In general, the best place to look is in your theme folders, specifically the main theme and in the index.php file. Then the footer and header files.
Also, check your modified dates and start with the most recently modified. Especially if there are several that were all modified around the same date/time.
I've seen, and had to fix, this problem several times on people's servers. The false data is normally loaded via a script inserted into the php files of the template.
First, you should definitely read over the Wordpress FAQ for dealing with a hacked site.
Common entry points for gaining the "access" required to pull the injection off are outdated themes and/or plugins. It's best to run production servers with only the one active theme on the server, as well as removing unused plugins and replacing outdated active plugins.
There are a few scripts out there that you can upload to your server to help you find infected files so you can replace, clean or delete them. (Links listed below)
Again, try looking at file modified dates and check out ones you haven't modified/installed recently yet have a recent date on the.
- Look for Bad Guys : I've used this one. It takes a bunch of configuration to root out all the false positives ... but it can at least help you get a general idea of which files to check out.
- Wordfence offers the ability to scan your files with their free plugin, I can't personally endorse it though, since I haven't used it myself. https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
- Sucuri is linked on the Wordpress forums frequently and they have a plugin for scanning as well, but once again... haven't personally used it. But I'm a hands-on kind of person.