WordPress Core is vulnerable to Stored Cross-Site Scripting via the custom header 'header_image_data' theme mod in various versions up to, and including, 7.1 due to insufficient sanitization of the header image width/height/URL values and an unescaped style attribute in the custom-header admin screen. get_custom_header() returned width/height without integer casting and Custom_Image_Header::step_1() echoed the style string without escaping. This makes it possible for authenticated attackers with edit_theme_options capability to inject web scripts; primarily relevant on Multisite where site administrators lack unfiltered_html.