Do you run backups? I'd look at restoring to some time before the exploit occurred, and running a full security audit immediately. Lock down SSH if you have it, turn off FTP at least temporarily (you should be using sFTP anyways) and scan for XSS vulnerabilities asap.

__________________
uʍop ǝpısdn sı ɹǝʇndɯoɔ ɹnoʎ sıɥʇ pɐǝɹ uɐɔ noʎ ɟı