Unsafe usage of href attribute in wp-admin/js/link.js

[Rudloff]

(This was initially reported privately as a security issue but it was considered not a core vulnerability.
I still think it is worth hardening so I am reporting it as a bug.)

wp-admin/js/link.js passes the value of the href attribute to $() without sanitizing it:

		var t = $(this).attr('href');
		...
		$(t).show();

This is dangerous because $() accepts both a selector or raw HTML.
In theory, this could be exploited if an attacker can inject basic HTML in the admin. (But core does not provide a way to exploit this, it would need to be chained with an HTML injection vulnerability).

For example this payload would trigger the problem if it can be inserted on /wp-admin/link-add.php:

<div id="category-tabs"><a href="&lt;img src=x onerror=alert()&gt;">Click me!</a></div>

Trac ticket: #65573

[arkaprabhachowdhury]

Local Testing Screenshot

[arkaprabhachowdhury]

I reproduced and tested this locally against WordPress trunk.

Before the patch, changing a category tab’s href to an HTML payload caused the value to be interpreted through jQuery’s HTML parsing path.

After applying the proposed fix from the PR, the handler uses aria-controls and document.getElementById(). The malicious href is no longer parsed, while the All categories and Most Used tabs continue to switch panels correctly.

Confirmed locally. The fix works as expected.