WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor.

I try add reply for first post "Hello World":


and get popup window

enter image description here.

Is it porential security risk or can no care? Thanks for advance..

share|improve this question
up vote 6 down vote accepted

The answer is in your question.

I try this when login as admin and editor.

The roles have the unfiltered_html capability that allows them to put whatever HTML they choose, including <script> tags, where ever they choose.

Is is a security risk? Only if you give folks you don't trust admin and/or editor roles. Or someone gains access to your an admin/editor account. Or there's another security hole somewhere in the core that allows privilege escalation from a lower to higher user level (unlikely).

By itself, it's not a security risk. Admin and editors need to be able to do things to actually manage the site.

share|improve this answer
Okay, thank you very much! I accidentally added the line and a little scared when I saw the result :) – user15194 Jan 1 '13 at 9:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.