Sucuri found an exploit in the plugin

Sucuri mis-diagnosed the file, this is a false positive match. The first indication of this is that it thinks it found a PHP exploit in a JavaScript file. Second, they’ve confirmed this false positive in other plugins that use the ACE editor like this one:

1. https://www.wpbeaverbuilder.com/support/q/fyi-for-beaver-builder-security/
2. https://wordpress.org/support/topic/sucuri-detecting-malware-on-421?replies=4

I would contact Sucuri for a fix.