Malicious script allowed in attachment Title, Caption and Description

[dglingren]

If you enter Javascript in the Title, Alternate Text, Caption and/or Description fields of an attachment the Edit Media and Media Library screens will properly escape and didplay it. However, the Gallery shortcode and the display page reached from the attachment's permalink do not escape these values and the script is executed.

For example, enter this in the Title field:

Title"<script>alert('Title');</script>

The double-quote terminates the text field and the script is executed.

[nacin]

When creating this ticket, this appeared at the top of the form:

Do not report potential security vulnerabilities here. Read the ​Security FAQ and email us at security@….

This does not appear to be a security vulnerability. See: ​http://codex.wordpress.org/FAQ_Security#Why_are_some_users_allowed_to_post_unfiltered_HTML.3F.

You are welcome to email us if there's more here.

[TobiasBg]

Note: This lead to the discovery of #22135.