michaelnorth

I checked a different machine and the button WAS present, so there must be something going on my other machine, perhaps a Chrome extension. Thanks for checking!

Yes, thank you. Agreed, it is image info addon injecting code into WordPress. The solution is to uninstall that poorly made addon.

Alright, thanks. I’ve since deleted the folder, asked Norton to re-scan, waiting for their response.

Using that method, I narrowed it down to the Convert Pro plugin and I’m in contact with the developer. I’ll close this thread, because it’s in their court now. Thank you!

Great, thank you, I’ll wait for the update to come through.

A small update just to be clear: As @forest-skills mentioned, whenever any text box, form, or almost anything it seems is edited, or a new post / page is created, the offending code snippet is injected immediately and must be manually deleted. Editing re-injects the code. This happens site-wide, across multiples sites. That suggests a plugin is responsible since some of my sites use different themes and builders, yet they have this issue in common.

One of the sites I was updating was clean — without this issue — then the issue appeared after updating WP, updating several plugins, and adding a few plugins.

Here’s a current screenshot: https://www.dropbox.com/s/b3zpa2dumom1nxm/07-19-2018-2.png?dl=0

@forest-skills Are you using any of these?

Updraft
Antispam Bee
Sucuri
Post Type Switcher
Fast Velocity Minify
Schema Pro
Admin Columns

• This reply was modified 6 years, 8 months ago by michaelnorth.
• This reply was modified 6 years, 8 months ago by michaelnorth.
• This reply was modified 6 years, 8 months ago by michaelnorth.
• This reply was modified 6 years, 8 months ago by michaelnorth.
• This reply was modified 6 years, 8 months ago by michaelnorth.
• This reply was modified 6 years, 8 months ago by michaelnorth.

@sterndata Thanks for re-opening — makes much more sense than starting a new thread.

Here’s my plugin list. If you’re having this same issue, please let me know if you’re using any of these plugins. By comparing notes, we can narrow it down to the culprit.

https://www.dropbox.com/s/57arh9hty1j834x/07-19-2018-1.png?dl=0

Yours too? I’ve still not discovered the exact source, but it has since cropped up on two more of my sites! Really a pain.

Yesterday, it showed up on a site I hadn’t touched for a while, AFTER I updated the plugins. Maybe we can compare notes to figure this out? Hang on, I’ll post my plugins list, see if there’s common ground. Thanks.

Fantastic, thank you!

@davidanderson

Good point, thank you.

Hi, thank you for the quick response ??

Yes, I did clear the cache (three times total), but the errors came back exactly as before. See screenshot here: https://www.dropbox.com/s/5yegkskx36nkegw/07-01-2018-5.png?dl=0

When you say search the site for “eval(“, do you mean file-by-file (not sure how to do that), or the database?

Confirmed this works. Thanks!

That worked, thanks!

Some feedback on the plugin:

The cache is definitely not clearing after 20 minutes, it’s been at least two hours.

My take is that the Data Storage button should be called “Clear” or “Reset”. I’m sure “Delete” causing people to pause, seems like it could be deleting an important file if you don’t understand they are temporary.

Wouldn’t it be helpful to show that he various security headers are correctly installed, instead of just just showing a blank? The not-present alert is useful, but positive confirmation is better ??

The security headers should include Strict Transport Security (HSTS) for sites that use HTTPS.

So far, it’s working ?? So I would suggest for anyone that has a similar issue, consider:

Reinstall WordPress core
Delete themes and reinstall
Delete plugins (retain the settings as necessary), and reinstall
Run Sucuri + WordFence scans