We got XSS hacked by someone, he did it using one of our plugins. All plugins have been disabled until we know what's wrong.