I have been working on providing the security related to the XSS attacks. My website only allows following mime-types: XML, CSV, HTML, PLAIN, VND_WAP_WML, APPLICATION_ZIP, APPLICATION_PDF, ...
I created a Wordpress theme for my client. He told me that he scanned my theme with a vulnerability scanner, and that it has security issues with the GET and windows.location methods. Is this really ...