There are several possibilities: - you downloaded and installed a hacked plugin that executes hidden codes - the site was hacked. This happens because the website is not updated, and does not have a firewall installed - an infected file from the personal computer was uploaded to the website - the server you are hosting on was attacked by malicious people. This is less common.