The hack put code at the top of the header and added a whole page of content to the home page. After looking through the theme files to make sure it wasn’t in there, I deactivated plugins one by one and reactivated them. This was the plugin that caused the problem. I am not sure if it was merely a vulnerability in the plugin or a bad plugin. This incident was on an unrelated site on a different server. I checked the usual suspects like uploads and .htaccess and all were normal. No files on the server had been recently modified that would have caused an issue.
