A Finnish researcher has disclosed details on an unpatched stored cross-site scripting vulnerability in the WordPress core engine.