Disable JavaScript in Comments

[Kuzmanov]

I think the ticket name says everything. Shouldn't JavaScript be disabled in comments?

[duck_]

What do you mean?

Are you saying you're able to put <script> tags in comments? If so are you writing said comment as an admin or editor user (someone with the unfiltered_html capability)?

[Kuzmanov]

Only when I'm logged in as an admin. As I see no one can put <script> in comments in WordPress 3.1.2, that's why I'm reporting this. It's not 'very' safe when someone can use <script> in the comments, even it's an admin user.

[ocean90]

To disallow unfiltered HTML for all users, you can add this to wp-config.php:

define( 'DISALLOW_UNFILTERED_HTML', true );

From ​wpdevel post by Nacin.