page contains a URL that is currently listed on Wordfence’s domain

Hi!

I get this

Title: toddler fleece
Bad URL: http://www.xcdnko.xyz/
Posted on: 2018-03-03 14:49:27
Details: This page contains a URL that is currently listed on Wordfence’s domain blacklist. The URL is: http://www.xcdnko.xyz/

Sure indeed, I checked my posts and there’s a <script> there with a lot of code.

I tried searching and replacing that code using MySQL (https://stackoverflow.com/questions/52249409/how-to-remove-scripts-in-posts-from-an-sql-injection-attack) and a WP plugin (Search & Replace) with no luck.

How can I get rid of that malicious code?