All plugins belong to the same theme. I don't use any external plugin, or any other theme. All downloaded and updated from the official sites. But I have passed Wordfence and it throws a lot of malware on my host.
See screenshot:
https://prnt.sc/1wzbz2k
Well someone from somewhere might have tried to hacked .Our site wplms.io also gets attacked and sometimes hacked despite all the securities.
Malware usually write directly into theme files which might happen in your case.
You have to change all your usernames and password and you need to reupload all the files wordpress core files , themes and all the plugins files again .The malacious could be anywhere in your site files .
follow : https://sucuri.net/guides/how-to-clean-hacked-wordpress/