Hi Simion,

Awesome news — the warning is completely gone and the site is clean now!

Thank you so much for your guidance and for pinpointing that exact Raw HTML element. Your help made all the difference in getting this resolved.

Hi Simion,

Thank you for pointing out the exact location.

I opened the homepage in TagDiv Composer and removed the malicious script as well as the entire Raw HTML element from the top row, then saved the page.

However, when I run the Sucuri scanner again, it still throws the “Warning: Malware Detected” alert.

Is it possible that TagDiv Composer’s internal cache / compiled page cache is still serving the old version of the homepage, or is there another place within the composer/theme options where this needs to be cleared?

Best regards,

Mladen

Hi Simion,

The website URL is https://mraclin.hr/

I have already completed all of those steps:

Scanned the entire database for cpajoliette (0 results).

Replaced WordPress core folders (wp-includes, wp-admin).

Updated the theme and tagDiv Composer to the latest clean versions.

Checked all theme options, headers, and custom code sections.

Ran a full Wordfence scan and verified that the files and database are clean.

Despite all files and database records being clean, external live scanners (like Sucuri) still report the injected script on the front end. Could this be caused by how tagDiv Composer caches shortcodes/elements, or is there a specific theme setting/table where this script could still be cached?

Best regards,

Mladen

Hi Simion,

Thank you for the update. I have updated the theme and tagDiv Composer to version 5.4.3.7, cleared all site cache, and re-scanned the site. However, ESET antivirus is still blocking the website.

Could you please advise if there are any specific database tables or remaining cached elements I should check, or if this might be a false positive on ESET’s end that needs to be reported?

Thanks!

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-545-reflected-cross-site-scripting

While it might just be a vulnerability rather than a malware infection, ESET Antivirus continues to block access to my website.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-545-reflected-cross-site-scripting

It is now OK, thanks a lot! I was delete and again install that plugin.

But now I have new problem in wordpress:

“Hola! Would you like to receive automatic updates and unlock premium support? Please activate your copy of Visual Composer.”

Can you help me with that?
Thanks in advance!

Mladen Štuban
http://www.mraclin.hr

Thanks a lot !

Hi,

I think for left menu marked with a red arrow on image – http://mraclin.hr/wp-content/uploads/2015/05/menu.jpg

Thanks a lot !

Thank you very much for help ! I’ve fixed it !
Can you help me with second problem: smaller menu on the left side. It does not appear on my website !
Thanks again in advance !