Spam Link Injection

I’ve got an old website using Organize Series to manage blog series. The site has recently seen some spam injection links that appear to only show up on Series pages.

They show up on the individual series page like:

<div class="post-meta fix">
<a href="http://veritasediting.com/approved-viagra-pharmacy/" title="approved viagra pharmacy">approved viagra pharmacy</a>

<div class="post-header fix">

They show up on the series-toc page like:

<div class="serieslist-box">
<a href="http://vertattitudeit.com/index.php/buy-cialis-canada/" title="buy cialis canada">buy cialis canada</a>
<div class="imgset"></div><div class="serieslist-content"><h2><a href="http://blogwebsite here" class="series-579" title="title">Title</a></h2><p></p></div><hr style="clear: left; border: none" /></div>

They show up on select posts (not everything) like:

<div class="entry_wrap fix">

							<div class="entry_content">
<a href="http://niemcy.pl/purchase-viagra-online-canada/" title="purchase viagra online canada">purchase viagra online canada</a>

								<div class="seriesmeta">Part 1 in a ...

This doesn’t appear to be happening on any category pages, so I think it may be related to the Organize Series plugin. The site is running an old version of the plugin, so the first thing I will do is update the plugin from 2.4.5 to 2.4.9. But I’m wondering where you might recommend I look in the plugin files or database to remove the offending links?

https://wordpress.org/plugins/organize-series/