WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area

WordPress core is vulnerable to Cross-Site Scripting via client-side template overriding in the admin area in all versions up to and including 6.9.1. The `wp.template()` JavaScript function uses `document.getElementById()` to locate templates, which matches any HTML element by ID regardless of element type. WordPress admin templates are intended to be `<script type="text/html" id="tmpl-*">` elements, but `getElementById` also matches `<div>`, `<img>`, and other injected elements. If an attacker can inject a non-script element with a matching `tmpl-*` ID, the template content is overridden with attacker-controlled HTML, which is then compiled by Underscore.js `_.template()` with JavaScript execution support. This is a conditional vulnerability that requires an existing HTML injection vector in the admin context.