Cross-Site Scripting: The Most Common WordPress Plugin Flaw
XSS shows up in plugin vulnerability disclosures more than any other bug class. Here's what stored and reflected XSS actually do, why an admin's browser is the real prize, and how proper escaping closes the door.