Short-term developer mitigations (apply now)

If you are a developer and cannot wait for a plugin update, add a server-side filter that sanitizes the titles attribute when shortcode attributes are parsed. Use WordPress APIs such as wp_kses, esc_attr, and sanitize_text_field, and prefer a whitelist where feasible.

Example safe filter for the sheets2table shortcode (place in an mu-plugin or your theme's functions.php; mu-plugin preferred):

<?php
/**
 * Emergency mitigation: sanitize sheets2table shortcode titles attribute.
 * Create as mu-plugin (wp-content/mu-plugins/sheets2table-sanitize.php)
 */

add_filter('shortcode_atts_sheets2table', function($out, $pairs, $atts, $shortcode){
    if ( isset($out['titles']) ) {
        // Remove any HTML tags and decode common entities.
        $clean = wp_kses( $out['titles'], array() ); // strips all tags
        $clean = trim( sanitize_text_field( html_entity_decode( $clean, ENT_QUOTES | ENT_HTML5 ) ) );
        // Limit length to reduce potential encoding abuse
        $out['titles'] = mb_substr( $clean, 0, 1024 );
    }
    return $out;
}, 10, 4);

Notes:

• Adjust the filter name if the shortcode differs — pattern is shortcode_atts_{$shortcode}.
• Sanitizing attributes at parse time helps neutralize stored payloads upon rendering.
• Also ensure admin/editor previews and any front-end rendering escape output appropriately.

Database cleanup and forensic detection

If you suspect exploitation, search the database for suspicious patterns associated with the titles attribute or shortcodes. Always run these commands on a backed-up copy of your database.

Search for <script> or event handlers inside content fields. WP-CLI examples (adjust quoting for your shell):

# Find posts containing 'sheets2table' shortcode
wp post list --post_type=post,page --format=ids --field=ID --post_status=any | \
xargs -n 50 -I % bash -c "wp post get % --field=post_content | grep -i 'sheets2table' && echo '--- post % ---'"

# Search DB for occurrences of 
			
				
			
					

							
			
			
			






				
				 
 
   
 
  
 
 查看我的订单
 0 
 
 
  
 
 
  
 
 
 
 小计
 
税费和运费在结账时计算
 
 
  
 
 
 
   结账