SignalsMonitor LIVE INTELLIGENCE
SECURITYQUIET

10 days ago

Ninja Forms plugin flaw exploited to hack WordPress sites

SIGNALSMONITORSECURITY

What's happening

SignalsMonitor is following this as a security story. BleepingComputer is the outlet attached so far. The first report grouped here was at 6 Oct 2026, 21:00 UTC. The headline in use is “Ninja Forms plugin flaw exploited to hack WordPress sites”. This note is SignalsMonitor's own briefing, not the publisher's article.

What we know

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...

BleepingComputerRead at BleepingComputer

Story timeline

Reports grouped into this story, earliest first. Exact repeats from the same outlet are collapsed.

Reported by 1 outlet

  • BleepingComputer