The first time we saw cross-site scripting on a client site it didn’t look dramatic. No skulls, no ransom note. Just an odd admin user we didn’t recognise and a few links on the homepage that nobody admitted adding. Classic Monday.
If you haven’t come across it before, cross-site scripting (XSS) is what happens when a stranger slips a fragment of JavaScript into a page and your browser cheerfully runs it as if it belongs there. That tiny fragment can do a lot—read someone’s session, post forms on their behalf, even create a brand-new admin account while you’re making tea. On WordPress it usually sneaks in through places that accept text: comments, search boxes, form fields, poorly-built widgets, the usual suspects.
Why XSS Keeps Appearing
Why does it keep happening? Because the web is built on trust and speed. We all want lively pages, instant feedback, “save without refreshing”. JavaScript gives you that. The flip side is simple: if you display something a user typed without cleaning it, the browser will happily execute anything that looks like code. You didn’t “let a hacker in”; you let their words run.
What It Looks Like in Real Life
A quick example from a recent audit. The site looked fine on the surface. In the comments table, though, one entry wasn’t a compliment—it was a script wrapped in a friendly sentence. When an editor viewed the post while logged in, the browser ran the script under their permissions. That’s how the mystery admin arrived. No alerts. No fuss. Just… there.
How to Prevent Cross-Site Scripting in WordPress
You’ll read a lot of advice about preventing XSS. Much of it is right, but it lands better when you see how it fits day-to-day:
-
Clean what comes in. In WordPress that means using the sanitisation functions when you handle user input. If it’s meant to be plain text, treat it like plain text. Don’t be brave.
-
Escape what goes out. Before you output anything that originated from a user, escape it for the context you’re using—text, attribute, URL, HTML, all slightly different jobs.
-
Don’t trust plugins blindly. Good teams ship fixes fast; old versions don’t. Most of the real-world XSS we’ve cleaned started life as a small oversight in a third-party plugin left a few versions behind.
-
Watch the users list. If you see an unfamiliar administrator with a sensible-looking email address, assume nothing. Remove first, investigate second.
Why We Use Wordfence on Every Build
We also run a web application firewall on every WordPress build we maintain. It’s not a silver bullet, but it is a very helpful net. We use Wordfence because it blocks the well-known XSS patterns before they ever hit PHP, and their threat intel means new tricks get caught quickly. When we pair that with regular updates and a bit of discipline in the codebase, incidents drop to near-zero.
Big Sites Get Hit Too
Does cross-site scripting only happen to small sites? No. History is full of big names caught out by a single clever payload. The common thread isn’t size; it’s unfiltered input displayed back to the page. WordPress just amplifies the risk because it powers so much of the internet and because it’s easy to add one more plugin that quietly introduces a gap.
How We Recovered One Site
Here’s what the recovery looked like for that Monday-morning site:
-
Lock it down. Disable public comments temporarily, revoke suspicious sessions, change keys, rotate passwords.
-
Remove the ghost admin and check for lingering backdoors (malicious plugin zips and edited theme files are favourites).
-
Patch the real issue – sanitise the offending field, escape output, update everything that’s out of date.
-
Turn the firewall up to full and keep it there. Then schedule updates so “I’ll do it later” isn’t an attack surface.
Need Help Securing Your WordPress Site?
None of this is glamorous, which is the point. Security is mostly small, careful habits repeated without fail. When we talk about cross-site scripting in WordPress with clients, we don’t promise that nothing bad will ever happen on the internet again. We promise that if someone tries something cheeky, your site is far more likely to shrug and carry on.
If you’d like a straight assessment of where your site stands—what’s safe, what needs fixing, what can wait—we’ll run a quick audit, put findings in plain English, and handle the tidy-up. We’ll also set you up with Wordfence, schedule updates, and remove the day-to-day worry from your team.
Start with a quick note and we’ll take it from there:
Get in touch with Bear Creative.
