In reply to Sybre Waaijer.

That’s not relevant to XSS reports, though, which some security vendors produce a lot of. All administrators in WP can produce unfiltered content by design in posts and pages. So, reports about administrators being able to carry out XSS attacks against themselves in other ways have no value.