Pings/Trackbacks: In `wp_xmlrpc_server::pingback_ping()`, strip inline JS and CSS while trying to figure out the pingback context.

Props david.binda.
Fixes #47283.
Built from https://develop.svn.wordpress.org/trunk@45823


git-svn-id: http://core.svn.wordpress.org/trunk@45634 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-includes/class-wp-xmlrpc-server.php

@@ -6880,7 +6880,10 @@ class wp_xmlrpc_server extends IXR_Server {
 			return $this->pingback_error( 32, __( 'We cannot find a title on that page.' ) );
 		}
 
-		$remote_source = strip_tags( $remote_source, '<a>' ); // just keep the tag we need
+		// Remove all script and style tags including their content.
+		$remote_source = preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $remote_source );
+		// Just keep the tag we need.
+		$remote_source = strip_tags( $remote_source, '<a>' );
 
 		$p = explode( "\n\n", $remote_source );
 

wp-includes/version.php

@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-alpha-45822';
+$wp_version = '5.3-alpha-45823';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.