v1.7.2
- Security (medium): stored cross-site scripting in the cookie consent content blocker. A post author or contributor could write blocker markup that, once a visitor unblocked it, loaded a javascript: address or an iframe with srcdoc or event handlers. The restore script now accepts only http and https addresses and a fixed list of iframe attributes.