Stored XSS Vulnerabilities in Ninja Forms and WPC Product Bundles Exploited to Compromise WordPress Sites

According to recent reporting, two separate WordPress plugins—Ninja Forms and WPC Product Bundles for WooCommerce—contain stored cross-site scripting vulnerabilities that are currently being exploited by threat actors. Stored XSS allows attackers to inject malicious code that executes when a user or administrator views a compromised page or post. In these active campaigns, the exploitation has led to the installation of web shells or backdoors and the creation of new rogue administrator-level user accounts. The vulnerabilities affect websites running the specified plugin versions, though exact version ranges and CVE identifiers were not detailed in the initial reports. Both Automattic (which oversees WooCommerce) and the Ninja Forms development team are reportedly aware of the issues. Mitigation guidance emphasizes immediate updating of the plugins to the latest patched versions, if available, and enforcing strict input validation and output encoding practices. Website administrators are advised to review user accounts for any unauthorized administrators and monitor for suspicious activity.