Once the threat actors gain access, they use WordPress custom HTML widgets or, more commonly, install the legitimate Simple Custom CSS and JS plugin to inject the malicious JavaScript code.

Beginning September 15, standard site editors will no longer be able to add custom CSS (cascading style sheets) and JavaScript to NEW web page built inside Omni CMS. This is part of a continued effort ...