Two unrelated WordPress plugins — Ninja Forms and WPC Product Bundles for WooCommerce — were hit by separate stored XSS vulnerabilities in early October 2026, and both are being used to deliver the exact same malicious JavaScript payload from the same attacker-controlled infrastructure. This isn’t two coincidental attacks; it’s one coordinated campaign using whichever vulnerable plugin a target site happens to have installed, and what the payload actually does once it runs is worth understanding in detail.
The Two Entry Points
| CVE | Plugin | CVSS | Mechanism |
|---|---|---|---|
| CVE-2026-94504 | Ninja Forms (≤3.15.3) | 7.2 | An anonymous, non-rich-text textarea value is stored and rendered without safe HTML encoding in the legacy submission editor — an attacker breaks out of the textarea with a closing tag and persistent script |
| CVE-2026-93836 | WPC Product Bundles for WooCommerce (≤8.6.6) | 7.2 | A quantity field cast to a float strips the leading numeric portion of a payload like “1<img…>” while preserving the script tag, storing it unsanitized in order item metadata and rendering it on page load |
Both are high-severity (7.2), not critical by CVSS score — and both are being actively exploited anyway, which is a useful reminder that severity score alone doesn’t fully capture real-world risk once a working exploitation campaign exists.
What the Payload Actually Does
The injected JavaScript is specifically built as a post-exploitation and persistence implant, designed to execute the moment a logged-in administrator views the affected page. From there it abuses that administrator’s authenticated wp-admin session to: install a malicious plugin, create a new administrator account, invoke a second, hidden persistence mechanism, and report success back to attacker infrastructure. The malicious plugin itself carries an unauthenticated file manager hidden behind seven layers of packing/obfuscation.
The Specific Tricks That Make This Hard to Notice
- The new administrator account is hidden from the Users screen — a routine glance at wp-admin’s user list won’t reveal it.
- A backdoor login URL authenticates as the site’s original owner — the attacker can access the site appearing to be you, not as an obviously separate account.
- Backdoor files are backdated to appear older than the WordPress installation itself — defeating a simple “sort files by modification date” check that would otherwise surface recently-added malicious code.
What to Do Right Now
- Update Ninja Forms to 3.15.4+ and WPC Product Bundles for WooCommerce to 8.6.7+ immediately if either is installed — this closes both entry points.
- Do not assume updating removes an existing infection — given the backdating and hidden-account tricks specifically designed to survive routine cleanup, manual investigation is required if there’s any chance the payload already ran.
- Check for admin accounts not visible on the standard Users screen — this requires a direct database query or a dedicated security scanner, since the hiding mechanism specifically defeats the normal admin UI.
- Don’t trust file modification dates alone when auditing for unfamiliar code — the backdating trick specifically defeats that check; use file integrity monitoring against known-good checksums instead.
- Look for any outbound connections to unfamiliar domains, particularly around the time either plugin was active in a vulnerable state on your site.
This connects directly to our broader coverage in WordPress Malware Detection: Signature-Based vs Behavioral Scanning — this exact campaign is a real-world example of why file integrity monitoring and behavioral detection matter beyond simple signature scans. If you suspect your site is affected, see WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. Want a site checked for this specific campaign? Get in touch.
Frequently Asked Questions
Am I affected if I don’t use Ninja Forms or WPC Product Bundles?
Not by this specific campaign’s current entry points, but the underlying lesson applies broadly: stored XSS in any plugin accepting user input can potentially be weaponized the same way, which is exactly why input sanitization matters regardless of which specific plugin is involved.
Does updating the vulnerable plugin remove an existing backdoor?
No — this is explicitly confirmed for this campaign. Updates close the entry point going forward but do not remove a hidden admin account or backdoor files already installed before you patched.
How would I actually find a hidden admin account?
A direct database query against the users table (rather than relying on the wp-admin Users screen, which the hiding mechanism specifically targets) or a dedicated malware/security scanner built to detect this class of persistence technique.
Featured image: original illustration.