Ninja Forms, a 500,000-install WordPress plugin, is under active XSS attack
Patchstack found attackers chaining stored XSS bugs in Ninja Forms and WPC Product Bundles to plant four separate backdoors, including a hidden admin account.
Patchstack researchers found attackers actively exploiting stored XSS flaws in two WordPress plugins: Ninja Forms, installed on over 500,000 sites, and WPC Product Bundles for WooCommerce, on more than 30,000. Both bugs let an unauthenticated attacker inject script that runs when an administrator later views the stored data, a WooCommerce order for CVE-2026-93836 or a form submission for CVE-2026-94504.
Patchstack first saw the WPC Product Bundles payload on 4 October and the same payload hitting Ninja Forms the next day, pointing to one threat actor. The script sets up four separate ways back in: a visible rogue admin account, a second admin account hidden from the Users screen via a must-use plugin, a token-based login URL that authenticates as the real site owner, and an unauthenticated file manager buried in the malicious plugin. WPC Product Bundles is fixed in 8.6.7, Ninja Forms in 3.15.4.
Why it matters: updating blocks new infections but doesn’t undo ones that already happened. If you run either plugin, update first, then check the database admin list and the mu-plugins folder for anything you didn’t put there, since Patchstack says cleanup needs a manual look, not just a version bump.