Resolved web site hacks

[klockstone]

I've come across 2 holiday accommodation web sites that seem to be compromised by gaming equipment ads. To see this, Google on 'Malston Mill' and 'Dittiscombe'. Both have the correct link in to their sites, but short description is nothing to do with them. Click on the 3 dots and you'll see their caches have been taken over by the advert.

Does anyone know how this exploit works and if the Plesk system is resistant? How do you get rid of this?

Duckduckgo and Mojeek don't seem to have the same problem.

Keith Lockstone

 

[Monty]

I see no indication that those websites are running on a server with Plesk, they appear to be running on servers with a different control panel.
So Plesk most likely has no relation to those websites.
Note: Both websites are running with Wordpress so the hack was very likely made through outdated/insecure Wordpress installations and/or plugins.

 

[klockstone]

I looked at the source and Malston Mill seems to be running WordPress 4.9.22 and Dittiscombe WordPress 5.6.10. Both have been compromised.

I've notified both (I know one of the owners) but have had no reply so far.