- Affected version
- 2.3.2
In
XF.Filter._filterAjaxResponse
HTML fetched via ajax is processed using XF.createElementFromString(result.html.content.trim())
. Since this isn't using XF.setupHtmlInsert
, any css or javascript which is passed to the _filterAjaxResponse
will be ignored.