Safe PHP sanitization approach:

// replace dangerous content in option safely
$opt_name = 'tab_color_picker_language_switch';
$value = get_option( $opt_name );

if ( $value && preg_match( '/<[^>]+>/', $value ) ) {
    // remove tags and keep hex color fallback
    $clean = sanitize_hex_color( strip_tags( $value ) );
    if ( empty( $clean ) ) {
        $clean = '#000000';
    }
    update_option( $opt_name, $clean );
}

If you find injected scripts elsewhere (posts, usermeta), export the records, sanitize or replace with safe defaults, and rotate credentials. When in doubt, isolate and consult incident response professionals.

Hardening checklist (practical steps every WordPress admin should follow)

1. Patch management: Keep core, themes, and plugins updated. Deactivate unmaintained plugins with known issues.
2. Least privilege: Minimize admin accounts and use role separation.
3. Access controls: Enforce strong passwords and 2FA; restrict admin access by IP if feasible.
4. Backups & monitoring: Maintain frequent backups and monitor admin actions and file integrity.
5. Security headers & CSP: Implement Content Security Policy to reduce impact of injected scripts where practical.
6. WAF & scanning: Deploy a managed WAF or host‑level protections and schedule periodic malware scans.
7. Incident response plan: Prepare standard procedures for compromise: isolate, snapshot, scan, clean, restore, and communicate.

Recovery and incident response after compromise

1. Isolate the site (maintenance mode, restrict access).
2. Take full backups (DB + files) and preserve timestamps.
3. Scan for persistence mechanisms: changed plugin/theme files, mu-plugins, new admin users, unexpected cron jobs, unknown files.
4. Remove or clean injected code, but keep a forensic copy.
5. Rotate all credentials (WP accounts, DB, FTP, hosting panel).
6. Reinstall software from known good sources and rebuild compromised components.
7. Conduct a full post‑incident audit and harden systems to prevent recurrence.

If you lack internal capacity, engage a reputable incident response provider experienced in WordPress environments.

Final notes

Do not under‑estimate admin‑accessible XSS. Even when an admin is required to save the payload, attacker techniques such as phishing and lateral compromise make this a real-world threat. Use layered defenses: secure coding, least privilege, 2FA, network restrictions, WAF coverage, and ongoing scanning. Quick containment followed by careful cleanup and credential rotation is the proven approach.

Appendix — developer reference snippets

Hex color validation function:

function is_valid_hex_color( $color ) {
    return preg_match( '/^#?[A-Fa-f0-9]{3}([A-Fa-f0-9]{3})?$/', trim( $color ) );
}

Sanitize callback example:

function wps_sanitize_color_callback( $value ) {
    $value = sanitize_text_field( $value );
    $clean = sanitize_hex_color( $value );
    if ( empty( $clean ) ) {
        return '#000000';
    }
    return $clean;
}

register_setting( 'wps_settings_group', 'tab_color_picker_language_switch', array(
    'sanitize_callback' => 'wps_sanitize_color_callback',
) );

Conceptual WAF rule: block POSTs where tab_color_picker_language_switch contains < or > or text that does not match the hex color regex.

Need a concise remediation plan?

If you would like a short, prioritized remediation checklist tailored to your installation, reply with the following (only if you intend to involve a security team):

• WordPress admin URL (for planning; do not post credentials)
• WordPress version
• “User Language Switch” plugin status/version

A qualified security professional can prepare a step‑by‑step plan (containment, virtual patch suggestions, safe cleanup steps and tests) for your site.