gvenditto

Thanks for the suggestion. That didn’t work for me but I know I probably didn’t know how to call it. I’m using Astra Pro So I added this to the “additional CSS” box and it worked …

ol {
	list-style-type: upper-roman;
}

I know all of my ordered lists will be roman but for now, that’s OK

The compositions are now displayed properly
https://friendsofmusicconcerts.org/jonathan-swensen/

David:

Did you ever have install the GravityForms plugin? The only evidence of simplelender in my site after I deleted simplelender’s files and folders was found in the database tables of GravityForms. I had de-activated GravityForms a few hours before the simplelender attack took place.

I found it by scanning all of my database tables looking for simplelender and there it was in a GravityForms table.

I used WP-Optimize to remove that table along with every other table left by Gravityforms and simplelender.

I started searching my database and found that another plugin I had used (and removed) had several database entries for simplelender. In Googling for other mentions of simplelender, I found that other users of this plugin (GravityForms) reported seeing simplelender in their tables. So it seems likely that GravirtyForms was an entry point.

I’ve removed all trace of both at this point, of course.

Thanks for the suggestion; I ran WordFence and it didn’t find anything.

By top menu, I assume you mean the navigation menu to display pages on your website; you control this in Appearance > Menus. You need to assign pages to a menu before it will appear. Alternatively, your theme may have its own options for the menus; this would appear under Appearance > Customize.

However, if you are referring to the top menu that WordPress displays to a logged in user, there are 2 possibilities: you may not be logged into WordPress or in your user profile page, you turned off the option to display the Toolbar. This is set in your Edit Profile page (top right corner when you are viewing the Dashboard).

It is good practice to de-activate the plugins after testing. When you have reached a decision on whether they are valuable, delete them. Out-dated plugins can result in a security vulnerability.

This plugin somehow was installed on my site without my knowledge. As the other users explain, it can not be un-installed.

Anyone who is also getting hacked, beware. Parts of my site become un-available to certain users. I was able to remove it by deleting files from the server but I still have not been able to determine how it was installed. We did not have any new users registering.

I suspect that other plug-ins I had installed were corrupted. A few suspects are: user registration, gravityforms and wp-optimize. I’ve seen mentions of simplelender hacks mentioned on gravityforms and wp-optimize pages.

If you have been dealing with this hack, please share so we can identify the source.