Trojan inside? (No, it’s paypal code)

Are you stealing the passwords from different blogs? Or rather installing a trojan horse to each visitor of the blog who runs this theme?

Don’t be so quick to assume the worst.

If you mean

https://www.plaintxt.org/themes/veryplaintxt/

That looks like part of “Donate with PayPal” input code.

See https://cms.paypal.com/us/cgi-bin/?&cmd=_render-content&content_ID=developer/e_howto_html_donation_buttons for more info.