The truly scary thing is that according to https://wordpress.org/about/stats/ more than 50% of WordPress sites are on 3.6 or older. There is no automatic update to patch the security issue for those sites.

That means more than 50% of the WordPress sites out there are vulnerable to people dropping appropriately formatted JavaScript in a comment. Drop a comment and redirect all users loading that page to a different website.

It just goes so show that automatic updates for security releases are truly great! Well done to the devs that got that into core! But there's still a lot of vulnerable websites out there. :(