Created ticket #22861 on Core Trac:
Wordpress 3.5 - Cross Site Scripting Vulnerability