Sometimes malware will corrupt the database, inserting malicious script tags.
Here’s the quick removal approach if you have access to your database directly:
<br /> UPDATE wp_posts SET post_content = REPLACE ( post_content, 'BAD SCRIPT TAG', '' );<br />
