Is there a worm targeting customizr?

I have two sites set up with customizr (one on the free version and one on pro). They’ve both been running well for several years. In the last month, both sites have experienced the same issues. (None of my sites running other themes have had the same issues). Began with all plugins deactivating. Then attempts to add a new plugin (in order to take a new backup) failed. One of the sites began to display full page ads for viagra instead of the site shortly afterwards. Is there a new/known vulnerability with customizr that may be causing this? What fix do you recommend? Thanks.