Titles containing JavaScript execute the JavaScript - XSS risk

[dbvista]

I created a post with this title:

<script lang="javascript">alert('hacked');</script>

When the article rendered, the alert box rendered too. This means WordPress is vulnerable to JavaScript-based attacks such as cross-site scripting (XSS).

[dbvista]

Here's another great title:

<script language="javascript">document.location='​http://www.you-are-hacked.com';</script>

which directs the browser to a malicious site.

[rianjs]

Working example:

Direct link to post:
​http://rianjs.net/2011/10/alertfoo

Homepage with the post on it:
​http://rianjs.net

Both trigger the JS.

[ryan]

Administrators and Editors have the unfiltered_html capability and are allowed to do this.

[dbvista]

Thanks. I re-tried this as an Author and the JavaScript did not execute.