“A Remote Code Execution vulnerability that ... explaining that the issue is in the ‘WP_HTML_Token’ class, introduced in WordPress 6.4 to improve HTML parsing in the block editor.