Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?

Question

I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies").

Wordpress filters <img> tags by default (except for the admin).

Will my Wordpress site be vulnerable to Cross-Site Scripting (XSS) if I allow img HTML tags in my comment section?

Answer 1

Many evil things can be done by including an image. The question is how well WordPress filters them. To give you an idea:

• File names should be checked properly.
• The actual image data can contain javascript.
• Also, EXIF data could contain javascript.