Hi @threepixelslab,

Traditionally,you can find this file in the functions.php and page.php file in your custom theme.You should remove the add_js_scripts function and all the add_action clauses that mention add_js_scripts.And,search keywords <scripts> in your origin code to find if there are other malicous virus.Or,you can check your edit module in your admin page,use text edit mode to find strange links.If you can login your phpadmin page,you can execute this MySQL command:

UPDATE wp_posts SET post_content = replace(post_content, 'COPY THE VIRUS CODE HERE','');

This is to replace the malicious links to blank.But you must execute this for each link.Just like:

UPDATE wp_posts SET post_content = replace(post_content, 'https://VIRUS DOMAIN/v2/0/fovR3B4fjiQSgtNFpGy....','');

UPDATE wp_posts SET post_content = replace(post_content, 'https://VIRUS DOMAIN/v2/0/gemRIkJ9djEBOXuetqaLkIOcy...','');

(Remember to substitute the VIRUS DOMAIN to the real one)

After i search for this,i wonder if your addon’s name is Ultimate Support Chat.It has been reported so you should delete it as fast as you can.However,I didn’t find any other records that related to the link you mentioned.I suggest you reinstall your wordpress,and use other theme.This is a better way.

Kind regards,
Shiroka

My guess without knowing Wordpress well would be that you have an unwanted plugin installed on Wordpress that is adding this. I’d use one of the security scanners that Wordpress has or review your plugins to see if there are any that are there that you do not want there. This site has some info about Wordpress security scanner plugins https://www.wpbeginner.com/wordpress-security/

I would try to install one of the security scanner plugins for Wordpress. It appears you may have a rogue plugin installed that is injecting this script into your site code. That or review your plugin list and see if there are any that you do not specifically want installed. If none of that finds anything, I would go through each plugin one by one and uninstall, refresh, and see if the injection is still there. Those links that Google gave are going to always come back with a 404 response due to how that staleshow.com website is used.