My site has been compromised

Hi,

This is my site.
https://www.nafdacoversight.com/oversight

I’ve noticed a few things,

1.) The link below the search button I didn’t put there which obviously leads to something malicious.

2.) The javascript error I set up for a php data parse. It says the file “arraydata.php” cannot be found, when it is indeed there, you can click it yourself from the console (if you’re using a debugging tool)

3.) When you do click on arraydata.php, it returns the array I wanted to fetch as intended, but adds a little extra at the end. An <a> tag with the same link found below the search button.

4.) On the wordpress editor, I found a suspicious file named “README_prevv1.php”. Read me’s aren’t php files so… yeah. I deleted that immediately. I backed up the code jargon in case.

Deleting the file didn’t solve my issue so I’m worried there’s still lingering malware somewhere in my site. Any ideas to help tackling this problem would be greatly appreciated. Thank you.