If your editor toolbar suddenly shows only one button, it may be a sign your site was exploited via the vulnerability in JCE Pro versions before 2.9.99.5. An unfamiliar editor profile may have been imported and is now being used instead of your usual one.

Go to Components -> JCE Editor -> Editor Profiles and look for any profile you do not recognise. Select and delete it. This will restore your normal toolbar.

Since you are already on the current version, the priority now is finding out whether the profile was used to upload anything to your site, and removing it if so:

• Check the images folder, and any custom File Directory Path you have set, for .php or .phtml files. Their presence is a strong sign the site was used to upload a payload. Remove any you find, and keep looking, as there may be more than one.
• Ask your host for the access logs and search for index.php?option=com_jce&task=profiles.import. If you want to restore from a backup, this dates the import and tells you which backup predates it.
• Search the same logs for index.php?option=com_jce&task=plugin.display, which is how a file may have been uploaded. Cross-reference the timing against anything you found in the images folder.
• If you restore from backup, restore to a point before the import date, then update JCE to 2.9.99.6 again immediately.
• mySites.guru offer a free file-level scan that will flag suspicious uploads: https://mysites.guru/free-audit/

I would recommend running the free audit offered by mysites.guru - https://mysites.guru/free-audit/