I honestly see most exploits coming through all these horribly written commercial themes that are available. Its amazing how many people with buy or download a theme or plugin from about anywhere versus one that has been reviewed, rated, etc.