CTI · reviewed · 2026-10-07

CVE-2026-93836: WooCommerce WPC Product Bundles stored XSS (CVSS 7.2, unauthenticated)

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1505 Server Software Component Persistence
• T1098 Account Manipulation Persistence
• T1204 User Execution Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: WordPress Stored XSS Payload Fetch From imgcdn1.com
id: 7e7e4492-aba4-41d3-817a-77ea4f7a2020
status: experimental
description: >
    Detects connections to imgcdn1.com, the host that serves the shared
    JavaScript payload (x.js) used in the actively exploited stored XSS
    campaign against WPC Product Bundles for WooCommerce (CVE-2026-93836)
    and Ninja Forms (CVE-2026-94504). The same payload is delivered for both
    plugins, and once an administrator views the stored content the script
    pulls WordPress admin nonces and creates rogue administrator accounts or
    installs backdoors.
references:
    - https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/
    - https://www.cve.org/CVERecord?id=CVE-2026-93836
    - https://www.valtersit.com/cve/CVE-2026-93836/
author: Tia N. List
date: 2026-10-07
tags:
    - attack.t1190
    - attack.t1505
logsource:
    category: network_connection
    product: windows
detection:
    selection_payload_host:
        DestinationHostname|endswith:
            - 'imgcdn1.com'
    condition: selection_payload_host
falsepositives:
    - None known; imgcdn1.com is not a mainstream image CDN, confirm ownership before blocking
level: high

References

• https://www.valtersit.com/cve/CVE-2026-93836/
• https://www.cve.org/CVERecord?id=CVE-2026-94504
• https://www.cve.org/CVERecord?id=CVE-2026-93836
• https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/