URL Injection

I am seeing security message in google search console (webmaster tools) about URL Injection hack on one of the websites. Its adding some variable after site url, like
site_url/?ba=partanea
site_url/ba=calancala
I have checked the database, dont see anything there, deleted old revisions, not used posts etc. I dont see any peace of malware code in db. I run wordfence scan, even enabled high sensitivity and scan binary as executive – no joy
Anyone has ever faced something like that?
When I fetch page (url) as google, I dont see anything strange, not ont the page itself nor source. Tried both desktop and mobile.
Branko