In reply to Phil Johnston.

Not all output needs to be escaped, but most should be. Even WordPress doesn’t escape all output.

Wordfence itself is claiming that the issue being referenced requires an authenticated attacker that has Administrator-level privileges, so the rendered content could not somehow come from a non-admin user. We checked into the claim and found that it does require that level of access.