From quick look at the code the post data mostly goes straight into wp_insert_post(), which is a low level function and serves to just store whatever you give it.
If you want to enforce the check you could make use of wp_import_post_data_raw filter and probably wp_kses_post().
Related Posts:
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
- Why does the URL http://a/%%30%30 crash Google Chrome?
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
- How to view PHP on live site
- Can an attacker use inspect element harmfully?
- Hide the fact a site is using WordPress?
- Verifying that I have fully removed a WordPress hack?
- WordPress 4.7.1 REST API still exposing users
- Can I Prevent Enumeration of Usernames?
- Should I escape wordpress functions like the_title, the_excerpt, the_content
- Should I remove install.php and install-helper.php?
- When to use esc_html and when to use sanitize_text_field?
- Are Nonces Useless?
- What is the difference between esc_html filter vs attribute_escape filter?
- Will there be security updates for 3.1 once 3.2 is released?
- How do I technically prove that WordPress is secure?
- WordPress it’s cleaning a custom query_var to avoid sql injections?
- How do WordPress Nonces Work?
- Tips for finding SPAM links injected into the_content
- Close a wordpress blog – keep site as it is but prevent hacks
- Is WordPress vulnerable to the httpoxy?
- How can I easily verify a core or plugin update has not broken anything?
- Vanilla WordPress install, what can/should I put in disable_functions?
- wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
- WordPress and Security
- Secure my “add_settings_field” translation?
- Is there a security risk giving someone temporary access to my blog’s code?
- How to properly sanitize/secure a WP Query coming from the front end
- WordPress Logout Only If User Click Logout or If User Delete Browser History
- brute force attack even though it is limited by IP
- How brute-forcer knows that the password is cracked for target username?
- wp_insert_post disable HTML filter
- Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
- Completely remove the author url
- Restricting access to content
- About WordPress site security
- Relative security of different releases of WordPress
- Is there any point setting the keys and salts in wp-config.php?
- Where to store OAuth 2.0 client id and secret?
- How can I safely use $_SERVER[‘REQUEST_URI’] to avoid XSS?
- Using HTACCESS for Secret Access
- Definitive wordpress directory ownership and permissions on linux
- Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
- Changing Table Prefixes – once done, am I good to go going forward?
- wordpress website host price and security [closed]
- Are there security risks in working directly in the themes folder that builds into a theme folder?
- Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
- Secure WordPress: Change admin
- Changing the default header name
- how much information can we hide when using wordpress cms?
- Is it safe to use a global wp nonce per user instead of a nonce per action?
- Wordfence detects change in wp-admin/includes/upgrade.php
- Basic password protection without using users and roles
- System setting changed by system user
- Does meta-data need to be sanitized?
- Will there be security updates for WordPress 4.9.9
- Any known bugs that could cause disappearance of the wp_users table?
- On new server, site got hacked, permissions a bit strange? Please help
- 404/500 error on content images if Referer header is from another domain [closed]
- Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
- Restrict Access without Creating Users
- Switching between security plugins is a risk?
- How to obfuscate wp-config.php or code
- Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
- How to prevent to direct access of my custom plugin folder/files
- Checking for origin of a xmlrpc request
- wordpress admin security
- Why do people use “admin” username by default? [closed]
- Are major WordPress updates mandatory for security?
- i moved wp-config.php outside of public html and this broke my website
- Is it safe to use the basic administration with reduced rights for private member space
- WordPress Database Re-installed (Hacked)
- Verifying that I have fully removed a WordPress hack?
- WordPress Security tools
- Robots.txt file not updating
- How can I stop other plugins from using my class’ sensitive methods?
- wordpress security (only one part of the site)
- What are WordPress Current Security Issues in 2017?
- wp-config.php moved above root results in no plugin updates
- Password-protect feed and make it usable in major aggregators
- Folder Permissions + Security Concerns
- Malware/Permission bug removal?
- Could a user account with a stolen password compromised entire WP site?
- how to find the way they hacked my WP site
- is this code properly secured
- Run a security scan on WordPress site that has .htaccess password [closed]
- nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]
- How to get real password (before encrypt) when register a user?
- Directory to store secure file
- checking the form submit in right order
- How can I give someone server access to only duplicate and modify a site?
- Our security auditor is an idiot. How do I give him the information he wants?
- I am under DDoS. What can I do?
- How can I implement ansible with per-host passwords, securely?
- Why should I firewall servers?
- How do I protect my company from my IT guy? [closed]
- Does changing default port number actually increase security? [closed]
- Can you alter the default wordpress strong password requirements?
- WordPress – tracking options
- how to sanitizing $_POST with the correct way?