Remember to follow rule number one when you discover foreign code on your site:
1) Do not panic.
This one of the pretty common “hacks” I’d run across while maintaining WordPress Sites for my last contract. If this was inserted onto every page, post, etc then your database was compromised possibly. Changing the Password is recommended, note you’ll need to update your WordPress config file manually with the new password. Also you may want to look into securing your wp-config file, it can be placed outside of the web-root. You could also deny access to the file via the htaccess file.
Check your plugins also, one of them may have been compromised which allowed the someone access to your database. I was using the category-page plugin on one site which I later parsed through the entire plugin and found it was compromised.
Media Temple has a guide to cleaning up your database if that is your host, pretty simple SQL method of finding something like that iframe and removing them.
Good luck, if you have and questions ask.
