WPC Order Notes for WooCommerce - Reflected cross-site scripting (XSS)

 410 | wp_die();
 411 | }
 412 |
 413 | function ajax_update_order_note() {
 414 | $comment = [
 415 | 'comment_ID' => sanitize_text_field( $_POST['note_id'] ),
 416 | 'comment_content' => sanitize_text_field( $_POST['note_content'] )
 417 | ];
 418 | wp_update_comment( $comment );
 419 |
> 420 |    echo $_POST['note_content'];
  421 |    wp_die();
  422 |   }
  423 |
  424 |   function ajax_add_order_note() {
  425 |    $ids              = explode( '.', $_POST['ids'] );
  426 |    $note_type        = wc_clean( wp_unslash( $_POST['note_type'] ) );
  427 |    $is_customer_note = ( 'customer' === $note_type ) ? 1 : 0;
  428 |
  429 |    foreach ( $ids as $id ) {
  430 |     $order = wc_get_order( $id );
      ^ Col 0