`$_POST['notes']` should be sanitized with `wp_kses_post()`. See Line 355 the old isset check.