Burn all blogs wordpress has a critical xss flaw