[uberhacked]

Uber told me they used WordPress to build their petition sites. Maybe other WordPress sites are vulnerable?

[noeltock]

WordPress has plenty of functions to sanitize, the one who made the theme or dropped in the form probably overlooked it.