The Post Content block used any tagName block attribute as its wrapper element as long as it survived tag_escape(), which only strips characters that are invalid in a tag name. An authenticated user with Contributor privileges or higher could therefore set the wrapper tag to script and have arbitrary JavaScript executed in the browser of every visitor viewing the post. The fix restricts the wrapper tag to an allowlist of div, main, section and article.
This vulnerability affects the following application versions:
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2