If you have a good full backup of your website, restore your site from it (recommended). Install and set up WordFence plugin (as in case of no backup).
If you don’t have good backup:
Immediately delete all files from this list. Get a clean copy of your version of WordPress, and clean copy of your theme. Copy over entire theme. Copy over clean /wp-admin/, and /wp-includes/. Start your website. Install WordFence security plugin, activate it, and set up its firewall. Do regular scans to see, if the problem persists, and follow plugin’s instructions.
Third option: if you don’t feel comfortable, performing above steps yourself, ask security pros for help.