WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.
Sign up to join this community
WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor.
I try add reply for first post "Hello World":
<script>alert('XSS')</script><script><</script>
and get popup window
.
Is it porential security risk or can no care? Thanks for advance..
The answer is in your question.
I try this when login as admin and editor.
The roles have the unfiltered_html capability that allows them to put whatever HTML they choose, including <script> tags, where ever they choose.
Is is a security risk? Only if you give folks you don't trust admin and/or editor roles. Or someone gains access to your an admin/editor account. Or there's another security hole somewhere in the core that allows privilege escalation from a lower to higher user level (unlikely).
By itself, it's not a security risk. Admin and editors need to be able to do things to actually manage the site.
