kiplog

Same issue, even with the Popup Builder update (4.2.6 as of 02-01-24) the infection persists. A scan and clean of all files is needed, wp-felody plugin needs to be deleted, and all additional css on all popups need to be deleted. It’s best to just to delete all old popups or replace the plugin entirely.
The malicious redirects also happen on Firefox, and not just on the homepage, but on subpages. So if your site is infected, checking the homepage for redirects in private or incognito mode is not enough, check your other pages too.

Question for support: where is the addition css for popups stored? I see malicious code in the exported xml in the meta_key sg_popup_scripts is that stored int eh database or in another file somewhere?

• This reply was modified 10 months ago by kiplog. Reason: Added question for support

Just reporting the Same issue.

Got TEC and EventBrite ticketing working again by rolling back with versions:
Event Tickets 5.5.10
TEC 6.1.1
The Events Calendar: Eventbrite Tickets 4.6.13

Still stuck in Recovery Mode in the Admin though, still working through what else is broken.