- $tabindex = isset( $node->meta['tabindex'] ) ? (int) $node->meta['tabindex'] : '';
- $aria_attributes = $tabindex ? 'tabindex="' . $tabindex . '"' : '';
+ // Allow only numeric values, then casted to integers, and allow a tabindex value of `0` for a11y.
+ $tabindex = ( isset( $node->meta['tabindex'] ) && is_numeric( $node->meta['tabindex'] ) ) ? (int) $node->meta['tabindex'] : '';
+ $aria_attributes = ( '' !== $tabindex ) ? ' tabindex="' . $tabindex . '"' : '';