WordPress 2.6.2 Bug: TinyMCE Allows Injection of Phantom Save Tags
Long story short, a bug has surfaced in WordPress 2.6.2. It allows for the injection of the following code (or stuff similar to it): <p><span style=“padding: 1px 4px; position: absolute; z-index: 10000; cursor: pointer; left: 395px; top: 745px; color: #000000;”>save</span></p> The above string does not appear in HTML view. The only options I can come […]