The simple answer is YES and any website can be hacked. Nulled and GPL themes/scripts are not from original developer so there is a posibilty that some individual has inserted a malware or any backdoor script in it.
The solution to that problem is easy. just go to this virus total website and...