Use a malware scanner to search for suspicious JS payloads and unusual modifications to theme/plugin files.

4. Contain exposure and harden

• Force-logout active administrative sessions (rotate sessions).
• Change admin and editor passwords and enforce strong MFA for privileged accounts.
• Review active user accounts for suspicious or newly-created contributor accounts.
• Check server access logs for unexpected POST/PUT requests or unusual admin-area access patterns.

5. Forensic cleanup if you find compromise

• If you find injected scripts or webshells, quarantine the site: take it offline or show a maintenance page while you clean.
• Restore from a known-good backup made before the infection date if available.
• If no suitable backup exists, clean the affected posts by removing the injected payloads manually or with controlled scripts.
• Re-scan after cleanup to ensure no lingering backdoors or secondary payloads remain.

Developer guidance — fixing the code correctly

If you are the plugin author or a developer working on similar shortcode implementations, follow these principles.

1. Sanitize inputs on write

When accepting attributes from untrusted users, sanitize them when storing and re-validate before use.

// For text attributes with no HTML allowed
$attr_value = isset($atts['my_attr']) ? sanitize_text_field($atts['my_attr']) : '';

// For attributes that allow a small subset of HTML
$allowed = array(
    'a' => array('href'=>true, 'title'=>true, 'rel'=>true),
    'br' => array(),
    'em' => array(),
    'strong' => array(),
);
$attr_value = wp_kses( $atts['html_attr'] ?? '', $allowed );

2. Escape output on render

Always escape values right before output. Use the appropriate escaping for the context:

• Attributes: esc_attr()
• HTML content that is allowed: wp_kses_post() or wp_kses()
• Full HTML output: echo wp_kses_post( $content );

Example shortcode handler pattern (note the escaped PHP opening tag for safe display):

 '',
        'description' => '',
    ), $atts, 'magic_conversation' );

    $title = sanitize_text_field( $atts['title'] );
    $description = wp_kses( $atts['description'], array('br'=>array(),'em'=>array(),'strong'=>array()) );

    ob_start();
    ?>
    

        

        

    
    

# Block obvious script tags in POST bodies (tune to your environment)
SecRule REQUEST_METHOD "POST" "chain,deny,status:403,msg:'Blocked possible stored XSS (script tag in POST)',id:1001001"
  SecRule ARGS|ARGS_NAMES|REQUEST_BODY "(?i)<\s*script\b" "t:none,t:urlDecode,t:lowercase"

SecRule REQUEST_BODY "(?i)on(error|load|mouseover|click)\s*=" "t:none,deny,msg:'Blocked possible XSS event handler in input',id:1001002"

SecRule ARGS "(?i)javascript\s*:" "t:none,deny,msg:'Blocked javascript: URI in input',id:1001003"