Stored Cross-Site Scripting in WordPress Emoji Loader Settings

The emoji loader read its configuration from an element resolved with document.getElementById( 'wp-emoji-settings' ). Post content authored by a Contributor-level user can inject an element with that id (DOM clobbering), so the loader parses attacker-controlled JSON, including the script URLs it subsequently loads. This lets a Contributor execute...