From ce9ccee8853c77d82fa5210cff8c794a95486ed8 Mon Sep 17 00:00:00 2001
From: Sainath Poojary <spoojary614@gmail.com>
Date: Wed, 22 Jul 2026 18:53:57 +0530
Subject: [PATCH] Security: Harden taxonomy tab handler in post.js

---
 src/js/_enqueues/admin/post.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/js/_enqueues/admin/post.js b/src/js/_enqueues/admin/post.js
index 445e79d8a6f05..fbd4776d01e90 100644
--- a/src/js/_enqueues/admin/post.js
+++ b/src/js/_enqueues/admin/post.js
@@ -567,7 +567,7 @@ jQuery( function($) {
 
 		// @todo Move to jQuery 1.3+, support for multiple hierarchical taxonomies, see wp-lists.js.
 		$('a', '#' + taxonomy + '-tabs').on( 'click keyup keydown', function( event ) {
-			var t = $(this).attr('href');
+			var t = $(this).attr( 'aria-controls' );
 			if ( event.type === 'keydown' && event.key === ' ' ) {
 				event.preventDefault();
 			}
@@ -577,8 +577,8 @@ jQuery( function($) {
 				$(this).attr( 'aria-selected', 'true' ).removeAttr( 'tabindex' );
 				$(this).parent().addClass('tabs').siblings('li').removeClass('tabs');
 				$('#' + taxonomy + '-tabs').siblings('.tabs-panel').hide();
-				$(t).show();
-				if ( '#' + taxonomy + '-all' == t ) {
+				$( document.getElementById( t || '' ) ).show();
+				if ( taxonomy + '-all' === t ) {
 					deleteUserSetting( settingName );
 				} else {
 					setUserSetting( settingName, 'pop' );