I noticed that if you are an admin or editor, you are able to put in script code like this in comments (not in the page/post editor) for admin/editor roles:
<script>alert("Danger, Wil Robinson!");</script>
There doesn't seem to be much documentation on this, which is allowed by
unfiltered_html (see the answers here ).
It is only enabled for admin/editor roles; other roles will ignore any scripting commands in comments. But this seems to be a security risk.
What do others think about this possible security risk that allows script commands in comments?
Remember that this question is about comments, and how a malicious script in the comment can affect visitors.
You have just proven that a malicious script in a comment will affect visitors to your site. It may not affect your site, but it will affect any visitor to your site.
Now, it might be useful for some sites to allow scripts in pages/posts. That is not the issue here. The issue is scripts in comments, which can be dangerous to the visitor.
PROOF OF CONCEPT (added)
Look at this page https://cellarweb.com/fstraptest/this-is-a-new-post/#comment-502 . Basic WP, no plugins activated, 2017 theme. Added a new post. Logged out. Opened new browser window (not tab). Loaded site as 'visitor' (no login). Looked at that post. Then commented on the post; saved it. Saw the popup. Redisplayed the post. Saw the popup.
If you go to that link, you will see "Danger Wil Robinson" popup.