Originally Posted by Sly

I wouldn't focus blame on any one theme or plug-in, this is a "nature of the beast" scenario with WordPress. This is why it's crucial to have any WordPress installations set up in an environment where any malicious injections will not impact other sites. It's also crucial to make sure WordPress, themes and plug-ins are updated at all times.