All cms blocks inserted an unauthorized link with js call as below https://kinfirighbetted.host/d/domain.com.js
Your site is hacked, you should manually remove code from CMS block, also be sure to search complete data base for 'kinfirighbetted' string to be sure that code is not injected in CMS pages as well.
Ask your hosting company to check for recently modified files and you might be able to find what caused issue.
If you add CSP headers, this will prevent that this script will load in the browser. So as long as it's not clear how it's possible and it happens again, you protect your clients with the CSP headers.
See owasp for what a CSP is https://www.owasp.org/index.php/Content_Security_Policy