A security issue in the wordpress backend.

First of all I’m not even sure if this is the right place to discuss topics like these, nor do I know if this issue has been addressed before or not, but I had to post this ASAP.

if you go to the post edit screen and you change the title to something like: <script>alert( document.cookie )</script> and visit the post, you’ll find that the script gets injected and executed, just like an HTML eval(), the Rich Text Editor has the same problem and this works for both posts and pages.

I have noticed this problem back in version 4.2.2 if I can recall (with some plugins and themes installed), and I tried it today using a Fresh install of 4.3, and they both have the same issues 🙂