Minicart back button infected

Hello,

Yesterday i did find my minicart back to shop button infected with this url:
/search/🪀❤%EF%B8%8F%EF%B8%8Faz+dating+sites🪀❤%EF%B8%8F%EF%B8%8Fwww.weke.xyz🪀❤%EF%B8%8F%EF%B8%8Faz+dating+sites+Free+Dating.+Dating+Site+az+dating+sites/page/5/

I was able to find it again in relevanssi logs and a wp rocket transient in database. Cleaned up everything and had to fully remove relevanssi. All was ok into just now, 12-15 hours later and the button is again going to the above search result.

Checked htaccess, wp-config, database and files around but can not find anything.

Any idea?

Brgds
Rune

Hello,

Your site was borken externaly. That is why the links lead to the ads

We do not provide the option to clear the site from the virues. Please try to restore the site from a backup.

Best Regards

Hello,

Well the button does not link to the ad or dating site, it just lead to a search result in my site. Scanned site with no result so then scanned DB and found it again in a wp rocket transient. So it seems like it has been cached by wp rocket. Deleted the transient and it seems like it is all good now:

_transient_rocket_get_refreshed_fragments_cache
{“fragments”:{“div.widget_shopping_cart_content”:”<div class=\”widget_shopping_cart_content\”>\n<div class=\”shopping-cart-widget-body wd-scroll\”>\n\t<div class=\”wd-scroll-content\”>\n\n\t\t\n\t\t\t<div class=\”wd-empty-mini-cart\”>\n\t\t\t\t<p class=\”woocommerce-mini-cart__empty-message empty title\”>Du har ingen produkter i handlekurven.<\/p>\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\tTilbake til butikken\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\n\t<\/div>\n<\/div>\n\n<div class=\”shopping-cart-widget-footer wd-cart-empty\”>\n\t\n\t\n\t\t\t<script>\n\t\t\t(function($) {\n\t\t\t\t$( ‘.remove’ ).off(‘click’, ‘.remove’).on( ‘click’, function() {\n\t\t\t\t\tgtag( ‘event’, ‘remove_from_cart’, {\n\t\t\t\t\t\t’items’: [ {\n\t\t\t\t\t\t\t’id’: ($(this).data(‘product_sku’)) ? ($(this).data(‘product_sku’)) : (‘#’ + $(this).data(‘product_id’)),\n\t\t\t\t\t\t\t’quantity’: $(this).parent().parent().find( ‘.qty’ ).val() ? $(this).parent().parent().find( ‘.qty’ ).val() : ‘1’,\n\t\t\t\t\t\t} ]\n\t\t\t\t\t} );\n\t\t\t\t});\n\t\t\t})(jQuery);\n\t\t\t<\/script>\n\t\t<\/div>\n<\/div>”,”.aws-free-shipping”:”<div class=\”aws-free-shipping vc_message_box vc_message_box-solid vc_message_box-square vc_color-orange\” style=\”display:none;\”><div class=\”vc_message_box-icon\”><i class=\”fa fa-truck\”><\/i><\/div><\/div>”,”notices_html”:””,”span.wd-cart-number”:”\t\t\t<span class=\”wd-cart-number\”>0 <span>items<\/span><\/span>\n\t\t”,”span.wd-cart-subtotal”:”\t\t\t<span class=\”wd-cart-subtotal\”><span class=\”woocommerce-Price-amount amount\”><bdi><span class=\”woocommerce-Price-currencySymbol\”>kr<\/span> 0.00<\/bdi><\/span><\/span>\n\t\t”},”cart_hash”:””}

So for now i guess problem is solved.

Brgds
Rune

Hello,

Yes, we see the problem, try to restore the site from one of your backups. This is only the way to clear the site.

Best Regards

[Author]

Posts