You know that old saying about the shoemakers children? Well, I’ve been thinking for a while that I’d like to redesign this site – but there were bigger problems than that:
There are a number of good resources about this problem (I was particularly helped by this and this) but the main reason this wan’t spotted earlier was the affected pages only showed up for Googlebot. You can only see the bad stuff if you view the cached Google version, or impersonate Googlebot (for example using this).
Suffice to say I’ve beefed up the security for this site, and I’ll be investigating my other sites as well. What you need to do, if you run WordPress, is read this and this – right now.