WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Date Block

Description

Gutenberg does not escape a block attribute before outputting it in an HTML attribute context, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against anyone viewing the affected post. The affected block ships both in the Gutenberg plugin and, bundled, in WordPress core.