Potential reflected XSS in the WebSub intent verification

[randomstuff]

I believe the WebSub intent verification might be vulnerable to XSS because it reflects the hub.challenge parameter with a HTML content type:

<?php

if (get_str("hub_mode") == "subscribe"){
  # ...
  $challenge = get_str("hub_challenge");
	$verify = get_str("hub_verify_token");
  # ...
  if ($verify != $subscription['verify_token']){
		error_403();
	}
  # ...
  echo $challenge;
	exit();
}

Reference: https://www.w3.org/TR/websub/