Thanks for posting this info. Unfortunately I cannot see the relevant parts on that transient food record to see what is actually being detected there. Can you please copy out the entire contents of that textarea and send it to me for further examination?
You can email it directly to me: eli AT gotmls DOT net
🙁 … Yes…
I don’t like to have it typed out like that just to avoid the spam bot scrapers picking it up, but yeah, that will reach me.
Ok, thanks for sharing that data with me. There is a draft post in that transient feed data that is a transcript of “Interview With Product Lead Mark Westguard Of WS Form” in which is mentioned viagra, and that is why the record was flagged for deep scan by my plugin.
Then the scan finds various links that would not otherwise be suspicious but in conjunction with the viagra talk it ends up being marked as a know threat.
I have whitelist this record so that it is no longer matched in my latest definition update. However, I am a bit disturbed by how and when this feed content made it into the WordPress Core release, so I am going to do some more digging to get to the bottom of this and find out why the full transcript of this interview is now embedded into every new WordPress database.
Thank you for taking the time to bring this to my attention, and also for your willingness to work with me further. Providing that additional data was crucial to me understanding the extent of this issue and greatly helped me to find a quick solution.