The only people I know who were hit by Flashback got it from visiting a website running Wordpress. I’m not quite sure why WP isn’t getting raked over the coals over it.
Actually, it’s because that wouldn’t get as many headline clicks, but still, it needs to be addressed by someone in the tech media.