Does WordPress apply any kind of data sanitization for its post content when saving it from admin area? (like stripping
<script> tags) Or all it does is checks for some user capability (like
I'm asking, because I'm making widget plugin:
- It allows to add or edit HTML content which will be later shown of frontend .
- It can be edited by site administrator or editor.
- HTML content can have any structure, can contain script tags and can contain any attributes. So doing wp_kses isn't an option.
My question is, how safe is it do this without any kind of sanitization? (besides checking for current_user_can).