Security Researchers Uncover XSS Vulnerabilities in Popular WordPress Plugins

Security analysts have uncovered an organized attack that exploits stored cross‑site scripting (XSS) weaknesses in two popular WordPress add‑ons—Ninja Forms and WPC Product Bundles for WooCommerce—to install backdoors and generate rogue administrator accounts on affected sites.

Stored XSS lets harmful code be stored on a server and subsequently run in the browser of anyone opening the compromised page. With these plugins, the flaw lives in input fields that fail to properly cleanse user‑provided data, permitting an attacker to inject script payloads that execute each time an administrator opens the plugin’s settings or form editor.

Ninja Forms, a drag‑and‑drop form creator, drives thousands of contact, survey and registration forms throughout the WordPress ecosystem. WPC Product Bundles for WooCommerce, on the other hand, provides bundling features for the leading e‑commerce solution. Both extensions boast high download numbers and are commonly deployed on sites from modest blogs to major online retailers, rendering them appealing targets for widespread abuse.

According to exploitation reports, when the malicious script runs it can quietly drop a PHP backdoor into the site’s file system and then generate a concealed admin account with full rights. This enables threat actors to alter site content, siphon visitor information, or move laterally to other services on the same server. Since the attack chain depends on genuine plugin operations, it can slip past many conventional security scanners that look for known malware signatures.

Developers of both add‑ons have issued patches that reinforce input validation and add extra nonce checks. They are urging site owners to install the updates without delay, reset any newly‑created administrator passwords, and audit their user rosters for unfamiliar accounts. WordPress’s core team also reiterated that maintaining the core software, themes and all plugins up to date is the strongest protection against such threats.

The episode highlights a wider problem for the WordPress community: the massive quantity of third‑party plugins expands the attack surface, and not every maintainer can address security disclosures quickly enough to shield a worldwide user base. Security specialists advise routine vulnerability scans, the use of a web‑application firewall, and restricting plugin installations to those that are actively maintained and broadly vetted. As the ecosystem expands, coordinated collaboration among developers, hosting providers and end users will be crucial to curb future XSS‑driven intrusion campaigns.