WordPress already disallows the use of JavaScript in the editor for users without the unfiltered_html capability. By default, only the Administrator and Editor roles have this capability. If necessary, you could remove this capability from Editor users as well. (It doesn’t make sense to remove it from Administrators, because they will still have the ability to install plugins, and thus execute whatever kind of code they want to.)
This code should do that for you:
function wpse_285333_remove_unfiltered_html_cap() {
$wp_roles = wp_roles();
$wp_roles->remove_cap( 'editor', 'unfiltered_html' );
}
// This function actually only needs to run once, so you can comment this out
// after loading the site once.
add_action( 'init', 'wpse_285333_remove_unfiltered_html_cap', 5 );
There are also plugins available to help with managing roles and capabilities.
Related Posts:
- Custom wp.editor.initialize settings ignored
- SecurityError: Blocked a frame with origin from accessing a cross-origin frame
- Remove inline linking tool
- How to wrap the content of the main tinyMCE editor with extra tags
- Add Item to Custom TinyMCE Menu
- How to get value of selected page template in Gutenberg editor?
- Strange gibberish JavaScript in Editor – site hacked?
- Close TinyMCE plugin window on click away
- Trouble adding JavaScript in visual editor (Sharpspring embed code)
- How can I get the standard WP-Editor through Javascript?
- Make TinyMCE checkbox that returns a value instead of true/false
- wp.editor.initialize does nothing
- Button insert link on front wp_editor not working
- JavaScript && operator in visual editor
- Authentication with the Rest API when using an External Application
- Media library not working with wp_editor() on the front end
- Popup box when Clicking on Insert into post button in wordpress
- wordpress 4.4 upgrade visual editor bullets select for not selected elements
- How to reference TinyMCE body in my script
- Change syntax styling of TinyMCE HTML Text Editor
- find out reason of “Updating failed” in Post-editor
- Should I manually resolve WP Core File security issues or await a subsequent WP release?
- How to stop javascript code being broken when going into visual editor
- How to make shortcode which returns HTML?
- How to use WP switchEditors.switchto(this) JS function in your own script?
- Cannot read properties of undefined (reading ‘show_ui’) Error on WordPress Post Editor
- VisualComposer/WPBakery Page Editor: Is any JS event triggered after the Edition pop-in is shown?
- Dynamically write in editor with Javascript
-   when I use ENTER for skipping line
- None of the JavaScript works when using wp_editor
- Securing Contact Form 7 [closed]
- Use add_action to run a script, but only on the post editor page
- How to securely set dynamic HTML content with JavaScript?
- Background color of edit post page
- React – uncaught TypeError: Cannot read property ‘setState’ of undefined
- Cannot read property ‘push’ of undefined when combining arrays
- Check if checkbox is checked with jQuery
- What does “res.render” do, and what does the html file look like?
- How to pause javascript code execution for 2 seconds [duplicate]
- Disable/enable an input with jQuery?
- Is there a sleep function in JavaScript?
- scrollIntoView Scrolls just too far
- How to update array value javascript?
- How to use scientific notation in js?
- String.Format not work in TypeScript
- jQuery Ajax POST example with PHP
- JSON.parse unexpected token s
- Escaping HTML strings with jQuery
- “Cross origin requests are only supported for HTTP.” error when loading a local file
- How to destroy a JavaScript object?
- wp_enqueue_script : how to change loading order of scripts?
- Is there a core Sortable component in Gutenberg?
- What are the better WYSIWYG post editor replacement alternatives?
- Using webpack to add customizer live preview functionality – wp.customize is not a function
- Path to image in js with wp_localize_script [closed]
- Load page in customizer preview on panel click?
- JQuery not loading
- Looping over wordpress meta to create “ ‘s?
- How to add API security keys into JS of wordpress securely
- How to include a JSON file on my page?
- Gutenberg consume wp-json data and reflect in frontend the content
- Adding inline JavaScript after wp_enqueue_scripts
- How to add “on change” to a text input in contact form7?
- How can I get user data into a javascript object?
- Why WordPress not using JSON_UNESCAPED_UNICODE by default?
- Install GTM in pure javascript through functions.php
- Update media library attachments
- WordPress load-scripts.php not loading
- Add script to page at certain location in wordpress
- get_header() in backend – but keep JavaScript and CSS files
- Absolutely print script in footer
- JavaScript Libraries in WordPress
- Removing admin javascript
- How can I put this JavaScript into WordPress? [closed]
- how to let users upload their custom cover image
- how to use nimble-API and Display data?
- How do you create your own link preview for my website?
- Can’t get rid of JQMIGRATE: Migrate is installed, version 3.3.2. Manually updated all the libralies and site. 5.8.2
- Need help in fixing javascript in WordPress
- Uncaught TypeError: r is not a function
- How to show cities according to the state in Form using Javascript? [closed]
- Can I get the user name in JavaScript?
- Landing function through URL
- Redirect to homepage if attmpting to leave intranet [closed]
- Twenty seventeen theme dropdown menu issue
- Escaping quotes while enqueuing scripts
- How to correctly load this jquery script through the file functions.php?
- Create new product with woocommerce REST API with javascript (clientside)?
- Combining results from WP-API using AngularJS
- Unserialize WP_Options options programatically?
- javascript errors on mobile browser, not on desktop
- Custom JS doesn’t work after 4.9.9 update [closed]
- Loading 2 Different Version of JS files [closed]
- Adding react app to an existing wordpress website
- Javascript file not included only on home page
- Get current day using javascript [closed]
- dropdown does not work [closed]
- Anyway to disable the auto excerpt creation?
- How do I cycle a JS function in WordPress? [closed]
- How to build BOTH non-block components and blocks present in the /src directory using @wordpress/scripts