We have an installation of WordPress (3.9) where TinyMCE is not removing script tags (in posts etc). This isn't correct, I believe?!

I think a developer that worked on the project possibly changed something when trying to sort something out, but I can't see where at the moment - what are the obvious places to look?



Update: This seems to happen on a fresh WP3.9 install. In the text tab of the post editor I can enter script tags, which persist unless I switch to the visual editor and save. I don't think that this is correct, I think that WP is supposed to strip script tags out...or did I miss something?

  • 1
    Which user roles experience this issue?
    – s_ha_dum
    Commented Apr 22, 2014 at 16:26
  • I'm seeing it logged in as an Administrator, haven't checked others. Commented Apr 22, 2014 at 19:00
  • I don't have the time to chase this down to verify it but the administrator should have "unfiltered html" capability. Try with another role.
    – s_ha_dum
    Commented Apr 22, 2014 at 19:04
  • editor seems to be able to do it too - I just did a fresh install of WP3.9, created a new post containing an alert between two script tags and the alert works...I also pulled in a js file...this can't be right can it?! Commented Apr 22, 2014 at 19:35
  • Are there any plugins on the site that may be modifying the editor's behavior?
    – s_ha_dum
    Commented Apr 22, 2014 at 20:13

1 Answer 1


Ok, it was my oversight - and s_ha_dum was almost spot on - I was kindly directed to this:


which explains the situation perfectly.

In case this is of any use to anyone

I have fixed it for the site I'm working on using the wp_insert_post_data filter, like this:

add_filter( 'wp_insert_post_data' , 'filter_post_data' , '99', 2 );

function filter_post_data( $data , $postarr ) {
    $data = wp_kses_post( $data );
    return $data;

I am hoping I've got something wrong here, this seems very...wrong?!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.