Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies").

Wordpress filters <img> tags by default (except for the admin).

Will my Wordpress site be vulnerable to Cross-Site Scripting (XSS) if I allow img HTML tags in my comment section?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Many evil things can be done by including an image. The question is how well WordPress filters them. To give you an idea:

share|improve this answer
    
Does Wordpress have any special way of filtering them? –  janoChen May 23 '11 at 10:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.