Someone keeps changing my SITEURL (mysql injection or xss?) [closed]

YOu need to deeply look throughout your site for the ‘infection’/malware code. This would include the following steps:

• update everything (WP, themes, plugins)
• change credentials on everything (hosting, FTP, admin-level users)
• create a new admin user, log in as it, then delete the user called ‘admin’ (or demote to ‘subscriber’)
• look at all folders for files that shouldn’t be there. This is somewhat easier if you sort the file list by date, looking for outliers (since you updated everything, the ‘good’ files should have the same date/timestamp).

I’ve put together a procedure I use to clean up a site. It takes a while, but can be done. There are other similar resources available via your favorite search engine.