Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers exploit XSS flaws in Ninja Forms and WPC Product Bundles to install backdoors on WordPress sites.
Hackers are actively exploiting stored XSS vulnerabilities in the popular Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins. These attacks, tracked as CVE-2026-93836 and CVE-2026-94504 respectively, allow threat actors to install backdoors and create hidden administrator accounts on compromised sites. The exploitation involves planting malicious JavaScript that, when executed by an administrator, installs a plugin named 'WP Smart Thumbnails' and establishes multiple persistence mechanisms.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ninja Forms?
Get an email when a new story names Ninja Forms, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonUnpatched stored XSS vulnerabilities in widely used WordPress plugins (Ninja Forms and WPC Product Bundles for WooCommerce) allowed attackers to inject malicious JavaScript that executes silently when an administrator visits the affected page. This client-side attack chain is particularly dangerous because it leverages the elevated privileges of the logged-in admin to install rogue plugins and create hidden administrator accounts, giving attackers persistent, stealthy control. The exploitation highlights a compounding risk: third-party plugins dramatically expand the attack surface of WordPress sites, and delayed patching — even briefly — leaves sites open to automated exploitation campaigns. Once persistence mechanisms are established, full remediation becomes significantly more complex, underscoring why rapid patch cycles and proactive plugin auditing are critical for web asset security.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — WP Smart Thumbnails
- cve — CVE-2026-93836
- cve — CVE-2026-94504