Authenticated (Contributor+) Stored Cross-Site Scripting via WordPress Block Delimiter Whitespace

WordPress before 7.1.4 matched the whitespace inside block comment delimiters () with the regex class \s, which accepts a different set of characters in the server-side PHP block parser (PCRE, which includes the vertical tab) than in the block editor JavaScript parser (which includes NBSP and other Unicode spaces). A Contributor could store a... Weiterlesen: Authenticated (Contributor+) Stored Cross-Site Scripting via WordPres…