Authenticated Cross-site Scripting in Template Name

Explanation During my research on latest WordPress I found that `$file_description` and `$description` from `wp-admin/theme-editor.php` are not filtering name of the template allowing attacker to do XSS attack.

...
		$file_description = get_file_description( $filename );

		if ( $filename !== basename( $absolute_filename ) || $file_description !== $filename ) {
			$file_description .= '<br /><span class="nonessential">(' . $filename . ')</span>';

		}

		if ( $absolute_filename === $file ) { …