Persistent XSS and CSRF on wordpress 3.9.1

[avinash_thapa]

As you release the new version of wordpress 3.9.1.
It consists of multiple vulnerabilities i.e Persistent XSS and CSRF.
This is present in the comment box.
An attaker can easily put the simple xss vector and able to create the XSS there.
It is a critical Vulenrability as it is stored.

[avinash_thapa]

PoC of the vulnerability

[ocean90]

When creating this ticket, was "Do not report potential security vulnerabilities here. See the Security FAQ and contact security@…." not noticeable? Honest question. If you have JavaScript enabled, you additionally would have needed to click a checkbox affirming "I am not reporting a security issue — report security issues to security@…".

---

Your report is invalid. Please read ​https://codex.wordpress.org/Roles_and_Capabilities#unfiltered_html

[SergeyBiryukov]

​http://codex.wordpress.org/FAQ_Security#Why_are_some_users_allowed_to_post_unfiltered_HTML.3F

[nacin]

([30253] and [30090] were designed to hit #29708.)