If you can put up with the pain a tiny bit longer then you may be able to avoid whitelisting altogether with v1.3.9h. We're working on a more convenient option which may make life simpler for everyone.

In the meantime, if you aren't entering any HTML code or encoded text like & via your admin, you won't need to whitelist anything further. If you *are* entering such content then whitelisting will be needed in the meantime.