wp db query "SELECT term_taxonomy_id, term_id, description FROM wp_term_taxonomy WHERE description REGEXP '(script|onerror|onload|javascript:|data:|iframe|svg|img)';"

If you don’t have WP-CLI, run equivalent SQL in phpMyAdmin or your hosting database tool.

Also check:

• Posts and pages: search post_content for similar patterns:

  SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP '(

• Widgets and theme options: check wp_options for injected HTML.
• Plugin/theme files for unfamiliar or obfuscated code.

Test on a backup first. Example SQL to remove 从术语描述中阻止']*>.*?', '', 'si')']*>';

Stripping event handler attributes like onload/onerror is more complex; prefer a PHP-based sanitizer to avoid breaking legitimate markup.

Option C — Sanitize through a PHP script using WordPress functions (safer)

Create a one-off PHP script and run via WP-CLI eval-file or an admin-only execution path:

 'category',
  'hide_empty' => false,
) );

$allowed_tags = array(
  'a' => array('href' => true, 'title' => true, 'rel' => true, 'target' => true),
  'b' => array(),
  'strong' => array(),
  'i' => array(),
  'em' => array(),
  'p' => array(),
  'br' => array(),
  'ul' => array(),
  'ol' => array(),
  'li' => array(),
  'span' => array('class' => true),
  // add only tags/attributes you trust
);

foreach ( $terms as $term ) {
    $clean = wp_kses( $term->description, $allowed_tags );
    if ( $clean !== $term->description ) {
        wp_update_term( $term->term_id, 'category', array('description' => $clean) );
        echo "Cleaned term {$term->term_id}
";
    }
}
?>

Run with:

wp eval-file sanitize-term-descriptions.php

Notes: Using wp_kses with a minimal allowlist is safer than regex-only approaches. Test on a staging site or backup first.

Suggested defensive WAF rules and short-term virtual patching

If you have the ability to configure a WAF, CDN rules, or host request filtering, add rules to block attempts to store suspicious payloads or to block rendering of known-suspicious content. These measures are temporary mitigations while you remove the vulnerable plugin or fully remediate the site.

Simple detection heuristics

• Block POST requests to /wp-admin/term.php or REST endpoints used to save term descriptions that contain , onerror=, onload=, javascript:, data:text/html, svg/onload, iframe, or suspicious src attributes with data:/javascript:.
• Block requests that include with event handlers, or style="background:url(javascript: style injections.

# Block attempts to save category descriptions containing 
			
				
			
					

							
			
			
			





		

		
					
				 
 
   
 
  
 
 查看我的订单
 0 
 
 
  
 
 
  
 
 
 
 小计
 
税费和运费在结账时计算
 
 
  
 
 
 
   结账