No, that's not what editors do, and yes, you should be worried.
Revert to a clean backup, keep your core and plugins up to date.
Change your WordPress and FTP/SFTP passwords. Make sure that there's not an infected client computer with access to the WP backend.
It might help to install a plugin like WordFence. That won't stop all attacks from happening, or from being successful, but it will stop some of them (mostly the automated ones, which are the absolute majority), and it can help you identify what files are infected.