I agree that the Better Search and Replace plugin is great for search/replace of the WP database.
But be aware that there are many other things you need to do to recover a hacked site. There are many places to get that info, but when I do it, I
-
change all credentials/passwords: database, FTP, hosting, admin-level
users -
reinstall WP (from the Updates screen), then reinstall all
plugins/themes from original sources -
Look closely at all files for modified dates that are not ‘right’
(using the hosting/FTP file manager to sort by date is helpful; most
valid files will have similar dates) -
Remove access to the xmlrpc.prg fle – that is a great attack vector
-
Check for any file names that are not expected. And check everywhere.
Details on how I recover from a hacked site are more than can be placed in an answer here. But I’ve detailed my procedure here, which may be helpful. It is possible to recover a hacked site, but it does take some effort. And it will take a while for the search engines to get the changes updated after you fix things.