I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies").

Wordpress filters <img> tags by default (except for the admin).

Will my Wordpress site be vulnerable to Cross-Site Scripting (XSS) if I allow img HTML tags in my comment section?

| improve this question | | | | |

Many evil things can be done by including an image. The question is how well WordPress filters them. To give you an idea:

| improve this answer | | | | |
  • Does Wordpress have any special way of filtering them? – janoChen May 23 '11 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.