Menu item titles allow arbitrary HTML and script tags

[foobuilder]

WordPress allows menu titles to contain arbitrary HTML and script tags. It looks like the titles are not sanitized to remove unsafe HTML when saved, and then not escaped on output. Screenshots attached.

[danieltj]

This is by design. On single sites, admins and editors have the capability to post unfiltered HTML in various places within the WordPress dashboard (including comment replies etc). In multi-sites, only super admins can post unfiltered HTML. Here is a link to ​the Codex about the capability.

Thanks for reporting this though. In future, any potential security reports should be ​posted to HackerOne.

[swissspidy]

See also ​https://make.wordpress.org/core/handbook/contribute/design-decisions/#unfiltered-html-for-editors-administrators-multisite for this and other design decisions.

[foobuilder]

Got it! Thank you both for clarifying. Sorry for the bad ticket.