At least 5,000 Wordpress sites are infected with a script that both logs keystrokes and mines cryptocurrency for the attacker(s). If you are running a site on Wordpress, keep it patched, for Pete’s sake.