Security Researchers Uncover XSS Vulnerabilities in Popular WordPress Plugins

Security analysts have discovered a coordinated attack that exploits stored cross‑site scripting (XSS) weaknesses in two popular WordPress add‑ons—Ninja Forms and WPC Product Bundles for WooCommerce—to install backdoors and spawn rogue administrator accounts on affected sites.

Stored XSS lets malicious code be written to a server and later run in the browser of anyone who loads the compromised page. In these plugins the flaw lives in input fields that fail to properly cleanse user‑supplied data, permitting an attacker to inject script payloads that execute whenever an administrator opens the plugin’s settings or form editor.

Ninja Forms, a drag‑and‑drop form builder, powers thousands of contact, survey and registration forms throughout the WordPress ecosystem. WPC Product Bundles for WooCommerce, on the other hand, adds bundle‑creation features to the leading e‑commerce platform. Both extensions enjoy high download numbers and are common on sites ranging from modest blogs to large online stores, making them appealing targets for widespread exploitation.

According to exploitation reports, once the injected script fires it can silently drop a PHP backdoor into the site’s file system and then generate a concealed admin user with full rights. This grants threat actors the ability to alter site content, harvest visitor information, or further move laterally to other services on the same server. Because the attack chain piggybacks on legitimate plugin functionality, it often slips past conventional security scanners that rely on known malware signatures.

The developers of both plugins have issued patches that harden input validation and add extra nonce checks. They advise site owners to apply the updates without delay, reset any newly created administrator credentials, and audit user lists for unfamiliar accounts. WordPress’s core team also reiterated that keeping the core platform, themes and all plugins up to date remains the most effective safeguard against such threats.

This episode highlights a wider issue for the WordPress community: the sheer volume of third‑party plugins expands the attack surface, and not every maintainer can address security disclosures quickly enough to protect a global user base. Security professionals recommend regular vulnerability scans, deployment of a web‑application firewall, and limiting plugin installations to those that are actively maintained and broadly reviewed. As the ecosystem grows, coordinated action among developers, hosting providers and end users will be crucial to curb future XSS‑driven intrusion campaigns.