When it comes to cross site scripting in WordPress, I think that there’s a lot of education that’s to be had.
I’m by no means an expert in this field, but I think that there’s either a lack of awareness or we take for granted what WordPress does for us.
Generally speaking, WordPress does an excellent job of providing sanitization and validation functions (assuming that we use them correctly), but that doesn’t mean there aren’t potential exploits.
In my latest series on Envato, I give a two part introduction to cross-site scripting in WordPress and practical tips for how we can test our themes and our plugins.