There is a new Wordpress exploit in
$textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE);
General problem here is that they try to parse HTML using regular expression. If they had ever looked at Stackoverflow they would know it's a bad idea.
Anyway, I tried to figure out how it works to understand the problem. I could not find a working solution, but I was able to create get
preg_split("/(<.*>|\[.*\])/Us", "<<<>script>e", -1, PREG_SPLIT_DELIM_CAPTURE);
How could you create a full