WordPress Hacked ????

Hi Guys been having problems for a few weeks with Avast Anti Virus who have blacklisted my site. Google or no other virus/malware scanners have black listed the site.

Many of my site users are Avast users and traffic and income is down for me. I have been chasing this up with Avast who now say the following.

The avast alert was for hxtp://www.whitbyseaanglers.co.uk/wp-includes/wp-mail.php
Code hick-up
ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js?ver=3.6.1 benign
[nothing detected] (script) ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js?ver=3.6.1
     status: (referer=wXw.whitbyseaanglers.co.uk/wp-includes/wp-mail.php)saved 92629 bytes ae49e56999d82802727455f0ba83b63acd90a22b
     info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
     info: [decodingLevel=0] found JavaScript
     suspicious:
Read how your site might have been infected: https://digwp.com/2009/06/xmlrpc-php-security/
Core code from WP is mostly secure and updated regularly against insecurities and vulnerabilities,
but there are many plug-ins and extemsions for WP that are less secure and may be vulnerable.
The xmlrpc-php-security issues should be taken up with your hoster as these are web server attacks.
See code
46:< link rel="EditURI" type="application/rsd+xml" title="RSD" href="htxp://www.whitbyseaanglers.co.uk/xmlrpc.php?rsd" />
47:< link rel="wlwmanifest" type="application/wlwmanifest+xml" href="htxp://www.whitbyseaanglers.co.uk/wp-includes/wlwmanifest.xml" />
There is also an issue with this backlink: https://www.eff.org/https-everywhere/atlas/domains/vimeocdn.com.html
see:
GET /p/flash/moogaloop/5.5.0b29/moogaloop.swf?clip_id=62537288 HTTP/1.1
Host: a.vimeocdn.com
HTTP/1.1 200 OK
Content-Type: application/x-shockwave-flash

polonus

Basically this makes no sense to me at all and I dont know what steps are needed to tidy up the site.

Please please please help.