Bugfix: correctly escape ampersands with htmlentities in URLs

core/40-page-renderer.php

@@ -439,7 +439,11 @@ class page_renderer
 		foreach($nav_links as $item) {
 			if(!is_string($item)) {
 				// Output the item as a link to a url
-				$result .= "<span><a href='" . str_replace("{page}", rawurlencode($env->page), $item[1]) . "'>$item[0]</a></span>";
+				$result .= "<span><a href='" . str_replace(
+					[ "{page}", "&" ],
+					[ rawurlencode($env->page), "&amp;" ],
+					$item[1]
+				) . "'>$item[0]</a></span>";
 				continue;
 			}