On this page (7 sections)
Patchstack reports an active campaign in which one JavaScript payload is delivered through stored cross-site scripting (XSS) flaws in two unrelated WordPress plugins: Ninja Forms and WPC Product Bundles for WooCommerce. When a logged-in administrator's browser runs the script, it installs a malicious plugin and creates an administrator account that does not show up on the Users screen. Details are in the Patchstack analysis, published October 6, 2026.
If you run Ninja Forms or WPC Product Bundles, or manage sites that do, you should update and check for signs of compromise. So far only one independent publisher covers this story, and the points below come from that single source.
What Patchstack observed
Patchstack says it first saw the payload on October 4, 2026, in an attempt against CVE-2026-93836 in WPC Product Bundles for WooCommerce. On October 5 it saw the same payload delivered through CVE-2026-94504 in Ninja Forms. Both attempts load a script from imgcdn1.com. Patchstack stresses that two is the number it has confirmed, not the number it expects the final count to be, so other plugins with similar flaws may be used the same way.
Patchstack describes the two entry points like this:
- WPC Product Bundles (through 8.6.6): a quantity value that starts with a valid number passes validation while keeping extra attacker-controlled markup. The value can be stored in WooCommerce order metadata and later rendered unsafely.
- Ninja Forms (through 3.15.3): attacker-controlled text from non-rich-text textarea submissions can be rendered without safe HTML encoding in the legacy administrative submission editor. When an admin views the submission, the script can run in the WordPress admin origin.
Why stored XSS becomes a full takeover
Stored XSS means the attacker saves content on your site that later runs as script in someone else's browser. Here the attacker does not need a password. They only need a privileged user to open the page that displays the poisoned data, such as an order or a form submission.
According to Patchstack, the retrieved script is not a scanner or proof of concept but a post-exploitation and persistence implant. It uses the administrator's existing authenticated session and normal WordPress admin functions, so no second server-side vulnerability is needed. Per the report, it installs a malicious plugin, creates a new administrator, runs an additional hidden persistence mechanism, and reports back to attacker infrastructure.
Patchstack's analysis of the dropped plugin found:
- an unauthenticated file manager hidden behind seven layers of packing
- a script that creates an administrator hidden from the Users screen
- a backdoor login URL that authenticates as the site's original owner
- files backdated so they look older than the WordPress installation itself
The practical lesson is that updating the plugin afterwards does not remove a backdoor that has already been planted.
Who is realistically exposed
Patchstack lists roughly 30K installs for WPC Product Bundles and 500K for Ninja Forms. Exposure is highest where an administrator regularly opens submissions or orders in wp-admin, since that is when the stored script fires. Sites on the affected versions that received suspicious submissions or orders since early October deserve a closer look, even if nothing seems wrong.
How to check your site
This WP-CLI command lists installed plugins with their versions. Run it from your WordPress directory and compare Ninja Forms against 3.15.4 and WPC Product Bundles against 8.6.6.
wp plugin list --fields=name,status,version,updateNext, list administrators. Because the attacker's account is described as hidden from the Users screen, the wp-admin list alone may not be trustworthy. A WP-CLI listing reads from the database, but it may also be filtered by code on a compromised site, so compare it with a direct database view if you can.
wp user list --role=administrator --fields=ID,user_login,user_email,user_registeredLook for accounts you do not recognize and registration dates since October 4, 2026. Also check for unfamiliar plugins and for references to the attacker's domain in stored content and server logs.
grep -E "imgcdn1\.com|nf_ajax_submit" /var/log/nginx/access.logA hit on nf_ajax_submit alone is normal for any site using Ninja Forms, because it is the regular form endpoint. It is only useful for narrowing down which submissions to review. The domain imgcdn1.com appearing in form entries, order notes or order metadata is a strong warning sign. Patchstack lists https://imgcdn1.com/fz/x.js and https://imgcdn1.com/fz/c.php as the payload and command server addresses.
What to do now
0 of 9 done
For a structured response, see our guide on what to do when a website is hacked and the WordPress security checklist. You can also run the free malware scanner, keeping in mind that outside-in detection has limits and cannot see everything inside your server.
Detection and hardening afterwards
- Restrict who has administrator rights, and have admins avoid browsing untrusted content in the same session as wp-admin.
- Keep plugins updated and remove ones you no longer use. Our plugin vulnerability tracker and the guide on checking whether a plugin is vulnerable help.
- Consider a web application firewall as one layer; see what a WAF is.
- Watch for unexpected changes to your site, such as new scripts or changed headers, with monitoring like Webforta Monitor.
A content security policy that limits which domains scripts can load from can also reduce the impact of injected script tags. Our security headers explainer covers the basics, though it is not a substitute for patching.
What is still unconfirmed
Only Patchstack reports this campaign so far, and its vendor advisory field points to upstream changelogs only. The scale of compromise, the attackers' identity and the full list of plugins used are not established. Patchstack itself says more flaws may be involved. We will treat any additional plugins as unconfirmed until sources name them.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.