Today, when I did some tests and found out that Wordpress doesn't filter the post_title.
Respectively, I make posts with the titles:
<?php while ( have_posts() ) : the_post(); echo 'Post Title'; endwhile;?>
<a href="http://stackexchange.com/">Post Title</a>
I. With the first post, Wordpress puts entire title in html comment tag:
<!--?php while ( have_posts() ) : the_post(); echo 'Post Title'; endwhile;?-->. Then no title shows up for this post.
II. The second, Wordpress return a title linked to http://stackexchange.com/.
III. The worst thing is the third one. A pop-up window with "Post Title" message appears three times. It's weird! What is Wordpress executing?
I made this test with Wordpress 4.2.2 on Twentyfiteen theme. I don't know much about security.
Does this bug(s) can be exploited and How do I filter it?