WP_HTML_Tag_Processor::set_modifiable_text() guarded comment text only against the –> and –!> closers, missing the abrupt closers the HTML specification also honours: a leading > or -> at the very start of the comment text. Text beginning with either sequence escaped the comment and was parsed as markup, so a caller placing untrusted content inside an HTML comment could have that content injected into the page. The fix extends the guard to /^-?>|–!?>/ so abrupt closers are rejected as well.
This vulnerability affects the following application versions:
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.1