[HELP!] Hidden external links injected into WP site!

Personally I would download the database and picture folder and dump the entire thing. Then reinstall wordpress and import the pictures and database. After that ONLY use plugins from wordpress and themes from the official wordpress site or a reputable theme provider (considering Asif WILSON Khan said it wasn't updated anymore). Avoid any theme or plugin that is cracked (including from the download section here). Make sure you change wp-admin to something else and use a random 20 char password. Search on google for htaccess security tweaks so people can't just randomly access important configuration files. Make sure you are always on the updates and keep updated about the latest wordpress security bugs. Oh and also make sure that your own PC is secure else you are wasting time with securing your website.