diff --git a/wordpress.org/public_html/wp-content/plugins/photo-directory/inc/uploads.php b/wordpress.org/public_html/wp-content/plugins/photo-directory/inc/uploads.php
index e52b9f21fc..75797df5ea 100644
--- a/wordpress.org/public_html/wp-content/plugins/photo-directory/inc/uploads.php
+++ b/wordpress.org/public_html/wp-content/plugins/photo-directory/inc/uploads.php
@@ -703,8 +703,15 @@ protected static function validate_upload_form() {
 			return 'checkbox_unchecked_license';
 		}
 
-		foreach ( [ 'post_title', 'post_content', 'post_excerpt' ] as $field ) {
-			// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Read raw: sanitizing before the check would hide what it looks for.
+		// The same fields and sanitizers `sanitize_submitted_description()` stores them with.
+		$fields = [
+			'post_title'   => 'sanitize_text_field',
+			'post_content' => 'sanitize_textarea_field',
+			'post_excerpt' => 'sanitize_text_field',
+		];
+
+		foreach ( $fields as $field => $sanitize ) {
+			// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized on the next line, by whichever callback stores the field.
 			$submitted = isset( $_POST[ $field ] ) ? wp_unslash( $_POST[ $field ] ) : '';
 
 			// A field can arrive as an array, which Frontend Uploader drops before it builds the post.
@@ -712,7 +719,8 @@ protected static function validate_upload_form() {
 				continue;
 			}
 
-			if ( preg_match( '/' . get_shortcode_regex() . '/', $submitted ) ) {
+			// Anything but a clean no-match is refused: preg_match() returns false when PCRE gives up.
+			if ( 0 !== preg_match( '/' . get_shortcode_regex() . '/', $sanitize( $submitted ) ) ) {
 				return 'shortcode-in-text';
 			}
 		}