WordPress (5.9-5.9.1) / Gutenberg (9.8.0-12.7.1) - Contributor+ Stored Cross-Site Scripting

Post authors are able to bypass KSES restrictions in WordPress >= 5.9 (and or Gutenberg >= 9.8.0) due to the order filters are executed, which could allow them to perform to Stored Cross-Site Scripting attacks

As a user without the UNFILTERED_HTML capability, create a post containing the following content:

{"version":"u003cimg src=404 onerror=alert(document.location)u003e","isGlobalStylesUserThemeJSON":"foobar"}