WordPress already disallows the use of JavaScript in the editor for users without the unfiltered_html
capability. By default, only the Administrator and Editor roles have this capability. If necessary, you could remove this capability from Editor users as well. (It doesn’t make sense to remove it from Administrators, because they will still have the ability to install plugins, and thus execute whatever kind of code they want to.)
This code should do that for you:
function wpse_285333_remove_unfiltered_html_cap() {
$wp_roles = wp_roles();
$wp_roles->remove_cap( 'editor', 'unfiltered_html' );
}
// This function actually only needs to run once, so you can comment this out
// after loading the site once.
add_action( 'init', 'wpse_285333_remove_unfiltered_html_cap', 5 );
There are also plugins available to help with managing roles and capabilities.
Related Posts:
- Custom wp.editor.initialize settings ignored
- SecurityError: Blocked a frame with origin from accessing a cross-origin frame
- Remove inline linking tool
- How to wrap the content of the main tinyMCE editor with extra tags
- Add Item to Custom TinyMCE Menu
- How to get value of selected page template in Gutenberg editor?
- Strange gibberish JavaScript in Editor – site hacked?
- Close TinyMCE plugin window on click away
- Trouble adding JavaScript in visual editor (Sharpspring embed code)
- How can I get the standard WP-Editor through Javascript?
- Make TinyMCE checkbox that returns a value instead of true/false
- wp.editor.initialize does nothing
- Button insert link on front wp_editor not working
- JavaScript && operator in visual editor
- Authentication with the Rest API when using an External Application
- Media library not working with wp_editor() on the front end
- Popup box when Clicking on Insert into post button in wordpress
- wordpress 4.4 upgrade visual editor bullets select for not selected elements
- How to reference TinyMCE body in my script
- Change syntax styling of TinyMCE HTML Text Editor
- find out reason of “Updating failed” in Post-editor
- Should I manually resolve WP Core File security issues or await a subsequent WP release?
- How to stop javascript code being broken when going into visual editor
- How to make shortcode which returns HTML?
- How to use WP switchEditors.switchto(this) JS function in your own script?
- Cannot read properties of undefined (reading ‘show_ui’) Error on WordPress Post Editor
- VisualComposer/WPBakery Page Editor: Is any JS event triggered after the Edition pop-in is shown?
- Dynamically write in editor with Javascript
-   when I use ENTER for skipping line
- None of the JavaScript works when using wp_editor
- Securing Contact Form 7 [closed]
- Use add_action to run a script, but only on the post editor page
- How to securely set dynamic HTML content with JavaScript?
- Background color of edit post page
- Why Is wp.editor Not Adding the ”Add Media” Button When I Initialize It?
- how to refresh page after user logout with ‘wp_logout_url’?
- Open image gallery on link click
- How do I call for two js files into a custom template?
- How to delay display of page elements until enqueued script has injected html
- load-scripts.php loads incorrect file names
- Retrieve $_POST data to send to javascript without using localize script
- Visual editor popover or placeholder
- How to change number field to text field using JS
- Enqueue concatinated JS file in WordPress
- Custom Media Meta fields to alter the generated image HTML that is inserted into a post for my animated GIF image player?
- wp_enqueue_scripts doesn’t work for template pages
- WordPress text widget with onclick function
- Create new product with woocommerce REST API with javascript (clientside)?
- Connecting a wordpress site to an AngularJS APP
- Can’t change javascript files
- how to do open a link in a open window from menu bar? [closed]
- Combining results from WP-API using AngularJS
- JavaScript and Google PageSpeed + wp_enqueue_script
- Javascript file doesn’t load
- Script not working in post content
- JavaScript problem in a WordPress PAGE
- How to identify which javascript is being executed
- Put dynamic Javascript in header after doing operations
- Unserialize WP_Options options programatically?
- how to include js in widget?
- early enqueueing javascript file in page template, not in functions.php
- Wysiwyg editor not working on 4.2.2
- Editing the source of a display for posts (to category recent)
- Dequeue set-post-thumbnail.min.js
- Extending the “Add Media”-Dialog … how do I finally insert something to the Post?
- How to adjust the selector used in JS to target only the one that was clicked on?
- WordPress 4.2 mce-views migration guide?
- Receive “menu-toogle” event from section menu in customizer
- Adding javascript blocks to a single file and adding it to the header
- JS files landing on page but not working, using childtheme of twentyeleven
- WordPress 4.1 crashes loading of ArcGIS Javascript API
- jQuery + more won’t load in header
- How to modify a class in load-scripts.js ?
- Convert javascript running xml files to wordpress platform
- When I click edit on a post, all the content disappear. Does anyone know how to fix this?
- WOW.js Script Tag Initialization Header/Footer
- How to block action if post is “dirty”?
- Remove WordPress default registration client side validation?
- How to integrate a different (JavaScript) editor in WordPress?
- JS enqueue path (localhost)
- Load and execute javascript from body
- Why can’t I load JS script in a plugin?
- Page template dynamic links based on browser size
- javascript errors on mobile browser, not on desktop
- Trigger a function during onload
- Loaded JavaScript file not showing [duplicate]
- WordPress Theme – jQuery JavaScript Library Issue
- I keep getting Javascript error messages
- How to add additional JavaScript code [duplicate]
- custom page url slug needs illegal ?id=1 for javascript
- Script loaders vs wp_enqueue_script
- PHP or JS for header image rotator?
- convertEntities() used before it is defined
- Block pattern conflict with custom block
- Use one javascript variable into another javascript file
- JavaScript: TypeError: xyz is not a function after upgrading WordPress
- How do I find stylesheet & javascript handles? [duplicate]
- JavaScript errors
- JavaScript file successfully registered but does not render correctly
- Disable html in custom post types