[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz-0exeK7p6yGHrr98CVB7NqfRvAGETt4SakRJgIRec4":3},{"article":4,"iocs":50,"watch_terms":61,"solutions":62,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"0e0ecaeb-5f19-4f91-aab4-5dc249adbcc5","Ninja Forms plugin flaw exploited to hack WordPress sites","ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites-e4f906","Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]","Hackers are actively exploiting stored XSS vulnerabilities in the popular Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins. These attacks, tracked as CVE-2026-93836 and CVE-2026-94504 respectively, allow threat actors to install backdoors and create hidden administrator accounts on compromised sites. The exploitation involves planting malicious JavaScript that, when executed by an administrator, installs a plugin named 'WP Smart Thumbnails' and establishes multiple persistence mechanisms.","Hackers exploit XSS flaws in Ninja Forms and WPC Product Bundles to install backdoors on WordPress sites.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F07\u002FNinjaForms.jpg","2026-10-06T21:00:27+00:00","2026-10-06T22:00:27.088639+00:00",9,[17,20,22,25],{"name":18,"type":19},"Ninja Forms","product",{"name":21,"type":19},"WPC Product Bundles for WooCommerce",{"name":23,"type":24},"WordPress","technology",{"name":26,"type":24},"WooCommerce","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54,58],{"type":44,"value":52,"context":53},"WP Smart Thumbnails","Malicious plugin installed by the attackers.",{"type":55,"value":56,"context":57},"cve","CVE-2026-93836","Vulnerability in WPC Product Bundles for WooCommerce.",{"type":55,"value":59,"context":60},"CVE-2026-94504","Vulnerability in Ninja Forms.",[18,21],{"controls":63,"vendors":148},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"patch-management","Automated patch management","Known holes get closed in days, not months.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":123,"name":124,"problem":125,"products":126},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[127,135,141],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":136,"product_name":137,"url":139,"description":140},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":123,"product_name":145,"url":146,"description":147},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":164},"stored-xss-in-wordpress-plugins-enables-backdoor-installation-and-admin-account-hijacking","Stored XSS in WordPress Plugins Enables Backdoor Installation and Admin Account Hijacking","Unpatched stored XSS vulnerabilities in widely used WordPress plugins (Ninja Forms and WPC Product Bundles for WooCommerce) allowed attackers to inject malicious JavaScript that executes silently when an administrator visits the affected page. This client-side attack chain is particularly dangerous because it leverages the elevated privileges of the logged-in admin to install rogue plugins and create hidden administrator accounts, giving attackers persistent, stealthy control. The exploitation highlights a compounding risk: third-party plugins dramatically expand the attack surface of WordPress sites, and delayed patching — even briefly — leaves sites open to automated exploitation campaigns. Once persistence mechanisms are established, full remediation becomes significantly more complex, underscoring why rapid patch cycles and proactive plugin auditing are critical for web asset security.",[154,155,156,157,158,159,160,161,162,163],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","OWASP Top 10 A03:2021 – Injection (Cross-Site Scripting)","GDPR Article 32 – Security of Processing (integrity and confidentiality of systems)","ITIL – Change Management \u002F Patch Management Practice",{}]