Wow, I learnt a lot from Rick's comments. I appreciate the honesty he has with sharing his experience with us. With due respect to some well-known bloggers, I reckon it might have come as piecemeal-dripfeed posts on an 'established' blog. Yet his comments are detailed and candid enough to make anyone sit up and say 'There is more I need to learn in this big bad (real) world and how can I actually mitigate against these potential threats instead of just relying on good luck and low traffic numbers. Thanks Rick. And thanks also to Jeffro for highlighting this critical XSS issue on his blog, as well as the Sucuri + WP Security Team for fixing this problem.