No, they aren't happening. Everybody is sanitizing all of their user inputs in against all possible vectors and when administrators visit such user generated co

No, they aren't happening. Everybody is sanitizing all of their user inputs in against all possible vectors and when administrators visit such user generated content and their cookies just happen to expire at that moment, they just enter their password into the dialog securely and go about their day. Their password does not grant any sort of elevated privilege to any systems. Stop ruminating on such ridiculous fantasies and occupy your mind with something productive instead.