By default, editors and admins in a single site installation have the unfiltered_html capability, which means they can insert any JavaScript and forms. If you want to disallow that, you can remove that capability from the editor role as described in Why is javascript allowed in my post content? or using a plugin like Members.
The only alternative is to assign them another role. See the documentation on which roles have the unfiltered_html capability and which don’t.
Related Posts:
- How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
- What’s the best approach for generating a new API key?
- Is it possible to decrypt SHA1
- Simplest two-way encryption using PHP
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- Error `sec_error_revoked_certificate` when viewed in Firefox only
- Convert .pfx to .cer
- how fix “this certificate cannot be verified up to a trusted certification authority”
- How can bcrypt have built-in salts?
- Getting a List of Currently Available Roles on a WordPress Site?
- Why should I use the esc_url?
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Where to securely store API keys and passwords in WordPress?
- Why are passwords exportable as plain text in WordPress?
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- Are the default salts secure?
- Is there a way to force ssl on certain pages
- Subscribe to email for security fixes?
- What is the purpose of having a token in cookies?
- How to escape custom css?
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- How is password strength calculated?
- How to secure or disable the RSS feeds?
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- Do Cookies Need to be Sanatized Before Being Saved?
- Disable external access to REST API Endpoint
- Make password invalid once logged out of password-protected page
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- WordPress salts set in config and database
- Add Shortcode inline inside Gutenberg block
- Disallow file edit not preventing plugin install
- How to secure WordPress XMLRPC?
- Protecting HTML5 video [closed]
- How can I find security hole in my wordpress site?
- Does WP show me if I’m logged in from multiple locations?
- Do I need to use the esc_html() function on hard coded links?
- WordPress Malware Problem help! [duplicate]
- Frontend Password change
- Restrictive File Permissions
- Downloading File from Outside Web Root
- Why are xmlrpc.php and wp-cron.php being called so often?
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- site get login attempts after htaccess ip restriction
- How to make a customized “Create Gallery” tab in the ‘Add Media’ window?
- Is it good security advice to install wordpress in subdirectory but link to root?
- wp-config.php modified?
- Moving wp-config.php up 2 levels
- How Could I sanitize the receive data from this code
- WordPress SQL Injections through User Agent
- How to save iframe tag into a post?
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- What permissions should I give directories if I want to make WordPress more secure?
- Tiny MCE-modifications (plugins) stopped working in WordPress 5.6
- Adding custom styles to dropdown in editor
- Is there a way to show only the text editor
- How to protect wp-admin through .htaccess?
- Something is unescaping all html entities before output to browser [closed]
- Why is WPBakery Page Builder backend editor not clickable? [closed]
- Is wp_kses the right approach in sanitizing this string?
- Renaming install.php for security?
- Limit Login Attempts BEFORE PHP is executed?
- Which Versions of WordPress Ship with the Patched TimThumb?
- Safe to say WordPress security releases don’t have database upgrades
- Use global variables or function that returns said variables for site-wide private-ish WP settings?
- fail2ban to prevent Brute Force Attacks on WordPress?
- Use Google authentication for pages within a website [closed]
- How to give the same error message when the wrong password or wrong username is used?
- should I escape a literal url added in functions.php
- Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
- Replace domain in database
- Adding Security Keys?
- What highest security brake with wordpress and static files?
- Secret keys in SCM
- Spam in WordPress root folder
- Uploading attachment (pdf) and prevent download for anonymous user
- Specific Page/Post Need to Stay Non SSL
- Scan multiple websites for malware that are in same webhost root?
- Security: AWS (shared hosting) claims template file malicious
- Cannot access wp admin of WordPress website (security plugin issue) [closed]
- Why are the latest visits to my website originating from my own website?
- How to allow some visitors to edit inline specific post
- PHP Code Sniffer – WordPress VIP Coding Standards
- How do I hide WordPress users from security scanning?
- Visual Editor not working for user on multiple computers
- Background Updates Not Happening
- wp-config.php file and code injection
- Trying to understand nature of hacking
- FORCE_SSL_ADMIN affecting subdomains
- What is the best security $_POST method?
- Is my WP site being hacked?
- Bullet List Indentation not showing up in the wordpress
- How do you search for backdoors from the previous IT person?
- How to test if my server is vulnerable to the ShellShock bug?
- Is wp-cron.php vulnerable to external attacks and how to protect it?