }
@@ -50,7 +50,7 @@
  />
 			</th>
 			<td class='plugin-title'>
-				<label for='checkbox_active_<?php echo $package['name']; ?>'><strong><?php echo $package['title']; ?></strong></label>
+				<label for='checkbox_active_<?php echo esc_attr( $package['name'] ); ?>'><strong><?php echo esc_html( $package['title'] ); ?></strong></label>
 
 				<?php
 				$count = '';
@@ -66,8 +66,8 @@
 				?>
 				<?php echo ( $count > 1 && $i >= 1 ) ? ' | ' : ''; ?>
 				<span>
-				<a href="<?php echo ( $att['url'] ) ? $att['url'] : admin_url() . 'admin.php?page=vkExUnit_main_setting'; ?>">
-				<?php echo $att['name']; ?>
+				<a href="<?php echo ( $att['url'] ) ? esc_html( $att['url'] ) : admin_url() . 'admin.php?page=vkExUnit_main_setting'; ?>">
+				<?php echo esc_html( $att['name'] ); ?>
 				</a></span>
 
 				<?php
@@ -82,9 +82,9 @@
 					<?php
 					if ( is_array( $package['description'] ) ) :
 						foreach ( $package['description'] as $desk ) {
-							echo $desk; } else :
+							echo wp_kses_post( $desk ); } else :
 													?>
-												<p><?php echo $package['description']; ?></p>
+												<p><?php echo wp_kses_post( $package['description'] ); ?></p>
 												<?php endif; ?>
 				</div><!-- [ /.plugin-description ] -->
 			</td>
diff --git a/admin/customizer.php b/admin/customizer.php
index 4287f988..ce44e627 100644
--- a/admin/customizer.php
+++ b/admin/customizer.php
@@ -65,7 +65,7 @@ public function render_content() {
 		  <input type="text" value="<?php echo esc_attr( $this->value() ); ?>"<?php echo $style; ?> <?php $this->link(); ?> />
 			<?php echo wp_kses_post( $this->input_after ); ?>
 		  </div>
-		  <span><?php echo $this->description; ?></span>
+		  <span><?php echo wp_kses_post( $this->description ); ?></span>
 		</label>
 			<?php
 		} // public function render_content() {
diff --git a/inc/call-to-action/package/class-vk-call-to-action.php b/inc/call-to-action/package/class-vk-call-to-action.php
index cd18972b..119d1dca 100644
--- a/inc/call-to-action/package/class-vk-call-to-action.php
+++ b/inc/call-to-action/package/class-vk-call-to-action.php
@@ -166,31 +166,31 @@ public static function save_custom_field( $post_id ) {
 						'escape_type' => '',
 					),
 					'vkExUnit_cta_img'                => array(
-						'escape_type' => '',
+						'escape_type' => 'esc_url',
 					),
 					'vkExUnit_cta_img_position'       => array(
 						'escape_type' => '',
 					),
 					'vkExUnit_cta_button_text'        => array(
-						'escape_type' => 'stripslashes',
+						'escape_type' => array( 'stripslashes', 'wp_kses_post' ),
 					),
 					'vkExUnit_cta_button_icon'        => array(
-						'escape_type' => 'stripslashes',
+						'escape_type' => 'wp_kses_post',
 					),
 					'vkExUnit_cta_button_icon_before' => array(
-						'escape_type' => 'stripslashes',
+						'escape_type' => 'wp_kses_post',
 					),
 					'vkExUnit_cta_button_icon_after'  => array(
-						'escape_type' => 'stripslashes',
+						'escape_type' => 'wp_kses_post',
 					),
 					'vkExUnit_cta_url'                => array(
-						'escape_type' => '',
+						'escape_type' => 'esc_url',
 					),
 					'vkExUnit_cta_url_blank'          => array(
 						'escape_type' => '',
 					),
 					'vkExUnit_cta_text'               => array(
-						'escape_type' => 'stripslashes',
+						'escape_type' => array( 'stripslashes', 'wp_kses_post' ),
 					),
 				);
 
@@ -198,8 +198,17 @@ public static function save_custom_field( $post_id ) {
 				foreach ( $custom_fields as $custom_field_name => $custom_field_options ) {
 
 					if ( isset( $_POST[ $custom_field_name ] ) ) {
-						if ( isset( $custom_field_name['escape_type'] ) && $custom_field_name['escape_type'] == 'stripslashes' ) {
-							$data = stripslashes( $_POST[ $custom_field_name ] );
+						if ( ! empty( $custom_field_name['escape_type'] ) ) {
+							if ( is_array( $custom_field_name['escape_type'] ) ) {
+								// エスケープ処理が複数ある場合
+								$data =  $_POST[ $custom_field_name ];
+								foreach ( $custom_field_name['escape_type'] as $escape ) {
+									$data = call_user_func( $escape, $data );
+								}
+							} else {
+								// エスケープ処理が一つの場合
+								$data = call_user_func( $custom_field_name['escape_type'], $_POST[ $custom_field_name ] );
+							}
 						} else {
 							$data = $_POST[ $custom_field_name ];
 						}
@@ -462,8 +471,9 @@ public static function render_meta_box_cta() {
 			'itemtype'  => array(),
 		),
 		'i'    => array(
-			'id'    => array(),
-			'class' => array(),
+			'id'          => array(),
+			'class'       => array(),
+			'aria-hidden' => array()
 		),
 	);
 	?>
@@ -498,6 +508,92 @@ public static function get_cta_post( $id ) {
 			return $target;
 		}
 
+		/**
+		 * 許可する HTML
+		 */
+		public static function cta_allow_html() {
+			$allowed_html = array(
+				'div'  => array(
+					'id'        => array(),
+					'class'     => array(),
+					'itemprop'  => array(),
+					'itemscope' => array(),
+					'itemtype'  => array(),
+					'style'     => array(),
+				),
+				'h3' => array(
+					'id'        => array(),
+					'class'     => array(),
+					'style'     => array(),
+				),
+				'h4' => array(
+					'id'        => array(),
+					'class'     => array(),
+					'style'     => array(),
+				),
+				'h5' => array(
+					'id'        => array(),
+					'class'     => array(),
+					'style'     => array(),
+				),
+				'h6' => array(
+					'id'        => array(),
+					'class'     => array(),
+					'style'     => array(),
+				),
+				'p'    => array(
+					'id'    => array(),
+					'class' => array(),
+					'style'     => array(),
+				),
+				'ul'   => array(
+					'id'        => array(),
+					'class'     => array(),
+					'itemprop'  => array(),
+					'itemscope' => array(),
+					'itemtype'  => array(),
+					'style'     => array(),
+				),
+				'ol'   => array(
+					'id'        => array(),
+					'class'     => array(),
+					'itemprop'  => array(),
+					'itemscope' => array(),
+					'itemtype'  => array(),
+					'style'     => array(),
+				),
+				'li'   => array(
+					'id'        => array(),
+					'class'     => array(),
+					'itemprop'  => array(),
+					'itemscope' => array(),
+					'itemtype'  => array(),
+					'style'     => array(),
+				),
+				'a'    => array(
+					'id'       => array(),
+					'class'    => array(),
+					'href'     => array(),
+					'target'   => array(),
+					'itemprop' => array(),
+					'style'     => array(),
+				),
+				'span' => array(
+					'id'        => array(),
+					'class'     => array(),
+					'itemprop'  => array(),
+					'itemscope' => array(),
+					'itemtype'  => array(),
+					'style'     => array(),
+				),
+				'i'    => array(
+					'id'          => array(),
+					'class'       => array(),
+					'aria-hidden' => array()
+				),
+			);
+			return $allowed_html;
+		}
 
 		/**
 		 * CTAとして返す内容の処理
@@ -545,7 +641,7 @@ public static function render_cta_content( $id ) {
 			wp_reset_postdata();
 
 			// wp_kses_post でエスケープすると outerブロックが出力するstyle属性を無効化される.
-			return do_blocks( do_shortcode( $content ) );
+			return do_blocks( do_shortcode( wp_kses( $content, cta_allow_html() ) ) );
 		}
 
 		/**
@@ -717,7 +813,8 @@ public static function get_option( $show_label = false ) {
 			// ↓ これであかんの？
 			// $output_option = wp_parse_args( $option, $default );
 			if ( ! $option || ! is_array( $option ) ) {
-				return $default; }
+				return $default; 
+			}
 
 			$posttypes = array_merge(
 				array(
diff --git a/inc/common-block.php b/inc/common-block.php
index 4598e9ca..e4c64bf8 100644
--- a/inc/common-block.php
+++ b/inc/common-block.php
@@ -52,6 +52,7 @@ function veu_block_deprecated_alart() {
 
 		$text .= '</ol>';
 		$text .= '</div>';
+		// 入力由来でないのでエスケープ不要
 		echo $text;
 	}
 }
diff --git a/inc/contact-section/contact-section.php b/inc/contact-section/contact-section.php
index 12323910..ded59b9e 100644
--- a/inc/contact-section/contact-section.php
+++ b/inc/contact-section/contact-section.php
@@ -241,16 +241,16 @@ public function options_page() {
 	}
 
 	public function option_sanitaize( $option ) {
-		$option['contact_txt']       = stripslashes( $option['contact_txt'] );
-		$option['tel_number']        = stripslashes( $option['tel_number'] );
-		$option['tel_icon']          = stripslashes( $option['tel_icon'] );
-		$option['contact_time']      = stripslashes( $option['contact_time'] );
-		$option['contact_link']      = stripslashes( $option['contact_link'] );
-		$option['button_text']       = stripslashes( $option['button_text'] );
-		$option['button_text_small'] = stripslashes( $option['button_text_small'] );
-		$option['short_text']        = stripslashes( $option['short_text'] );
+		$option['contact_txt']       = wp_kses_post( stripslashes( $option['contact_txt'] ) );
+		$option['tel_number']        = wp_kses_post( stripslashes( $option['tel_number'] ) );
+		$option['tel_icon']          = wp_kses( $option['tel_icon'] , array( 'i' => array( 'class' => array(), 'aria-hidden' => array() ) ) );
+		$option['contact_time']      = wp_kses_post( stripslashes( $option['contact_time'] ) );
+		$option['contact_link']      = esc_url ( $option['contact_link'] );
+		$option['button_text']       = wp_kses_post( stripslashes( $option['button_text'] ) );
+		$option['button_text_small'] = wp_kses_post( stripslashes( $option['button_text_small'] ) );
+		$option['short_text']        = wp_kses_post( stripslashes( $option['short_text'] ) );
 		$option['contact_image']     = esc_url( $option['contact_image'] );
-		$option['contact_html']      = stripslashes( $option['contact_html'] );
+		$option['contact_html']      = wp_kses_post( stripslashes( $option['contact_html'] ) );
 		return $option;
 	}
 
@@ -451,7 +451,7 @@ public static function render_widget_contact_btn_html() {
 			}
 			$cont .= '<i class="' . $class . '"></i> ';
 
-			$cont .= $options['short_text'];
+			$cont .= wp_kses_post( $options['short_text'] );
 
 			// Arrow Icon
 			$class = 'far fa-arrow-alt-circle-right';
@@ -462,7 +462,7 @@ public static function render_widget_contact_btn_html() {
 
 			$cont .= '</span>';
 			if ( isset( $options['button_text_small'] ) && $options['button_text_small'] ) {
-				$cont .= '<span class="contact_bt_subTxt contact_bt_subTxt_side">' . $options['button_text_small'] . '</span>';
+				$cont .= '<span class="contact_bt_subTxt contact_bt_subTxt_side">' . wp_kses_post( $options['button_text_small'] ) . '</span>';
 			}
 			$cont .= '</a>';
 		}
diff --git a/inc/insert-ads.php b/inc/insert-ads.php
index d3d9047d..ba33c495 100644
--- a/inc/insert-ads.php
+++ b/inc/insert-ads.php
@@ -125,7 +125,6 @@ public function print_google_auto_ad() {
 		$option = $this->get_option();
 		if ( $option['google-ads-active'] && $option['google-pub-id'] ) {
 
-			$overlay = ',overlays: {bottom: true}';
 ?><!-- [ <?php echo veu_get_name(); ?> GoogleAd ] -->
 <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
 <script>
@@ -134,7 +133,7 @@ public function print_google_auto_ad() {
 		  enable_page_level_ads: true
 			<?php
 			if ( $option['google-ads-overlays-bottom'] ) {
-				echo $overlay;}
+				echo ',overlays: {bottom: true}';}
 ?>
 	 });
 </script>
@@ -230,7 +229,7 @@ public function render_configPage() {
 		$lang          = ( get_locale() == 'ja' ) ? 'ja' : 'en';
 		$Google_ad_url = 'https://support.google.com/adsense/answer/7478040?hl=' . $lang;
 		?>
-		[ <a href="<?php echo $Google_ad_url; ?>" target="_blank"><?php _e( 'About Google Auto ads', 'vk-all-in-one-expansion-unit' ); ?></a> ]
+		[ <a href="<?php echo esc_url( $Google_ad_url ); ?>" target="_blank"><?php _e( 'About Google Auto ads', 'vk-all-in-one-expansion-unit' ); ?></a> ]
 	</th>
 	<td>
 		<?php _e( 'If you would like to set to Google Auto ads,Please fill in Publisher ID.', 'vk-all-in-one-expansion-unit' ); ?>
diff --git a/inc/other-widget/widget-3pr-area.php b/inc/other-widget/widget-3pr-area.php
index 13185301..371b16ca 100644
--- a/inc/other-widget/widget-3pr-area.php
+++ b/inc/other-widget/widget-3pr-area.php
@@ -137,13 +137,13 @@ function update( $new_instance, $old_instance ) {
 		$instance = $old_instance;
 
 		for ( $i = 1; $i <= 3; ) {
-			$instance[ 'label_' . $i ]              = $new_instance[ 'label_' . $i ];
-			$instance[ 'media_3pr_image_' . $i ]    = $new_instance[ 'media_3pr_image_' . $i ];
-			$instance[ 'media_3pr_alt_' . $i ]      = $new_instance[ 'media_3pr_alt_' . $i ];
-			$instance[ 'media_3pr_image_sp_' . $i ] = $new_instance[ 'media_3pr_image_sp_' . $i ];
-			$instance[ 'media_3pr_alt_sp_' . $i ]   = $new_instance[ 'media_3pr_alt_sp_' . $i ];
-			$instance[ 'summary_' . $i ]            = $new_instance[ 'summary_' . $i ];
-			$instance[ 'linkurl_' . $i ]            = $new_instance[ 'linkurl_' . $i ];
+			$instance[ 'label_' . $i ]              = wp_kses_post( stripslashes($new_instance[ 'label_' . $i ] ) );
+			$instance[ 'media_3pr_image_' . $i ]    = esc_url( $new_instance[ 'media_3pr_image_' . $i ] );
+			$instance[ 'media_3pr_alt_' . $i ]      = esc_html( stripslashes( $new_instance[ 'media_3pr_alt_' . $i ] ) );
+			$instance[ 'media_3pr_image_sp_' . $i ] = esc_url( $new_instance[ 'media_3pr_image_sp_' . $i ] );
+			$instance[ 'media_3pr_alt_sp_' . $i ]   = esc_html( stripslashes( $new_instance[ 'media_3pr_alt_sp_' . $i ] ) );
+			$instance[ 'summary_' . $i ]            = wp_kses_post( stripslashes( $new_instance[ 'summary_' . $i ] ) );
+			$instance[ 'linkurl_' . $i ]            = esc_url( $new_instance[ 'linkurl_' . $i ] );
 			$instance[ 'blank_' . $i ]              = ( isset( $new_instance[ 'blank_' . $i ] ) && $new_instance[ 'blank_' . $i ] == 'true' );
 			$i++;
 		}
@@ -163,7 +163,7 @@ function widget( $args, $instance ) {
 
 				echo '<h1 class="subSection-title">';
 				if ( isset( $instance[ 'label_' . $i ] ) && $instance[ 'label_' . $i ] ) {
-					echo $instance[ 'label_' . $i ];
+					echo wp_kses_posts( $instance[ 'label_' . $i ] );
 				} else {
 					_e( '3PR area', 'vk-all-in-one-expansion-unit' );
 				}
diff --git a/inc/other-widget/widget-button.php b/inc/other-widget/widget-button.php
index 2c7003f4..d49f9464 100644
--- a/inc/other-widget/widget-button.php
+++ b/inc/other-widget/widget-button.php
@@ -69,7 +69,7 @@ function widget( $args, $instance ) {
 
 		if ( $options['linkurl'] && $options['title'] ) : ?>
 		<div class="veu_button">
-			<a class="<?php echo implode( ' ', $classes ); ?>" href="<?php echo $options['linkurl']; ?>"<?php echo $blank; ?>>
+			<a class="<?php echo implode( ' ', $classes ); ?>" href="<?php echo esc_url( $options['linkurl'] ); ?>"<?php echo $blank; ?>>
 			<span class="button_mainText">
 
 			<?php
@@ -205,11 +205,11 @@ function form( $instance ) {
 
 	function update( $new_instance, $old_instance ) {
 		$opt                = array();
-		$opt['title']       = wp_kses_post( $new_instance['title'] );
-		$opt['icon_before'] = $new_instance['icon_before'];
-		$opt['icon_after']  = $new_instance['icon_after'];
-		$opt['subtext']     = $new_instance['subtext'];
-		$opt['linkurl']     = $new_instance['linkurl'];
+		$opt['title']       = wp_kses_post( stripslashes( $new_instance['title'] ) );
+		$opt['icon_before'] = wp_kses_post( $new_instance['icon_before'] );
+		$opt['icon_after']  = wp_kses_post( $new_instance['icon_after'] );
+		$opt['subtext']     = wp_kses_post( stripslashes( $new_instance['subtext'] ) );
+		$opt['linkurl']     = esc_url( $new_instance['linkurl'] );
 		$opt['blank']       = ( isset( $new_instance['blank'] ) && $new_instance['blank'] == 'true' );
 		$opt['size']        = in_array( $new_instance['size'], array( 'sm', 'lg' ) ) ? $new_instance['size'] : 'md';
 		$opt['color']       = in_array( $new_instance['color'], array_keys( self::button_otherlabels() ) ) ? $new_instance['color'] : static::$button_default;
diff --git a/inc/other-widget/widget-page.php b/inc/other-widget/widget-page.php
index 5ef10602..c2fb502f 100644
--- a/inc/other-widget/widget-page.php
+++ b/inc/other-widget/widget-page.php
@@ -190,7 +190,7 @@ function form( $instance ) {
 	// 保存・更新する値
 	function update( $new_instance, $old_instance ) {
 		$instance                       = $old_instance;
-		$instance['title']              = $new_instance['title'];
+		$instance['title']              = wp_kses_post( stripslashes( $new_instance['title'] ) );
 		$instance['page_id']            = $new_instance['page_id'];
 		$instance['set_title']          = $new_instance['set_title'];
 		$instance['child_page_index']   = $new_instance['child_page_index'];
@@ -233,7 +233,7 @@ function display_page( $args, $instance ) {
 
 		echo PHP_EOL . '<div id="widget-page-' . $pageid . '" class="widget_pageContent entry-body">' . PHP_EOL;
 		if ( $widget_title['display'] ) {
-			echo $args['before_title'] . $widget_title['title'] . $args['after_title'] . PHP_EOL;
+			echo wp_kses_post( $args['before_title'] . $widget_title['title'] . $args['after_title'] ) . PHP_EOL;
 		}
 		echo apply_filters( 'the_content', $page->post_content );
 
diff --git a/inc/other-widget/widget-pr-blocks.php b/inc/other-widget/widget-pr-blocks.php
index d5b43f56..2fdec2d3 100644
--- a/inc/other-widget/widget-pr-blocks.php
+++ b/inc/other-widget/widget-pr-blocks.php
@@ -206,14 +206,14 @@ public function update( $new_instance, $old_instance ) {
 		}
 
 		for ( $i = 1; $i <= 4; ) {
-			$instance[ 'label_' . $i ]            = $new_instance[ 'label_' . $i ];
-			$instance[ 'media_image_' . $i ]      = $new_instance[ 'media_image_' . $i ];
-			$instance[ 'media_alt_' . $i ]        = $new_instance[ 'media_alt_' . $i ];
-			$instance[ 'iconFont_class_' . $i ]   = $new_instance[ 'iconFont_class_' . $i ];
-			$instance[ 'iconFont_bgColor_' . $i ] = $new_instance[ 'iconFont_bgColor_' . $i ];
+			$instance[ 'label_' . $i ]            = wp_kses_post( stripslashes( $new_instance[ 'label_' . $i ] ) );
+			$instance[ 'media_image_' . $i ]      = esc_url( $new_instance[ 'media_image_' . $i ] );
+			$instance[ 'media_alt_' . $i ]        = esc_html( stripslashes( $new_instance[ 'media_alt_' . $i ] ) );
+			$instance[ 'iconFont_class_' . $i ]   = esc_html( $new_instance[ 'iconFont_class_' . $i ] );
+			$instance[ 'iconFont_bgColor_' . $i ] = esc_html( $new_instance[ 'iconFont_bgColor_' . $i ] );
 			$instance[ 'iconFont_bgType_' . $i ]  = $new_instance[ 'iconFont_bgType_' . $i ];
-			$instance[ 'summary_' . $i ]          = $new_instance[ 'summary_' . $i ];
-			$instance[ 'linkurl_' . $i ]          = $new_instance[ 'linkurl_' . $i ];
+			$instance[ 'summary_' . $i ]          = wp_kses_post( stripslashes( $new_instance[ 'summary_' . $i ] ) );
+			$instance[ 'linkurl_' . $i ]          = esc_url( $new_instance[ 'linkurl_' . $i ] );
 			$instance[ 'blank_' . $i ]            = ( isset( $new_instance[ 'blank_' . $i ] ) && $new_instance[ 'blank_' . $i ] == 'true' );
 			$i++;
 		}
@@ -285,7 +285,7 @@ public function widget( $args, $instance ) {
 				// title text
 				echo '<h1 class="prBlock_title">';
 				if ( isset( $instance[ 'label_' . $i ] ) && $instance[ 'label_' . $i ] ) {
-					echo $instance[ 'label_' . $i ];
+					echo wp_kses_post( $instance[ 'label_' . $i ] );
 				} else {
 					_e( 'PR Block', 'vk-all-in-one-expansion-unit' );
 				}
diff --git a/inc/other-widget/widget-profile.php b/inc/other-widget/widget-profile.php
index f302dfa4..bab0b88a 100644
--- a/inc/other-widget/widget-profile.php
+++ b/inc/other-widget/widget-profile.php
@@ -181,24 +181,24 @@ function form( $instance ) {
 	/*-------------------------------------------*/
 	function update( $new_instance, $old_instance ) {
 		$instance                    = $old_instance;
-		$instance['label']           = $new_instance['label'];
-		$instance['mediaFile']       = $new_instance['mediaFile'];
-		$instance['mediaAlt']        = $new_instance['mediaAlt'];
-		$instance['profile']         = $new_instance['profile'];
+		$instance['label']           = wp_kses_post( stripslashes($new_instance['label'] ) );
+		$instance['mediaFile']       = esc_url( $new_instance['mediaFile'] );
+		$instance['mediaAlt']        = esc_html( stripslashes( $new_instance['mediaAlt'] ) );
+		$instance['profile']         = wp_kses_post( stripslashes( $new_instance['profile'] ) );
 		$instance['mediaAlign_left'] = $new_instance['mediaAlign_left'];
 		$instance['mediaAlign']      = $new_instance['mediaAlign'];
 		$instance['mediaRound']      = $new_instance['mediaRound'];
-		$instance['mediaSize']       = $new_instance['mediaSize'];
+		$instance['mediaSize']       = esc_html( $new_instance['mediaSize'] );
 		$instance['mediaFloat']      = $new_instance['mediaFloat'];
 		$instance['facebook']        = esc_url( $new_instance['facebook'] );
 		$instance['twitter']         = esc_url( $new_instance['twitter'] );
-		$instance['mail']            = esc_attr( $new_instance['mail'] );
+		$instance['mail']            = esc_url( $new_instance['mail'] );
 		$instance['youtube']         = esc_url( $new_instance['youtube'] );
 		$instance['rss']             = esc_url( $new_instance['rss'] );
 		$instance['instagram']       = esc_url( $new_instance['instagram'] );
 		$instance['linkedin']        = esc_url( $new_instance['linkedin'] );
 		$instance['iconFont_bgType'] = $new_instance['iconFont_bgType'];
-		$instance['icon_color']      = $new_instance['icon_color'];
+		$instance['icon_color']      = esc_html( $new_instance['icon_color'] );
 		return $instance;
 	}	
 	/*-------------------------------------------*/
@@ -356,9 +356,7 @@ function widget( $args, $instance ) {
 		echo PHP_EOL . '<div class="veu_profile">' . PHP_EOL;
 
 		if ( isset( $instance['label'] ) && $instance['label'] ) {
-			echo $args['before_title'];
-			echo $instance['label'];
-			echo $args['after_title'];
+			echo wp_kses_post( $args['before_title'] . $instance['label'] . $args['after_title'] );
 		}
 		?>
 <div class="profile" >
diff --git a/inc/post-type-manager/package/class.post-type-manager.php b/inc/post-type-manager/package/class.post-type-manager.php
index 7260e769..45076d46 100644
--- a/inc/post-type-manager/package/class.post-type-manager.php
+++ b/inc/post-type-manager/package/class.post-type-manager.php
@@ -109,8 +109,9 @@ public static function add_meta_box_action() {
 			/*******************************************
 			 * Supports(Required)
 			 */
-			echo '<h4>' . esc_html__( 'Supports(Required)', 'vk-all-in-one-expansion-unit' ) . '</h4>';
+			echo '<h4>' . esc_html__( 'Supports ( Required )', 'vk-all-in-one-expansion-unit' ) . '</h4>';
 			$post_type_items_value = get_post_meta( $post->ID, 'veu_post_type_items', true );
+
 			echo '<ul>';
 			foreach ( $post_type_items_array as $key => $label ) {
 				$checked = ( isset( $post_type_items_value[ $key ] ) && $post_type_items_value[ $key ] ) ? ' checked' : '';
@@ -323,33 +324,42 @@ public static function save_cf_value( $post_id ) {
 			if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
 				return $post_id;
 			}
+			
+			$post_type_id            = ! empty( $_POST['veu_post_type_id'] )            ? esc_html( strip_tags( $_POST['veu_post_type_id'] ) )  : '';
+			$post_type_items         = ! empty( $_POST['veu_post_type_items'] )         ? $_POST['veu_post_type_items']                         : '';
+			$menu_posttion           = ! empty( $_POST['veu_menu_position'] )           ? esc_html( strip_tags( $_POST['veu_menu_position'] ) ) : '';
+			$menu_icon               = ! empty( $_POST['veu_menu_icon'] )               ? esc_html( strip_tags( $_POST['veu_menu_icon'] ) )     : '';
+			$post_type_export_to_api = ! empty( $_POST['veu_post_type_export_to_api'] ) ? esc_html( $_POST['veu_post_type_export_to_api'] )     : '';
+			$post_type_rewrite       = ! empty( $_POST['veu_post_type_rewrite'] )       ? esc_html( $_POST['veu_post_type_rewrite'] )           : '';
+			
+			if ( ! empty ( $_POST['veu_taxonomy'] ) ) {
+				$taxonomy      = $_POST['veu_taxonomy'];
+
+				for ( $i = 1; $i <= apply_filters( 'veu_post_type_taxonomies', 5 ); $i++ ) {
+					$taxonomy[$i]['slug']     = ! empty( $taxonomy[$i]['slug'] )     ? esc_html( strip_tags( $taxonomy[$i]['slug'] ) )  : '';
+					$taxonomy[$i]['label']    = ! empty( $taxonomy[$i]['label'] )    ? esc_html( strip_tags( $taxonomy[$i]['label'] ) ) : '';
+					$taxonomy[$i]['tag']      = ! empty( $taxonomy[$i]['tag'] )      ? esc_html( $taxonomy[$i]['tag'] )                 : '';
+					$taxonomy[$i]['rest_api'] = ! empty( $taxonomy[$i]['rest_api'] ) ? esc_html( $taxonomy[$i]['rest_api'] )            : '';						
+				}
+			}
 
-				// 保存しているカスタムフィールド.
+			// 保存しているカスタムフィールド.
 			$fields = array(
-				'veu_post_type_id',
-				'veu_post_type_items',
-				'veu_menu_position',
-				'veu_menu_icon',
-				'veu_post_type_export_to_api',
-				'veu_post_type_rewrite',
-				'veu_taxonomy',
+				'veu_post_type_id'            => $post_type_id,
+				'veu_post_type_items'         => $post_type_items,
+				'veu_menu_position'           => $menu_posttion,
+				'veu_menu_icon'               => $menu_icon,
+				'veu_post_type_export_to_api' => $post_type_export_to_api,
+				'veu_post_type_rewrite'       => $post_type_rewrite,
+				'veu_taxonomy'                => $taxonomy,
 			);
 
-			foreach ( $fields as $key => $field ) {
-					$field_value = ( isset( $_POST[ $field ] ) ) ? $_POST[ $field ] : '';
-
-					// データが空だったら入れる.
-				if ( get_post_meta( $post_id, $field ) == '' ) {
-					add_post_meta( $post_id, $field, $field_value, true );
-
-					// 今入ってる値と違ってたらアップデートする.
-				} elseif ( get_post_meta( $post_id, $field, true ) !== $field_value ) {
-					update_post_meta( $post_id, $field, $field_value );
-
-					// 入力がなかったら消す.
-				} elseif ( '' === $field_value ) {
-					delete_post_meta( $post_id, $field, get_post_meta( $post_id, $field, true ) );
-				}
+			foreach ( $fields as $field_name => $field_value ) {
+				if ( ! empty( $field_value ) ) {
+					update_post_meta( $post_id, $field_name, $field_value );
+				} else {
+					delete_post_meta(  $post_id, $field_name );
+				}				
 			}
 
 			// リライトルールを更新するように.
diff --git a/inc/promotion-alert/package/class-veu-promotion-alert.php b/inc/promotion-alert/package/class-veu-promotion-alert.php
index b397295c..e84a3341 100644
--- a/inc/promotion-alert/package/class-veu-promotion-alert.php
+++ b/inc/promotion-alert/package/class-veu-promotion-alert.php
@@ -78,9 +78,10 @@ public static function kses_allowed() {
 				'style' => array(),
 			),
 			'i'      => array(
-				'id'    => array(),
-				'class' => array(),
-				'style' => array(),
+				'id'          => array(),
+				'class'       => array(),
+				'style'       => array(),
+				'aria-hidden' => array()
 			),
 			'a'      => array(
 				'id'    => array(),
diff --git a/inc/sns/widget-fb-page-plugin.php b/inc/sns/widget-fb-page-plugin.php
index bfc5ea0d..f4a0b9cd 100644
--- a/inc/sns/widget-fb-page-plugin.php
+++ b/inc/sns/widget-fb-page-plugin.php
@@ -16,12 +16,12 @@ function __construct() {
 
 
 	function widget( $args, $instance ) {
-		echo $args['before_widget'];
+		echo wp_kses_post( $args['before_widget'] );
 		echo '<div class="veu_fbPagePlugin">';
 		if ( isset( $instance['label'] ) && $instance['label'] ) {
-			echo $args['before_title'];
-			echo $instance['label'];
-			echo $args['after_title'];
+			echo wp_kses_post( $args['before_title'] );
+			echo wp_kses_post( $instance['label'] );
+			echo wp_kses_post( $args['after_title'] );
 		}
 
 		$page_url  = ( isset( $instance['page_url'] ) && $instance['page_url'] ) ? $instance['page_url'] : '';
@@ -32,10 +32,10 @@ function widget( $args, $instance ) {
 		?>
 
 		<div class="fbPagePlugin_body">
-			<div class="fb-page" data-href="<?php echo $page_url; ?>" data-width="500"  data-height="<?php echo $height; ?>" data-hide-cover="<?php echo $hideCover; ?>" data-show-facepile="<?php echo $showFaces; ?>" data-show-posts="<?php echo $showPosts; ?>">
+			<div class="fb-page" data-href="<?php echo esc_url( $page_url ); ?>" data-width="500"  data-height="<?php echo esc_attr( $height ); ?>" data-hide-cover="<?php echo esc_attr( $hideCover ); ?>" data-show-facepile="<?php echo esc_attr( $showFaces ); ?>" data-show-posts="<?php echo esc_attr( $showPosts ); ?>">
 				<div class="fb-xfbml-parse-ignore">
 					<blockquote cite="<?php echo $page_url; ?>">
-					<a href="<?php echo $page_url; ?>">Facebook page</a>
+					<a href="<?php echo esc_url( $page_url ); ?>">Facebook page</a>
 					</blockquote>
 				</div>
 			</div>
@@ -43,7 +43,7 @@ function widget( $args, $instance ) {
 
 		<?php
 		echo '</div>';
-		echo $args['after_widget'];
+		echo wp_kses_post( $args['after_widget'] );
 
 		veu_set_facebook_script();
 	} // widget($args, $instance)
@@ -51,9 +51,9 @@ function widget( $args, $instance ) {
 
 	function update( $new_instance, $old_instance ) {
 		$instance              = $old_instance;
-		$instance['label']     = $new_instance['label'];
-		$instance['page_url']  = $new_instance['page_url'];
-		$instance['height']    = $new_instance['height'];
+		$instance['label']     = wp_kses_post( stripslashes($new_instance['label'] ) );
+		$instance['page_url']  = esc_url( $new_instance['page_url'] );
+		$instance['height']    = esc_html( $new_instance['height'] );
 		$instance['showFaces'] = $new_instance['showFaces'];
 		$instance['hideCover'] = $new_instance['hideCover'];
 		$instance['showPosts'] = $new_instance['showPosts'];
diff --git a/readme.txt b/readme.txt
index 31664862..faed40de 100644
--- a/readme.txt
+++ b/readme.txt
@@ -81,6 +81,8 @@ e.g.
 
 == Changelog ==
 
+[ Bug fix ] Fix XSS of Widgets, CTA, Custom Post Type Manager.
+
 = 9.99.0 =
 [ Specification Change ] Foce Load JS from footer is abolished.
 [ Fix ] Add a title attribute on  Google Tag Manager (noscript)