What might cause “junk after document element” error?

Question

I have PHP errors redirected to log file. Only for WP installation so this definitely doesn't come from somewhere else. This is what started to come up recently (this is all of them, not cut):

[22-Sep-2010 14:30:41] junk after document element at line 2, column 0
[22-Sep-2010 16:17:08] junk after document element at line 2, column 0
[22-Sep-2010 17:19:42] junk after document element at line 2, column 0
[22-Sep-2010 18:30:19] junk after document element at line 2, column 0
[22-Sep-2010 20:19:23] junk after document element at line 2, column 0
[23-Sep-2010 14:51:40] junk after document element at line 2, column 0
[23-Sep-2010 15:54:33] junk after document element at line 2, column 0
[23-Sep-2010 17:23:02] junk after document element at line 2, column 0

This doesn't really look like PHP error (function blah-blah failed at line x), they are very infrequent and don't seem to be tied to page loads (maybe to some cron event?) and there hadn't been any major configuration changes in months other than keeping plugins up to date and one or two new ones (days before this started).

Googling results are mostly about XML parsing... Of which WP probably does plenty (feeds, updates, what else?..) but how to pinpoint what is going wrong?

This has me really puzzled.

Answer 1

A quick Google search confirmed your suspicion ... this is likely an XML parsing error. Furthermore, some discussion on the forums suggests it's caused by script insertion after a closing </rss> tag.

If it is an inserted script, this is likely the result of a hack or an attack on your site or host.

Another possibility is a PHP error in the RSS-generation script. PHP would return the error in-line, and the error message, being non-XML, would be read as "junk" by the XML parser. This could also be the result of a feed your site is trying to read (i.e. on the admin dashboard), not necessarily a feed you're generating.

Answer 2

Solved. External feed idea was correct, figuring out feed was slightly more complex.

I had installed Core Control plugin and enabled log of HTTP requests.

Then it was just sitting and waiting until error re-occurs and checking which feed was downloaded at exactly same time.

Subject feed:

• belonged to one of recently installed plugins;
• was fried dead with PHP fatal error instead of content.

And feed validator was giving exact match on it:

line 1, column 0: Undefined root element: br

line 2, column 0: XML parsing error: :2:0: junk after document element

PS I am not sure which answer better to accept, this with exact solution or EAMann's with ideas and discussion? Edit: can't accept my own for two days anyway, that one it is.