Unsafe usage of href attribute in wp-admin/js/post.js

[Rudloff]

(This was initially reported privately as a security issue but it was considered not a core vulnerability.
I still think it is worth hardening so I am reporting it as a bug.)

wp-admin/js/post.js passes the value of the href attribute to $() without sanitizing it.
This is dangerous because $() accepts both a selector or raw HTML.
In theory, this could be exploited if an attacker can inject basic HTML on the post edit page. (But core does not provide a way to exploit this, it would need to be chained with an HTML injection vulnerability).

For example this payload would trigger the problem if it can be inserted on /wp-admin/post-new.php:

<div class="categorydiv" id="taxonomy-foo"></div>
<div id="foo-tabs"><a href="&lt;img src=x onerror=alert()&gt;">Click me!</a></div>

Using document.querySelectorAll() would ensure the input is always interpreted as a selector:

$(document.querySelectorAll(t)).show();

This PR hardens the taxonomy tab click handler in wp-admin/js/post.js to avoid passing a raw href value into jQuery’s $() constructor. This mitigates the risk of unintended HTML parsing or CSS selector injection.

Trac ticket: #65572