From 667e963fabc18d89d768b888999272e7b9ec26ae Mon Sep 17 00:00:00 2001
From: Sainath Poojary <spoojary614@gmail.com>
Date: Tue, 21 Jul 2026 17:54:09 +0530
Subject: [PATCH 1/2] Security: Use `aria-controls` instead of `href` in link
 category tab

---
 src/js/_enqueues/admin/link.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/js/_enqueues/admin/link.js b/src/js/_enqueues/admin/link.js
index ed4bd5e3efb94..dae086f846873 100644
--- a/src/js/_enqueues/admin/link.js
+++ b/src/js/_enqueues/admin/link.js
@@ -20,7 +20,7 @@ jQuery( function($) {
 	 * @return {boolean} Always returns false to prevent the default behavior.
 	 */
 	$('#category-tabs a').on( 'click keyup keydown', function( event ){
-		var t = $(this).attr('href');
+		var t = $(this).attr( 'aria-controls' );
 		if ( event.type === 'keydown' && event.key === ' ' ) {
 			event.preventDefault();
 		}
@@ -30,8 +30,8 @@ jQuery( function($) {
 			$(this).attr( 'aria-selected', 'true' ).removeAttr( 'tabindex' );
 			$(this).parent().addClass('tabs').siblings('li').removeClass('tabs');
 			$('.tabs-panel').hide();
-			$(t).show();
-			if ( '#categories-all' == t ) {
+			$( '#' + t ).show();
+			if ( 'categories-all' === t ) {
 				deleteUserSetting('cats');
 			} else {
 				setUserSetting('cats','pop');

From 2a1c94330c971cff1d64f55d8af0f1dd6c1ce4e3 Mon Sep 17 00:00:00 2001
From: Sainath Poojary <spoojary614@gmail.com>
Date: Tue, 21 Jul 2026 20:31:09 +0530
Subject: [PATCH 2/2] fix: Use document.getElementById()

---
 src/js/_enqueues/admin/link.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/js/_enqueues/admin/link.js b/src/js/_enqueues/admin/link.js
index dae086f846873..fcd9e7581af13 100644
--- a/src/js/_enqueues/admin/link.js
+++ b/src/js/_enqueues/admin/link.js
@@ -30,7 +30,7 @@ jQuery( function($) {
 			$(this).attr( 'aria-selected', 'true' ).removeAttr( 'tabindex' );
 			$(this).parent().addClass('tabs').siblings('li').removeClass('tabs');
 			$('.tabs-panel').hide();
-			$( '#' + t ).show();
+			$( document.getElementById( t ) ).show();
 			if ( 'categories-all' === t ) {
 				deleteUserSetting('cats');
 			} else {