WordPress versions starting from 2.5 to 4.7.4 have the improper handling of post meta data values in the XML-RPC (Remote Procedure Call) API. Discovered and reported by Sam Thomas.
Update WordPress core to the latest possible version (at least 4.7.5)