Ajax: Mitigate possible XSS vulnerability

Proposed by @jaubourg

Cherry-picked from b078a62013
Fixes gh-2432
Closes gh-2588

src/ajax/script.js

@@ -4,6 +4,13 @@ define( [
 	"../ajax"
 ], function( jQuery, document ) {
 
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
+jQuery.ajaxPrefilter( function( s ) {
+    if ( s.crossDomain ) {
+        s.contents.script = false;
+    }
+} );
+
 // Install script dataType
 jQuery.ajaxSetup( {
 	accepts: {