Header.php hacked to include script tag following body tag

Immediately following the body tag in my header.php I had a script tag that caused the page to redirect to spam. I only noticed it this morning but it may have been there longer.

It has appeared in all my themes including the default theme, and all child themes. It has affected multiple wordpress installs too. I have removed the offending line in the code but I don’t know how it got there so feel like I’m just waiting for it to reappear ?? One of my sites affected was in early development and only had 7 plugins installed: Akismet, Hostgator WalkMe, Jetpack, Mojo Marketplace, Password Protected, WordPress Seo and WP Super Cache. Are any of these known to have a vulnerability?? Only Jetpack, Mojo and Password Protect are active.