We are not exposing any vulnerabilities that did not exist before the TinyMCE upgrade. It doesn't make sense to limit just what users input thorough TinyMCE given that they can enter anything in other components, and import anything via XML.