Unsafe usage of href attribute in wp-admin/js/common.js

[Rudloff]

(This was initially reported privately as a security issue but it was considered not a core vulnerability.
I still think it is worth hardening so I am reporting it as a bug.)

wp-admin/js/common.js passes the value of the href attribute to $() without sanitizing it:

panel = $( link.attr('href') );

This is dangerous because $() accepts both a selector or raw HTML.
In theory, this could be exploited if an attacker can inject basic HTML in the admin. (But core does not provide a way to exploit this, it would need to be chained with an HTML injection vulnerability).

For example this payload would trigger the problem if it can be inserted anywhere in the admin:

<div class="contextual-help-tabs"><a href="&lt;img src=x onerror=alert()&gt;">Click me!</a></div>

The contextual help tab click handler passed the raw href attribute to jQuery's $(), which accepts both CSS selectors and raw HTML.

Fix: Use aria-controls with the $( '#' + id ) pattern, the same convention used elsewhere in the same file and across admin JS (privacy-tools.js, site-health.js).

Trac ticket: #65574