[Dismounted]

Most of the time, malicious code (JavaScript) in injected inside a page, this is called XSS (Cross Site Scripting).

The code can get there through the display of user submitted content. If the input is cleaned of bad HTML before being displayed, the output is generally safe, but if not, that content could be interpreted by the browser as HTML. Thankfully, vBulletin has plenty of documentation on input cleaning, and most modification authors adhere to using these APIs.

There are other methods of injecting malicious code, but that gets a little more complex.