Ninja Forms plugin flaw exploited to hack WordPress sites

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts.

Read at the source

Summary written for cymesh.dev. The full article lives at BleepingComputer.

Topics

malware

~/cymesh.net

Certificates expire quietly

cymesh.net watches your TLS and SSL certificates and warns you before one lapses.

monitorsTLS/SSL expiry, chain and hostnamealertsemail, ahead of the expiry datescopenon-intrusive, read-only checks

Talk to us See cymesh.net

~/related/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites-fmdw2

2026-10-06 18:24 UTC[info]

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

The Hacker Newsmalware linux

2026-10-06 15:53 UTC[info]

Alleged ATM malware creator appears in Nebraska court after arrest

The Recordmalware

2026-10-06 13:17 UTC[info]

ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware

The Recordcloud malware

2026-10-06 12:47 UTC[info]

FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware

SecurityWeekmalware

2026-10-06 10:34 UTC[info]

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

SecurityWeeksupply-chain malware

2026-10-05 21:25 UTC[info]

ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

Dark Readingmalware iot linux