Large-site Quick Edit reparses a Contributor display name into active HTML

On sites with more than 10,000 users, a Contributor can save entity-encoded HTML in their display name. When an administrator opens the attacker's crafted Posts-page URL and clicks **Quick Edit** on the Contributor's pending post, WordPress decodes the stored name with `.text()` and reparses it …

name: wp-quick-edit-large-site-lab

services:
  db:
    image: mysql:8.4
    environment:
      MYSQL_DATABASE: wordpress_quick_edit
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
      MYSQL_ROOT_PASSWORD: root
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", …