In reply to David Anderson.

If I understand the issue correctly it was that output wasn’t escaped. That means if the rendered content somehow came from a non-admin user (like a comment on a post), when a non hacker admin logs in and sees that rendered content, it could allow that unescaped output to contain code, which could then use the credentials of the logged in admin without their knowledge. So it likely didn’t need to be a hacker with admin access. That’s typical of unescaped content. I haven’t deeply checked out this issue, but that’s why all output must be escaped.