I found this in a plugin. What does it do? is it dangerous?

It loads a block of markup containing spam (I thought about posting a bit of the source but I don’t want to advertise the content in any way) from a domain that is a close misspelling of the domain– http://jquery.com/— used by jQuery, a reputable and popular Javascript library and one that WordPress includes in the Core. I think the idea is to appear to be loading that library, when in fact loading something very different.

And it is in other ways attempting to appear to be loading jQuery. Notice the variable name $jquery.

It may attempt to load malicious scripts as well. I didn’t check.
I would definitely call it dangerous especially since the content on that page can change anytime the domain controllers feel like it.

At best it is going to damage your site as search engines look down on sites that spread spam.

Don’t use it. It does nothing beneficial for you or for anyone else on the web other than the people who run the site. If you found this on a reputable site, report it to them.

Related Posts:

  1. How Restrict access to admin dashboard by specific static ip?
  2. Questions about brute force attacks on the admin username, coming from amazon IP addresses
  3. Weird problems after recovery from security breach
  4. 404 errors when updating options in admin dashboard
  5. Stop the user if login from the cookies
  6. Disabled plugins are they security holes – rumor or reality?
  7. Disable /wp-admin/plugin-install.php
  8. What could a hacker do with my wp-config.php
  9. How Can I Securely Implement a Password-less Login Feature?
  10. Security and .htaccess
  11. Are there procedures to prevent malicious plugin updates?
  12. Where are plugins located
  13. Admin menu as submenu from another plugin
  14. Why does WordPress require a ftp server to be running on the webserver to transfer plugins?
  15. Reordering themes in admin panel
  16. Custom admin column disappearing when using Quick Edit [duplicate]
  17. Should we use plugins that aren’t available from the official WordPress site?
  18. Using tabs for wordpress plugin
  19. Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?
  20. Where should my plugin POST to?
  21. Security error WP 4.0 + WP phpBB Bridge [closed]
  22. Plugin Development: WordPress processes twice on post update. How to skip process on the first?
  23. Disabled plugins are security holes – rumor or reality?
  24. how to not show plugin in admin area
  25. “Are you sure you want to do this?” when deactivating all plugins in WordPress 4.3.1 [closed]
  26. Prevent Brute Force Attack
  27. Getting “Fatal error: Call to undefined function wp_cache_get() in option.php” after updating a cache plugin [closed]
  28. Edits to plugin not taking effect
  29. How to expire all wordpress user passwords instantly?
  30. Should you escape hardcoded URLs?
  31. Preventing BFA in WordPress without using a plugin
  32. How to Sort the Favorite Plugins Screen Alphabetically?
  33. ‘wp_login’ action hook not working with wp-login.php file
  34. 404 Error on Activate / Deactivate Plugin
  35. Why isn’t admin_notices displaying my text? [Simple Plugin, Beginner]
  36. How can I make uploaded images in the editor load with HTTPS?
  37. How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?
  38. WordPress filter that hook after each action/filter hook
  39. How to delete Passwrd Protected posts cookies when a user logged out from the site
  40. How to hide some section in WordPress under Post
  41. How to block plugin activations with no known user or coming from unknown IP address range?
  42. Check for security updates
  43. Standard Fail2Ban vs. WP Fail2ban vs. WP Fail2Ban Redux
  44. Polylang : Interverting languages after development [closed]
  45. Malicious File Upload [closed]
  46. Stop Plugin Enumeration [closed]
  47. Add sub menu page in your plugin
  48. Security and Must Use Plugins
  49. Is Timthumb still broken? What security measures should be taken?
  50. Full list of registered scripts or styles, but from an admin options page
  51. Is it safe to use admin-ajax.php in the frontend?
  52. How to protect WordPress from security scanner [closed]
  53. How can I modify page content in the admin panel?
  54. Change the layout of action links under the plugin names
  55. getting notifications about updates only in the “core” page
  56. Redirect Plugins.php to New Plugin Page
  57. Get access to WordPress when logged out
  58. Why are plugin settings not all nested in one place?
  59. Edit page header on a custom plugin
  60. Website Captcha Error: The reCAPTCHA wasn’t entered correctly
  61. WordPress search shows protected content
  62. Change Dashboard URL from wp-admin to wp-admin/index.php
  63. Using file_get_contents within admin but keep logged in
  64. Can I disable xml-rpc by setting it to false?
  65. Help to Create a Simple Plugin to make a post
  66. How can we get this dynamically as this folder may not be by the same name always → wp-admin
  67. Calling PHP function with AJAX
  68. Hide response returned from WordPress REST API call
  69. WordPress Admin login redirect to homepage
  70. “Fire Secure” menu item
  71. https rewrite not working for All in one security Brute force > rename login url
  72. Store admin page into variable
  73. Admin login substantially slower on production server
  74. Continous audio play in pages
  75. Redux framework somehow added to my site, can’t locate in plugins
  76. wp_verify_nonce fails always
  77. Disable default posts (Posts,Pages,Comments and Media) in wp-admin
  78. wp-admin will not redirect to wp-login.php
  79. Validating values using Settings API?
  80. Getting 404 page not found error while trying to access add new plugin / themes
  81. getpost content with all formatting for admin pages
  82. Plugin (smart archives reloaded) crashed site / no access on admin panel
  83. Which filters or actions involve with index page for plugin?
  84. Problem with permissions in wp-content/plugins
  85. Making plugin to use different table prefix cause permission problem
  86. WordPress Plugin: Where should I put my cookies for cURL?
  87. Add custom fields in the new and edit the site forms without touching the WP core
  88. Ajax in Plugins: returns the whole page
  89. My WP site and password was hacked, what to do? [closed]
  90. How to resolve these findings from security audit
  91. ERROR: Cookies are blocked due to unexpected output – no access to FTP
  92. Mixed content warning on doctype in admin
  93. How I can hide my wp folders from Inspect Element (Developer Tools)
  94. How to Find WordPress site has backdoor login Codes
  95. List all posts in a particular page [closed]
  96. How to rename files during upload to a random string?
  97. cURL External API request displays content above other content on page
  98. WordPress Plugin and other pages not opening
  99. warning wp session
  100. /wp-admin/plugins.php takes ages to load, and then 404s

Leave a Comment

tech