How to protect against XSS in WordPress