Hi Jeff - good post - I think that you will find there are a lot of Plugins and Themes that will need to be patched for this XSS vulnerability because it was in the codex.

In our case the day WP 4.2.1 update was released we tested all 19 plugins we maintain on wordpress.org and found the vulnerability in 6 of them - that is just under 30% - they where updated that day.

With our Premium plugins on a3rev.com that ratio dropped down to 12% - still significant .

The XSS was unknown before this WP 4.2.1 - it could not be detected with any of the stock standard hacking tools - so up to now it has been a minimal risk (slightly above 0 ). Now that it is a know vulnerability the risk factor is a multiple of:

The # of devs who don't test and patch their plugins / themes
X
the # of users who don't run updates.