Wordpress plugins get injected with crap all the time, same with joomla, pretty much any site running a super old php version with their CMS, etc.