blog.sucuri.net/2015/08/persistent-xss-vulnerability-in-wordpress-explained.html
core.trac.wordpress.org/changeset/33549