Reflected XSS vulnerability in a WordPress theme

Hello guys,

Firstly, great job with the whole WordPress business and keeping an active and thriving community – you have my genuine appreciation and gratitude.

I just want to ask the theme/plugin reviewers if they could do some basic pentesting on 3rd party services before adding them on WordPress.org. I happened to find a reflected XSS vulnerability on a theme I found on the themes folder on WordPress.org, and I got a bit worried. I’d rather not name the theme, and I did fill a report on their website which they kindly addressed timely.

My point is that I’d sleep a lot better if I knew the services were filtered through some basic penetration testing before being published on the main website.

Other than this, many thanks for keeping this CMS active and up to date!

Cheers