# WordPress Plugin XSS: Ninja Forms & WPC Product Bundles Exploited

> Hackers are exploiting XSS vulnerabilities in Ninja Forms and WPC Product Bundles for WooCommerce to install backdoors and create rogue admin accounts on WordPress sites.

- Published: 2026-10-07T03:20:28.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Ninja Forms, WordPress, XSS, WPC Product Bundles, CVE-2026-94504
- CVEs: CVE-2026-93836 (CVSS 8.8), CVE-2026-94504 (CVSS 8.8)
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/
- Canonical: https://runtimerebel.com/blog/wordpress-plugin-xss-ninja-forms-wpc-product-bundles-exploited

## Key points

- WordPress sites are at risk of hidden administrator accounts and backdoors via actively exploited plugin flaws.
- Affected systems: WordPress sites using Ninja Forms <=3.15.3 or WPC Product Bundles for WooCommerce <=8.6.6.
- Remediation: Update affected plugins immediately and diligently check for signs of compromise, including hidden admin accounts.

Threat actors are actively exploiting stored Cross-Site Scripting ([XSS](/glossary#xss)) vulnerabilities in two popular WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce. These exploits allow attackers to install persistent backdoors and create highly stealthy, rogue administrator accounts on compromised websites. The campaigns, identified by Patchstack researchers in early October, underscore the critical importance of timely patching and vigilant post-compromise detection for WordPress administrators.

## Technical Analysis of WordPress Plugin XSS Exploitation

The identified vulnerabilities affect widely deployed plugins within the WordPress ecosystem. Ninja Forms, used on over 500,000 sites, and WPC Product Bundles for WooCommerce, active on more than 30,000 sites, both suffer from similar XSS flaws that can lead to full site compromise. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/), these vulnerabilities are tracked as [CVE-2026-93836](https://nvd.nist.gov/vuln/detail/CVE-2026-93836) for WPC Product Bundles for WooCommerce versions 8.6.6 and older, and [CVE-2026-94504](https://nvd.nist.gov/vuln/detail/CVE-2026-94504) for Ninja Forms versions 3.15.3 and older.

### [Attack Vector](/glossary#attack-vector) and [Payload](/glossary#payload)

**How attackers [exploit](/glossary#exploit) Ninja Forms [CVE](/glossary#cve)-2026-94504** and similar flaws begins with an authenticated session. The vulnerabilities require a logged-in user to trigger, often meaning an attacker plants malicious JavaScript in data fields processed by the plugins, such as WooCommerce order data or Ninja Forms submissions. When a legitimate, authenticated administrator subsequently views or loads content containing this malicious JavaScript, the script executes within the context of the administrator's session.

The specific JavaScript payload, delivered from the domain `imgcdn1[.]com`, is named `x.js`. Upon execution, it retrieves necessary administrative nonces and leverages legitimate WordPress functions to achieve its objectives. The common origin of this payload for both plugin campaigns strongly suggests a single [threat actor](/glossary#threat-actor) behind these coordinated exploitation attempts.

### Post-Exploitation Tactics and [Persistence](/glossary#persistence)

Once the malicious JavaScript executes, it installs a deceptive plugin, masquerading as "WP Smart Thumbnails" version 1.2.4 from "MediaPress Labs." Concurrently, it creates a hidden, fully privileged administrator account. This rogue account is designed to evade detection: it does not appear in the standard "Users -> All Users" list, is not counted in user totals, and cannot be filtered. This stealth mechanism ensures persistent, undetected access for the attacker.

Beyond the initial compromise, the malicious JavaScript and the installed plugin's PHP scripts establish multiple access mechanisms to the compromised site. Even if the "WP Smart Thumbnails" plugin is identified and removed, the hidden administrator account and a secret login URL persist. This is achieved through separate auxiliary attack plugins that feature backdated timestamps, a technique used to further evade detection and maintain long-term access.

## Actionable Recommendations for Defenders

Defenders must prioritize immediate actions to mitigate these ongoing threats. The stealthy nature of the post-exploitation activities makes both prevention and thorough post-compromise investigation crucial.

### Immediate Patching Guidance

The most critical immediate step for any organization utilizing these plugins is to upgrade to the latest secure versions. For Ninja Forms, upgrade to version 3.15.4 or later. For WPC Product Bundles for WooCommerce, update to version 8.6.7 or later. This action will prevent further exploitation of the identified XSS vulnerabilities. Regular updates are fundamental for effective **WPC Product Bundles for WooCommerce XSS mitigation** and overall WordPress security.

### Post-Compromise Detection and Remediation

Simply updating the vulnerable plugins does not clean an existing infection. WordPress administrators are strongly advised to meticulously check their sites for signs of compromise. Key indicators include:

*   **Hidden Administrator Accounts:** Manually inspect your database for administrator users that do not appear in the WordPress admin dashboard. Focus on users with `wp_capabilities` metadata indicating administrator roles but lacking corresponding `wp_users` entries visible through the standard UI.
*   **Malicious Plugins:** Scan for the "WP Smart Thumbnails" plugin or any unfamiliar plugins, particularly those with backdated timestamps.
*   **Unusual File Activity:** Look for recently modified files in core WordPress directories, especially `wp-content/plugins` and `wp-content/themes`, as well as any unknown JavaScript files or scripts.

Tools designed to **detect hidden WordPress admin accounts after XSS** attacks can be invaluable. Thoroughly auditing user accounts and installed plugins, even after patching, is paramount to ensure complete eradication of the threat actor's persistent access.

**Related:** [BdThemes WordPress Plugin Supply Chain Attack Creates Rogue Admins](/blog/bdthemes-wordpress-plugin-supply-chain-attack-creates-rogue-admins), [CVE-2026-64638: WordPress Pre-Auth XSS Leads to PHP RCE](/blog/cve-2026-64638-wordpress-pre-auth-xss-leads-to-php-rce)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/wordpress-plugin-xss-ninja-forms-wpc-product-bundles-exploited