Ok that would be another indication that this is not injected code. Typically injected code is after the fact. A hacker’s payload contains several different types of files. Some are hidden backdoor files, some can be Shells, some create new files (file regenerators) if you find some of the hacker files and some just do end result stuff like add malicious code/links/code injection. Code injection typically happens repeatedly until you find all of the files in a hacker’s payload.
Logically either these links were included in something you installed or were manually added later by someone who logged into your site. It is also possible that someone could have cracked your FTP password and manually edited files to add these links.
None of the factors/symptoms/etc involved indicate a typical hacker pattern/action. The sites are legitimate sites and for the links not to be hidden/disguised/obfuscated would be a huge risk for them to get their sites blacklisted. Both of these sites are owned by the same person.
My advice to you is change all of your passwords: WordPress, FTP, …
