XSS Game: What Cross-Site Scripting Teaches WordPress Developers About Web Security
Treat every WordPress value as hostile until it is escaped for the exact place it appears. That is the big lesson XSS Game teaches, and it fits WordPress development painfully well. Cross-site scripting is not a rare edge case. It is what happens when a comment, setting, URL parameter, shortcode attribute, block field, or REST response gets printed into the page with too much trust. Read more