Where does someone else's ads come from on a Wordpress site?

Question

Malware

I have a site on wordpress. Initially, I received complaints from readers about ads that make redirects, pop-ups that cannot be closed, and spam. Today I myself noticed such an advertisement on one of the pages. Some links on the site were changed and three unknown banners were installed that led to infected sites. And it was only on the mobile version of the site, I watched it from an iPhone.
I cleared the cache of this particular page and all the ads on the left disappeared immediately. Is it possible that one of the readers has a browser infected and substitutes such advertising, and when he loaded this page into the cache, the version that was displayed with fake advertising was saved to the server? Is this even possible? Or what is the reason for such ads?
All plugins are official, there are purchased direct plugins, in theory there should be no viruses from them, everything is clean.

Answer 1

plugins are official, there are purchased direct plugins, in theory there should be no viruses from them, everything is clean.

Purchased ones can also be dishonest
. Plugins might not be in business - hosting hacking.

Answer 2

Is it possible that one of the readers has a browser infected and substitutes such advertising, and when he loaded this page into the cache, the version that was displayed with fake advertising was saved to the server?

The reader's browser is unable to upload anything to the server.
It is very possible that you installed a theme with "bookmarks", the Internet is full of articles on how to find out. By request "Wordpress hidden links in the topic".