Threat actors are actively exploiting stored Cross-Site Scripting (XSS) vulnerabilities in two popular WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce. These exploits allow attackers to install persistent backdoors and create highly stealthy, rogue administrator accounts on compromised websites. The campaigns, identified by Patchstack researchers in early October, underscore the critical importance of timely patching and vigilant post-compromise detection for WordPress administrators.
Technical Analysis of WordPress Plugin XSS Exploitation
The identified vulnerabilities affect widely deployed plugins within the WordPress ecosystem. Ninja Forms, used on over 500,000 sites, and WPC Product Bundles for WooCommerce, active on more than 30,000 sites, both suffer from similar XSS flaws that can lead to full site compromise. According to BleepingComputer, these vulnerabilities are tracked as CVE-2026-93836 for WPC Product Bundles for WooCommerce versions 8.6.6 and older, and CVE-2026-94504 for Ninja Forms versions 3.15.3 and older.
Attack Vector and Payload
How attackers exploit Ninja Forms CVE-2026-94504 and similar flaws begins with an authenticated session. The vulnerabilities require a logged-in user to trigger, often meaning an attacker plants malicious JavaScript in data fields processed by the plugins, such as WooCommerce order data or Ninja Forms submissions. When a legitimate, authenticated administrator subsequently views or loads content containing this malicious JavaScript, the script executes within the context of the administrator’s session.
The specific JavaScript payload, delivered from the domain imgcdn1[.]com, is named x.js. Upon execution, it retrieves necessary administrative nonces and leverages legitimate WordPress functions to achieve its objectives. The common origin of this payload for both plugin campaigns strongly suggests a single threat actor behind these coordinated exploitation attempts.
Post-Exploitation Tactics and Persistence
Once the malicious JavaScript executes, it installs a deceptive plugin, masquerading as “WP Smart Thumbnails” version 1.2.4 from “MediaPress Labs.” Concurrently, it creates a hidden, fully privileged administrator account. This rogue account is designed to evade detection: it does not appear in the standard “Users -> All Users” list, is not counted in user totals, and cannot be filtered. This stealth mechanism ensures persistent, undetected access for the attacker.
Beyond the initial compromise, the malicious JavaScript and the installed plugin’s PHP scripts establish multiple access mechanisms to the compromised site. Even if the “WP Smart Thumbnails” plugin is identified and removed, the hidden administrator account and a secret login URL persist. This is achieved through separate auxiliary attack plugins that feature backdated timestamps, a technique used to further evade detection and maintain long-term access.
Actionable Recommendations for Defenders
Defenders must prioritize immediate actions to mitigate these ongoing threats. The stealthy nature of the post-exploitation activities makes both prevention and thorough post-compromise investigation crucial.
Immediate Patching Guidance
The most critical immediate step for any organization utilizing these plugins is to upgrade to the latest secure versions. For Ninja Forms, upgrade to version 3.15.4 or later. For WPC Product Bundles for WooCommerce, update to version 8.6.7 or later. This action will prevent further exploitation of the identified XSS vulnerabilities. Regular updates are fundamental for effective WPC Product Bundles for WooCommerce XSS mitigation and overall WordPress security.
Post-Compromise Detection and Remediation
Simply updating the vulnerable plugins does not clean an existing infection. WordPress administrators are strongly advised to meticulously check their sites for signs of compromise. Key indicators include:
- Hidden Administrator Accounts: Manually inspect your database for administrator users that do not appear in the WordPress admin dashboard. Focus on users with
wp_capabilitiesmetadata indicating administrator roles but lacking correspondingwp_usersentries visible through the standard UI. - Malicious Plugins: Scan for the “WP Smart Thumbnails” plugin or any unfamiliar plugins, particularly those with backdated timestamps.
- Unusual File Activity: Look for recently modified files in core WordPress directories, especially
wp-content/pluginsandwp-content/themes, as well as any unknown JavaScript files or scripts.
Tools designed to detect hidden WordPress admin accounts after XSS attacks can be invaluable. Thoroughly auditing user accounts and installed plugins, even after patching, is paramount to ensure complete eradication of the threat actor’s persistent access.
Related: BdThemes WordPress Plugin Supply Chain Attack Creates Rogue Admins, CVE-2026-64638: WordPress Pre-Auth XSS Leads to PHP RCE