Wrapped get_search_query() with esc_attr() in 404.php, front-page.php,
and searchform.php. Without this, a crafted search query can inject
arbitrary HTML attributes into the search input value field.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>