Stored XSS via unsafe preg_replace() replacements in WordPress Image lightbox and Playlist blocks

The Image block's lightbox renderer and the Playlist block inserted markup with preg_replace() and used block-derived HTML as the replacement string, so $0, \0 or $1 sequences in a user-authored image tag or playlist waveform setting were expanded into a copy of the tag's own markup. That breaks the attribute quoting and lets a Contributor turn... Weiterlesen: Stored XSS via unsafe preg_replace() replacements in WordPress Image …