Ticket #34831: 34831.2.diff

wp-includes/js/wp-embed.js

@@ -22 +22 @@
                         return;
                 }
 
+                if ( /[^a-zA-Z0-9]/.test( data.secret ) ) {
+                        return;
+                }
+
                 var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
                         blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
                         i, source, height, sourceURL, targetURL;