Containment: immediate steps (what to do right now)

If the site is affected and an official plugin fix is not immediately available, follow containment steps to reduce risk:

1. Deactivate the plugin (if feasible):
   • Dashboard → Plugins → Deactivate.
   • WP-CLI:

     wp plugin deactivate simple-bible-verse-via-shortcode

   Removing the plugin stops rendering the vulnerable shortcode output.

2. If you need plugin functionality: disable shortcode rendering site-wide temporarily:

   Add this to a small site-specific plugin or the theme’s functions.php as a temporary measure.

3. Restrict Contributor actions:
   • Review and revoke Contributor accounts you do not trust.
   • Temporarily require that only Editors/Authors can publish or add content.
   • WP-CLI example to remove capability:

     wp role remove-cap contributor edit_posts

4. Apply request filtering / WAF rules where available: block inputs that contain script tags, on* attributes, or javascript: URIs in POST bodies or shortcode parameters. Use narrowly targeted rules to avoid false positives.
5. Scan and clean stored payloads: find posts with script-like tokens and remove or sanitize the problematic content (manual review preferred).
6. Rotate credentials and sessions for administrators: force password resets for administrators and potentially impacted users; invalidate admin sessions.
7. Put the site in maintenance mode if you suspect active exploitation while cleaning.

Detection: how attackers might hide and how to uncover stored payloads

Attackers often obfuscate payloads. Use multiple detection techniques:

• Text-based search: search for , javascript:, onerror=, onload=, eval(, document.cookie, or base64-encoded content in post_content, postmeta, and options.
• Structural search: look for shortcodes with attribute values containing angle brackets or attribute names beginning with on.
• Compare revisions: inspect recent revisions made by Contributors to find injected content.
• HTTP logs: review POST requests to wp-admin/post.php, post-new.php, and AJAX endpoints from Contributor accounts around the time of injection.
• Front-end scans: crawl the site with a scanner that evaluates DOM rendering to spot injected scripts that only appear when shortcodes render.
• File integrity: although stored XSS usually resides in the database, check uploads and other file stores for unexpected artifacts.

function safe_bible_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'book'  => '',
        'verse' => '',
    ), $atts, 'simple_bible' );

    // Validate attributes
    $book  = preg_replace('/[^a-zA-Z0-9\- ]/', '', $atts['book']);
    $verse = preg_replace('/[^0-9\-\: ]/', '', $atts['verse']);

    // Build safe output
    $output  = '
';
    $output .= '' . esc_html( $book ) . '';
    $output .= ': ';
    $output .= '' . esc_html( $verse ) . '';
    $output .= '
';

    return $output;
}
add_shortcode( 'simple_bible', 'safe_bible_shortcode' );