Advance full admin takeover from v1.1 to v1.12

Batches everything built since the 1.0 WP.org submission reset: Login
Redirect, the Tools/Export/Import screen takeovers, Modules rebuilt as
an addon marketplace, Menu Creator's reorder fix, Activity Log
redesigned into a filterable table with Admin/User tabs, dark-theme
fixes for Site Health/Personal Data/Updates, and an opt-in Disable
Gutenberg toggle. Continues the "nothing stays native" takeover goal
and closes gaps found via live testing and the WordPress Plugin Check
tool. See CHANGELOG.md for the full per-version breakdown (1.1-1.12).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

app/src/shell/components/SearchModal.vue

@@ -16,6 +16,18 @@ const highlighted = ref(0);
 let debounceTimer;
 let requestSeq = 0;
 
+// wp/v2/search returns titles with HTML entities (e.g. "Ben & Jerry").
+// Decode them for display WITHOUT rendering markup: a <textarea>'s innerHTML
+// is RCDATA, so tags stay literal text and only entities are decoded — then
+// we read them back as a plain string and render with text interpolation.
+// This replaces a v-html bind on item.title, which would have executed any
+// HTML an unfiltered_html user put in a post title (admin→admin XSS).
+const decodeEntities = (str) => {
+  const el = document.createElement('textarea');
+  el.innerHTML = String(str ?? '');
+  return el.value;
+};
+
 const search = async () => {
   const q = query.value.trim();
   if (q.length < 2) {
@@ -121,7 +133,7 @@ onUnmounted(() => document.removeEventListener('keydown', onKeydown));
               @mouseenter="highlighted = i"
               @click="openResult(item)"
             >
-              <span class="smodal__result-title" v-html="item.title" />
+              <span class="smodal__result-title">{{ decodeEntities(item.title) }}</span>
               <span class="smodal__result-type">{{ item.subtype }}</span>
             </button>
           </li>