Oolongeya

The `js output()` function within `http.cookies.Morsel` returns an inline `<script>` snippet that only escapes double quotes for JavaScript string context. It fails to neutralize the `</script>` sequence, which is sensitive to the HTML parser, allowing for potential escaping within the generated script element.

The WooCommerce WordPress plugin does not properly handle batch requests, potentially allowing unauthenticated users to execute administrative actions on non-store REST endpoints. This could enable the creation of arbitrary administrator users through a Cross-Site Request Forgery (CSRF) attack.