Tag Info

Hot answers tagged


Jetpack doesn't really sanitize CSS, it just cleans it up, which has the side-effect of removing some vulnerabilities, but not all. An attacker can still use @import to import unsanitized CSS; expression() to introduce XSS to older IE browsers; @charset to trick the browser into interpreting the CSS as HTML, opening up XSS opportunities; set URLs with ...

Only top voted, non community-wiki answers of a minimum length are eligible