Code:
two xara .js files were also compromised, not just the html
This is not good at all. I assume you've done a system scan? Cushy CMS sounds great but I won't give anyone my clients server information outside of my server for just this possible out come.

Good luck.