SQL Injections, etc.

[syrus.xl]

<a href="http://www.avgthreatlabs.com/sitereports/domain/chicitysports.com/" target="_blank">http://www.avgthreatlabs.com/siterep...itysports.com/</a>

A few online scanners are showing it with malicious code. However, that could be Wordpress or vBulletin, you would need to check your databases and file systems of both scripts. Wordpress tends to get attacked more than vBulletin, unless you are using un-official plugins/modifications.

Websites that have been 'hacked' can cost a lot, it all depends on the person that you employ, but usually you are looking at a hourly rate, and they would need to do some indepth searches. Some are easier to repair than others, it really depends on how bad it is.