A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a ...