Title: Javascript can be saved in the post title
Last modified: February 12, 2022

---

# Javascript can be saved in the post title

 *  Resolved [AlanP57](https://wordpress.org/support/users/alanp57/)
 * (@alanp57)
 * [4 years, 5 months ago](https://wordpress.org/support/topic/javascript-can-be-saved-in-the-post-title/)
 * I’m testing for cross-site scripting vulnerabilities in WordPress 5.9 and found
   that a line of Javascript code typed into the post title gets saved to the database
   and executed when the post is displayed. Shouldn’t the post title be sanitized?

Viewing 1 replies (of 1 total)

 *  Moderator [Samuel Wood (Otto)](https://wordpress.org/support/users/otto42/)
 * (@otto42)
 * WordPress.org Admin
 * [4 years, 5 months ago](https://wordpress.org/support/topic/javascript-can-be-saved-in-the-post-title/#post-15359126)
 * [@alanp57](https://wordpress.org/support/users/alanp57/) Hello!
 * In WordPress, users with the Administrator or Editor role can post unfiltered
   HTML, including Javascript code, in many places. This includes post titles, post
   content, and even comment fields. This is not new to WordPress 5.9.
 * You can find more information about this here: [https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-some-users-allowed-to-post-unfiltered-html](https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-some-users-allowed-to-post-unfiltered-html)

Viewing 1 replies (of 1 total)

The topic ‘Javascript can be saved in the post title’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 1 reply
 * 3 participants
 * Last reply from: [Samuel Wood (Otto)](https://wordpress.org/support/users/otto42/)
 * Last activity: [4 years, 5 months ago](https://wordpress.org/support/topic/javascript-can-be-saved-in-the-post-title/#post-15359126)
 * Status: resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics