Tag Info

New answers tagged


Jetpack doesn't really sanitize CSS, it just cleans it up, which has the side-effect of removing some vulnerabilities, but not all. An attacker can still use @import to import unsanitized CSS; expression() to introduce XSS to older IE browsers; @charset to trick the browser into interpreting the CSS as HTML, opening up XSS opportunities; set URLs with ...

Top 50 recent answers are included