Tia N.List

Reported by 4 outlets

CVE-2026-93836: WooCommerce WPC Product Bundles stored XSS (CVSS 7.2, unauthenticated)

new0.1
Why this score
Breadth
2.00 / 2.0 · 4 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
4.40 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.57 / 0.6 · time to second source
Recency
× 0.01 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.1 / 10 = base × recency + community
valtersit.comcve.orgbleepingcomputer.comsecurityonline.info CVE-2026-93836CVE-2026-94504 desk first seen 15d ago

Desk analysis

Two unrelated WordPress plugin stored-XSS vulnerabilities are being actively exploited in the same campaign to plant hidden admin accounts. WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS 7.2, unauthenticated through 8.6.6) and Ninja Forms (CVE-2026-94504, 3.15.3 and older, installed on 500,000+ sites) both allow stored script injection that executes when an administrator opens a submission or order item. The attacker uses the same JavaScript payload delivered from imgcdn1[.]com to retrieve admin nonces and create rogue accounts. Both flaws are tracked by Wordfence and CISA entries note active exploitation; patches exist for Ninja Forms and WPC Product Bundles should be updated to fixed versions. Over 30,000 sites run the WooCommerce bundle plugin.

Watch for backdoor scripts in WooCommerce order metadata or Ninja Forms submission data, and verify plugin versions. The campaign started around October 4 against WPC Product Bundles and expanded to Ninja Forms the next day, indicating coordinated use of the same actor infrastructure rather than separate incidents.

Timeline

  1. original reporting

    CVE-2026-93836 WooCommerce WPC Product Bundles stored XSS via qty param, CVSS 7.2, unauthenticated, no patch yet. Update now: https://www. v

    www.valtersit.com · 15d ago · September 28th, 2026

    CVE-2026-93836 WooCommerce WPC Product Bundles stored XSS via qty param, CVSS 7.2, unauthenticated, no patch yet. Update now: https://www. v

    via Mastodon https://www.valtersit.com/cve/CVE-2026-93836/

  2. update from cve.org

    CVE-2026-94504: Ninja Forms <= 3.15.3 - Stored Cross-Site Scripting

    cve.org · 21d ago · September 22nd, 2026

    Wordfence published this record as CNA on 2026-09-22, with vendor notification on 2026-09-11 and public disclosure on 2026-09-21, crediting Hippolyte Quéré (Hippie). Ninja Forms 3.15.3 and older store an anonymous non-RTE textarea value and render it without safe HTML encoding in the legacy submission editor, letting an attacker break out of the textarea with stored script that executes when an administrator opens the attacker-known direct submission URL.

  3. update from cve.org

    CVE-2026-93836: WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter

    cve.org · 21d ago · September 22nd, 2026

    Wordfence published the CVE record as CNA on 2026-09-22 after notifying vendor wpclever on 2026-09-18 and disclosing publicly on 2026-09-21, crediting researcher lhking. The record describes stored XSS via the qty parameter in versions through 8.6.6: a float cast during quantity validation lets numeric-prefixed payloads such as 1<img src=x onerror=...> pass, and the markup is stored verbatim in order item metadata under the _woosb_ids key. CVSS 3.1 base score is 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, and the CISA vulnrichment entry at publication marked exploitation as none.

  4. update from bleepingcomputer.com

    Ninja Forms plugin flaw exploited to hack WordPress sites

    bleepingcomputer.com · 7d ago · October 6th, 2026

    Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. Both vulnerabilities received a high severity score and require an authenticated session to exploit. The Ninja Forms plugin for WordPress is installed on more than 500,000 sites and allows creating custom forms without writing code. The campaign was identified on October 4 by researchers at WordPress security platform Patchstack, against users of WPC Product Bundles for WooCommerce. The next day, the same activity was observed against Ninja Forms. In both attacks, the same JavaScript payload was delivered from ‘imgcdn1[.]com,’ indicating the same threat actor behind the exploitation attempts against the two plugins. According to the researchers, the attacker tries to plant malicious JavaScript ( x.js ) in WooCommerce order data or Ninja Forms submissions. When a logged-in administrator loads the content, the script executes using the authenticated WordPress session. When launched, it retrieves the necessary administrative nonces and uses legitimate WordPress func

  5. mentioned by www.bleepingcomputer.com

    🤖 Actively exploited: stored XSS in two WordPress plugins — Ninja Forms (CVE-2026-93836) and WPC Product Bundles for WooCommerce (CVE-2026-9

    www.bleepingcomputer.com · 7d ago · October 6th, 2026

  6. update from www.bleepingcomputer.com

    Actively exploited Ninja Forms flaw used to compromise WordPress sites

    www.bleepingcomputer.com · 7d ago · October 6th, 2026

    A vulnerability in the Ninja Forms WordPress plugin is being actively exploited to compromise WordPress sites. The usual reminder applies: third-party plugins e

    Translated from French. Original: https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/

  7. update from www.bleepingcomputer.com

    If you run a website using WordPress, check your plugins today. A security flaw in Ninja Forms and WPC Product Bundles is being used to take

    www.bleepingcomputer.com · 7d ago · October 7th, 2026

    If you run a website using WordPress, check your plugins today.

  8. mentioned by www.bleepingcomputer.com

    # NinjaForms plugin flaw exploited to hack # WordPress sites https://www. bleepingcomputer.com/news/secu rity/ninja-forms-plugin-flaw-exploi

    www.bleepingcomputer.com · 6d ago · October 7th, 2026

  9. mentioned by securityonline.info

    An active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now. # Wo

    securityonline.info · 6d ago · October 8th, 2026

Source on GitHub