If you find untrusted script tags or suspicious inline JavaScript in stored options or content that you did not place intentionally, treat it as compromise and follow the incident response steps below.

Indicators of compromise (IoCs)

Look for the following signs:

• Unexpected redirects from your site to unknown domains.
• Hidden or injected iframes, script tags, or on-event attributes in pages or admin screens.
• Unauthorized changes to plugin settings that you didn’t make.
• New admin users or login events from unknown IPs around the time of changes.
• Outbound HTTP requests from the browser to unknown third-party domains when viewing site pages.
• Alerts from external scanners detecting JavaScript-based SEO spam.

Check server and application logs for unusual POST requests to plugin settings pages or options saving endpoints (e.g., admin-post.php, options.php, or plugin-specific admin pages). Also examine the timing of admin actions in the WordPress audit logs (if available).

Immediate containment & mitigation steps

If you discover suspicious stored scripts or believe you’re affected, act quickly:

1. Temporarily restrict access
   • Restrict admin dashboard access to a small set of IP addresses if possible (via host firewall or server ACLs).
   • Rotate administrator passwords and invalidate active sessions for all users:
     • In wp-admin: Users → All Users → Edit each Admin → Change password
     • Or use WP-CLI to force logout by altering authentication tokens:

       wp user session destroy 

   • Revoke or rotate API keys and credentials used by the site.
2. Take the site to maintenance mode (if necessary)
   • Prevent visitors from being served malicious scripts while you investigate.
3. Clean stored payloads
   • Remove suspicious script tags from wp_options, posts, postmeta or plugin tables. Prefer manual review to avoid deleting legitimate data.
   • Example SQL to view and then remove tags (test first, and backup DB first):

     SELECT option_name, option_value FROM wp_options WHERE option_value LIKE '%

     To remove script tags safely you may use application logic; direct SQL replace is risky.

   • Use WP-CLI to search-and-remove suspicious content if you have a tested workflow and backups.
4. Disable the vulnerable plugin
   • If an update/fix is not available, deactivate and remove the plugin until a secure version is released.
   • Command:

     wp plugin deactivate wmf-mobile-redirector

5. Scan & audit
   • Run a full site scan for malware and additional injected content.
   • Check themes, mu-plugins, and uploads directories for unexpected files.
   • Review user accounts and capabilities for unauthorized additions.
6. Restore from a known-good backup (if available)
   • If you have clean backups from before the compromise and the timeline of the malicious change is clear, restoring may be the safest route. Ensure credentials and any vulnerable plugins are patched before bringing the restored site online.