In wp-admin folder the ajax-actions.php file has some unsanitize data issue.

[smit08]

Path of file: wp-admin/includes/ajax-actions.php

In these files, there are some $_POST used without sanitizing by filter_input. I think this should be solved.

I am adding some code below for some reference.

$post_id = isset( $_POST['post_ID'] ) ? (int) $_POST['post_ID'] : 0;

[smit08]

I have solved the sanitize data in one place by using filter_input. Please review it and if its in proper way then i will change it for whole file.

[sanzeeb3]

I guess casting an integer to post ID does the sanitization itself.

[SergeyBiryukov]

Hi there, welcome back to WordPress Trac! Thanks for the ticket.

I think comment:1 is correct, the (int) casting is enough for sanitization here.