From 8a9ca8b1db1713206c65d7624d639aab278936d3 Mon Sep 17 00:00:00 2001 From: Sainath Poojary Date: Fri, 17 Jul 2026 19:00:20 +0530 Subject: [PATCH] Security: Use aria-controls attribute with safe $( '#' + id ) selector pattern avoiding unsafe use of href --- src/js/_enqueues/admin/common.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/js/_enqueues/admin/common.js b/src/js/_enqueues/admin/common.js index c3d49310e8897..9c5799c0ada41 100644 --- a/src/js/_enqueues/admin/common.js +++ b/src/js/_enqueues/admin/common.js @@ -695,7 +695,7 @@ $('.contextual-help-tabs').on( 'click', 'a', function(e) { $('.contextual-help-tabs .active').removeClass('active'); link.parent('li').addClass('active'); - panel = $( link.attr('href') ); + panel = $( '#' + link.attr( 'aria-controls' ) ); // Panels. $('.help-tab-content').not( panel ).removeClass('active').hide();