My RSS feed was hacked

My aunt is running an older version of WordPress (2.7). And it looks like someone has hacked her RSS feed. You can see here: https://bit.ly/94xFkG

Someone is inserting a <script> tag just after the </rss> to include a php file form somewhere and it is messing up parsing the XML.

I have looked everywhere to find where they could be inserting this into the feed but can’t find it.

Any help would be appreciated.