Remove malicious code from website and ensure it does not come back

An old wordpress site not updated for years, is now updated but there is already some code injection. <script type='text/javascript' src='[login to view URL]'></script><script type='text/javascript' src='[login to view URL]'></script><script src='[login to view URL]' type='text/javascript'></script> Shows on most pages/posts at line breaks. 20 more pages to clean, but I thought you might prefer I leave them as you can maybe see a pattern and use edit>replace all in the database, rather than manually editing which is what I was doing. I can provide Website URL FTP access Wordpress login extendCP - not cPanel but similar, which includes PHPMyAdmin MySQL Access Error Logs Job is to clean the code up and ensure the injection cannot happen again, installing wordfence for example. If you feel some / all of the plugins are insecure feel free to recommend different ones. As with all my projects I insist you use this word as your first word in your bid or I will delete it, I am so fed up with autobidding software bidding on projects not even read. So start your bud with the word BUTTER to be considered.