Search code examples
javascriptwordpresssecuritycode-injection

Injected script by someone in my worpdress site home page


I have WordPress site. In my Home page somebody add some script after my post div I am try to find out how to remove this but script is coming form dynamic,

I guess my site is hack by someone

Here I will share that script inject by someone function 7a3() {var h = document.head;if (!h) { h = document.getElementsByTagName(“head”); h = h[0]; }var s = document.createElement(“style”);s.type = “text/css”;var c = “#swboc-10o{display:flex; overflow:hidden; margin:0px}#home-right-bottom #swboc-10o>*{width:497px; flex-shrink:0; margin:0}#swboc-10o>#swboc-10{margin-left:-497px; flex-shrink:1; background-color:rgb(255, 255, 255); width:100%}@media only screen and (max-width: 1024px) and (min-width: 960px) {#swboc-10o{float: left; margin: 0 25px;}}“;if(s.styleSheet) s.styleSheet.cssText = c; else s.appendChild(document.createTextNode(c)); h.appendChild(s);}

<script>function erewhonf75() {var h = document.head;if (!h) { h = document.getElementsByTagName("head"); h = h[0]; }var s = document.createElement("style");s.type = "text/css";var c = "#erewhon-f75o{display:flex; overflow:hidden; margin:10px 0px}#erewhon-f75o>*{width:407px; flex-shrink:0; margin:0}#erewhon-f75o>#erewhon-f75{margin-left:-407px; flex-shrink:1; background-color:rgb(255, 255, 255); width:100%}";if(s.styleSheet) s.styleSheet.cssText = c; else s.appendChild(document.createTextNode(c)); h.appendChild(s);}</script> 

and HTML tag is

  <div><a href="https://cialrx.com/">Cialis 10 mg</a> proved to be a really reliable drug that helps me in dealing with women. I accept it two or three hours before the meeting. When it starts to work, I feel a rush of blood to my face, a small stuffiness in my nose, but eventually it all descends to the genitals. The effect is only positive, lasting several days.</div><p id="erewhon-f75">Erewhon Santa Monica features a beautiful patio, terraced courtyard, and a street-level view of Erewhon’s open kitchen. Erewhon has been independent and family-owned for fifty years. We are proud to work with innovative and passionate vendors and farmers to bring you a unique mix of products, held to the highest standards. Hope to see you soon!</p></div>
<script>erewhonf75();</script></li></ul></div></div>

I don't what this script and HTML div

I was searched all project but I couldn't find any thing from my side anyone have any idea what's happen with my site


Solution

  • Your best bet is to run a scan using something like Wordfence (it's a plugin and there is a free version). Most of those code injections are done through eval(base64_decode)snippets. It might be in your functions.php file, but they could've blasted every php file.

    Bottom line: Install Wordfence or any other scanning tool and follow the directions it gives you. Make sure to keep all the plugins and Wordpress version updated. If the theme code is tracked in git, you can compare the code as well and pull from master to remove all the crap.