There are instances in other articles, including the latest one from December. It's a WordPress site and the links are baked into the HTML so yes, it's likely running a compromised plugin.