WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Bind Directive Prototype Pollution

Description WordPress does not reject prototype-mutating property names in Interactivity API bind directives in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session when the...