The Hack Repair Guy

Yes, would appear your calendar app has been compromise, well, that is, unless you are legitimately selling “xanax”

Google see’s:
otc drug interactions with xanax

I would start by ensuring all versions are updated to latest (WordPress and plugins).

Then work to change all your passwords (WordPress, FTP, and email).

If all is updated, go to Dashboard and click Updates. Then re-install now.
That may help to overwrite the core files.

You’ll then need to have someone visually work through your files and remove any back door scripts to fully clean your account.

Once the hacker is in, they are in, and you’ll need to work through all of your files, remove the malicious scripts and code from files, then work to better harden your site moving forward.

One quick technique for WordPress, if you can log in successfully, is to reupdate your existing installation. See Dashboard -> Updates, then click the button ReInstall Now.

While that will not remove all of your hackers’ script hijacking it may help to overwrite your core files and possibly clear some of the egregious code. Of course this won’t touch your theme files. You’ll need to review those for changes carefully as well.

If in need of help, Google is your friend.
Try something like, “website malware repair” or a similar query if looking for help.

Sadly, I often find folks have been compromised for weeks or months before hacker actually does anything malicious. That said, it’s unlikely WordPress is at fault.

About 70% of the sites I’ve seen hacked were simply due to stuff being left outdated for many months at a time. In 20% of cases, the issue was a plugin (like an old revslider or Contact Form plugin).

As an aside, people often have other installations of WordPress or other scripts installed within their account, and never think that maybe another script on my site might be the entry point. I’d say about 5% of accounts are hacked due to forgotten scripts sharing the same account.