verdipro

Thank you for the info. All the plugins are updated (they get updated monthly) so all is set there. Is there a way to figure out which plugin caused these files so that I can determine if I can disable it?

ok just sent it thank you. I agree I think it is false positives also. I have a very good backup/update/backup regimen, so I would be surprised if someone got through before an update was in place.

In case anyone sees this post & is having the same issues. This error was related to the WP Google Maps Pro plugin & a fix is being pushed out in a new release.

ok thank you. I didn’t see a spot for it on that page, but I guess it is the comments section. I posted a comment there.

Bump. Anyone experience this before? Stumped on this one.

Thank you for your response @a2hostingrj

I do have monthly backups of all site files + databases.

I was mainly concerned with the error & that even though those tables did not seem to repair properly, the site did load again. So I am not sure at this time if the issue still persists or if it is resolved.

@sygnoossupportteam no problem, thank you!

@sygnoossupportteam thank you for your reply. I fully understand and am aware that anything can get hacked at anytime thru a variety of ways.

My point is that your sticky post: https://www.ads-software.com/support/topic/what-to-do-when-popup-click-redirects-to-an-unknown-website-2/ should also tell people to check thru other files that changed on their site, to make sure any of the malicious code was not added to them.

And if you think it is a good practice to change your WP admin password after the code injection, then that should be mentioned as well.

@sygnoossupportteam thank you for the update. My only question would be, how did they add code to my footer.php page then? I did have code on there & it referenced their code that they added to the JS in the popup.

@sygnoossupportteam I currently do not have the issue. But you may want to update your sticky post on it, as I know my themes footer.php file also had code injected into it from the same people that accessed via the popup builder.

Are you sure that the code does not get injected in any other areas? Should user/pass & things needing to be change there or do they access in differently?

@finout & they have replied to other forum posts today – some multiple times, but have not replied to this thread, which is kind of alarming.

No problem, thank you!

@sterndata thank you for the info. I will certainly try to get this disabled by these means. Hopefully WordPress provides another option in the future. I shouldn’t have to jump thru hoops for someone not deactivating their hosting account properly.

That worked, thank you!

@specialk thank you for the fast reply. It looks to be some sort of plugin/theme conflict, so I will start to disable plugins when the traffic is lower this evening & see if I can detect the issue. The same theme is working fine on other sites and those are all running the Disable Gutenberg plugin as well.