Ticket #53973: 53973.20220602.1.patch

src/wp-includes/class-wp-roles.php

@@ -159 +159 @@
                         return;
                 }
 
+                if( wp_kses( $role, '' ) !== $role || wp_kses( $display_name, '' ) !== $display_name ) {
+                        return;
+                }
+
                 $this->roles[ $role ] = array(
                         'name'         => $display_name,
                         'capabilities' => $capabilities,