Currently, I am working on a CMS/Framework I developed that is similar to Wordpress, in that it is a platform for admins to create/post content for users.
I am saving the HTML that is generated by editor fields in my database, and binding the HTML within my JSON response in the client to be displayed once it is retrieved. However, often times, a lot of sanitization is done in order to display the HTML to protect against XSS attacks. Which I definitely understand why.
However, in this case where the site administrator is generating the content. As long as the administrators takes other good security actions (Such as securing their accounts with strong passwords, and securing their servers), and are not malicious themselves, it could be safe to say that the HTML is trusted, and should not be considered vulnerable to XSS correct? I am going to write documentation on the framework soon, and would like to bring up any of the caveats the framework may have, so that developers are aware.
Any advice would be appreciated. Or if there are any other major security holes I should look out for, please let me know.