Stored Cross-Site Scripting in WooCommerce Order Notes REST API v4

WooCommerce before 10.7.0 passed the REST API v4 order-note request field directly to add_order_note() without sanitization, storing the value verbatim. Any user able to create an order note through the v4 REST API can inject script that is later executed when the note is rendered, including in the wp-admin order screens. The fix wraps the value...