Remove malware and fake pop-up + update necesary plugins (leaving website functional)

My website www.highpark94.com.co is displaying an annoying popup masquerading as a Chrome update; it is clearly malware/phishing, and I need to eradicate it as soon as possible.

What I expect from your work:

Complete removal of the malicious code and any file, script, or database entry associated with the popup.

Update of all site plugins, themes, and software to close the security vulnerability that allowed the intrusion.

Verification that the page is clean again on services like Google Safe Browsing.

A brief final report containing: infected files, actions taken, the updated version of each component, and best practice recommendations to prevent future attacks.

Available resources:
I have full administrator access (hPanel, FTP, and CMS backend), so I can provide credentials immediately.

Acceptance criteria:
The popup must be permanently removed, the website must load without alerts or redirects, and diagnostic tools must mark it as safe. If you believe that adding extra layers of protection is advisable alongside the updates, we can review that after the initial cleanup.