WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies").

Wordpress filters <img> tags by default (except for the admin).

Will my Wordpress site be vulnerable to Cross-Site Scripting (XSS) if I allow img HTML tags in my comment section?

share|improve this question
up vote 3 down vote accepted

Many evil things can be done by including an image. The question is how well WordPress filters them. To give you an idea:

share|improve this answer
Does Wordpress have any special way of filtering them? – janoChen May 23 '11 at 10:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.