I think I remember reading somewhere recently online that a surprisingly high percentage of spyware on computers is spread from reputable websites; you don't have to visit the Internet's "rough neighborhoods" to get infected. Is this true, and if so, where/how is this documented?
Yes, it's a more common occurrence, and the only documentation I have is my antispyware logs showing rejects for malicious downloader attempts and html page source analysis on a VM that showed iframe injection code to exist on the site.
Wordpress if not properly maintained or secured means you are at risk of going to reputable blog sites only to be sent over to some infection engine that does a pretty thorough scan of your system to profile it for the most likely exploit application.
Cross site scripting also is employed and the site you are on doesn't even have to be compromised or hacked for this to work.
The only documentation I read on this was by anti-malware or virus scanner companies. (Which should be the ones investigating this, but which also makes me doubt whatever they publish as this is in their favour. As we dutch say 'We from WC-Eend recommend WC-Eend to .....').
However there are at least three ways in which malware can get distributes by reputable websites:
If you want to see if a site uses software from other server than the website itself, try the requestpolicy plugin for Firefox. It will give you some insight as to how often scripts and other sources get called from other websites.
The reason why these attacks happen is that websites allow unvalidated input to be entered on the website, and then retrieved later for display. Sometimes this happens because of an insecure webserver, and sometimes they just don't do proper input validation.
This is extremely common on websites such as forums, message boards, and "Comments" sections of content management system (CMS) websites; basically, anywhere that users can enter their own data. Superuser, in fact, is one example of such a site.
There are ways to defend against and/or prevent these attacks, but they're extremely common. The Open Web Application Security Project says that Stored XSS is/was the #2 most dangerous application security flaw in 2010. It provides ways for website owners to attempt to test their website for these vulnerabilities using their tests, for example, here.