Submission Review Guidelines:

• I have followed the WooCommerce Contributing Guidelines and the WordPress Coding Standards.
• I have checked to ensure there aren't other open Pull Requests for the same update/change.
• I have reviewed my code for security best practices.
• Following the above guidelines will result in quick merges and clear and detailed feedback when appropriate.

Changes proposed in this Pull Request:

Extends the stored XSS fix from #63616 (which covers REST API v1/v2/v3) to the v4 REST API.

Adds wp_kses_post() sanitization to the note content in the v4 OrderNotes\Controller::create_item() method before passing it to add_order_note(). This strips dangerous tags like <script> while preserving safe HTML.

Note: Unlike the v1 fix which uses sanitize_callback in route args via array_merge, the v4 fix sanitizes directly in create_item(). This is because v4's schema-driven architecture doesn't use array_merge to override endpoint args, and WordPress core's rest_get_endpoint_args_for_schema() hardcodes sanitize_callback to rest_sanitize_request_arg — ignoring any sanitize_callback set in the schema. Sanitizing at the point of use is cleaner for v4 and provides defense in depth.

Also adds a unit test verifying the sanitization behavior.

Screenshots or screen recordings:

N/A

How to test the changes in this Pull Request:

1. Create an order via the WooCommerce admin.
2. Use the v4 REST API to add an order note containing a <script> tag:

   POST /wp-json/wc/v4/order-notes?order_id=<ORDER_ID>
   { "note": "<script>alert('xss')</script>Safe content<b>bold</b>" }
   

3. Verify the response note field does not contain <script> tags.
4. Verify safe HTML like <b>bold</b> is preserved.
5. View the order in the admin and confirm no script injection occurs.

Testing that has already taken place:

• Unit test test_create_item_sanitizes_note_content verifies XSS payloads are stripped and safe HTML is preserved.
• Full v4 OrderNotes test suite passes (17 tests, 55 assertions).

Milestone

• Automatically assign milestone for the next WooCommerce version

Note: Check the box above to have the milestone automatically assigned when merged.
Alternatively (e.g. for point releases), manually assign the appropriate milestone.

Changelog entry

• Automatically create a changelog entry from the details below.

• This Pull Request does not require a changelog entry. (Comment required below)