Ninja Forms flaw actively exploited to compromise WordPress sites

Cybercriminals have launched a wave of attacks targeting websites running on the popular WordPress content management system. Security researchers report that hackers are actively exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated plugins.

The targeted components include Ninja Forms and WPC Product Bundles for WooCommerce. By leveraging these security flaws, attackers manage to install backdoors and provision rogue administrator accounts on vulnerable web properties.

This incident highlights the ongoing risks associated with third-party plugin ecosystems that power millions of websites globally. Failing to apply timely security patches remains one of the primary vectors for website takeovers.

For website administrators and IT professionals, this serves as a critical reminder to maintain rigorous update schedules and monitor administrative access logs. Proactive vulnerability management is essential to prevent unauthorized access.

Site owners utilizing these specific plugins are urged to update them to the latest patched versions immediately and audit their user databases for any unauthorized administrator accounts.