brazilian sites embedding malware into wordpress sites

i just caught http://3ramos.com.br/js/ and some others from the domain .br which asks the viewer to run a java file

you have to manually to the file manager and remove the line from the wordpress theme .
i dont know how they are doing it or if wordpress is vunreable ?