Authenticated (Contributor+) Stored Cross-Site Scripting via WordPress Categories Block Label

WordPress 6.7 through 7.1.3 built the Categories block's dropdown markup by concatenating the block's label attribute into the sprintf() format string. A Contributor could store a Categories block whose label contains printf conversion specifiers (such as %1$s or %2$s), which KSES keeps as plain text; when the block is rendered, sprintf() expands... Weiterlesen: Authenticated (Contributor+) Stored Cross-Site Scripting via WordPres…