Strange code in feeds

That should be a lesson not to use “sponsored themes”!
Delete all that crap links from your footer.php – it is full of links to porno sites ??

Hey Moshu – nice to talk to you again!

It was a theme sourced from the WordPress site – and then tweaked ??

Anyway… this is the code from the footer:

<div style="clear:both;"></div> </div> <div id="footer"> <p>Copyright &copy; <?php echo date("Y"); ?> <a title="Copyright">/"><?php bloginfo('name'); ?></a>  |  Created by <a title="The support page for your theme." href="https://milo.peety-passion.com/">milo</a><a title="Custom themes" href="https://insomnia.peety-passion.com/">IIIIVII</a> | <a title="Designfruita?￠ provides resources and inspiration for designers." href="https://www.designfruit.com/">Brushes</a> | <?php wp_loginout(); ?></p> </div> <?php do_action('wp_footer'); ?><script src="https://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
 </body> </html>

Which bit should I delete?

| Created by miloIIIIVII | Brushes |

EVERYTHING between the bloginfo(name) – and wp_loginut!

I’ve deleted nearly all of the footer but the errors are still there… could it be something else?

This is what the footer page says now: <div style=”clear:both;”></div> </div> <div id=”footer”> <p>Copyright © SultanaBlog. Thanks for visiting. </p> </div>
</body> </html>

The question marks in the feed occur in the middle of posts… would it be the same problem?

Instead of using the builtin theme editor try using a good ol text editor (NOT WORD) on the footer.php and see if you can spot the code then.

Ah, that thing is more evil than I thought!
It is using some script to insert the garbage. Did you download it recently from https://themes.wordpress.net ? or a long time ago?

Pack the theme in a zip and send it over to my-name-here AT transycan net

Again: do not worry about the feeds now… you have a million links there to nasty ugly porno sites! THAT’s the problem, not the feeds.

I’m using wordpad but just checked in notepad and it says the same as my last post…

Thanks Moshu – will do.

I found the theme here: https://themes.wordpress.net/columns/3-columns/3053/beauty-50/

And downloaded about 10 days ago.

CB

Moshu could it be that maybe it is not the theme it self but that code has been inserted in the wp-footer itself.

Edit: Just had a look at the theme and didn’t see anything funny in the footer or sidebars or index.

That’s interesting Jeremy, I can’t find a wp-footer file… should it sit under the main wordpress folder?

Actually, I have to apologize to the theme author(s). It is NOT the theme.
It is your site/blog that has been compromised.

Do you have wrold writable files (like online theme editing)? Stop doing it.
Change your passwords.
Report to your host!
Check out your source code to see what I am talking about!

What are wrold writable files?

chmod 666