I’ve had a ton of spam links for drugs of various kinds showing up in my header and footer for a long time. I keep deleting them and they keep coming back. They aren’t visible, but they have caused Google to no longer list my site in results even when searching for my specific domain name. I finally hunted down the code that was causing the problem. I don’t claim to know everything about php or WordPress, but maybe my experience will help you.
footer.php file, I found the code
<?php do_action('get footer'); ?> at the bottom of the file just before the
</body> tag. This seemed to be retrieving the spam links in the footer.
I found some help on the WordPress forums, so I guess it’s a known problem.