On October 6, 2026, Patchstack published an analysis of a campaign targeting two WordPress plugins: WPC Product Bundles for WooCommerce and Ninja Forms. A script stored in an order or form submission can execute when an administrator views that content. For a retailer or small business, the risk goes beyond the form display: the attack can leave persistent access to the website.
Two plugins in one observed campaign
Patchstack's first observed attempts were on October 4 against WPC Product Bundles and October 5 against Ninja Forms. The campaign uses two stored XSS flaws: malicious content is saved and later interpreted in an administrator's browser.
BleepingComputer and iSec News cover the campaign. The total number of compromised sites is not established. Patchstack's observations should not be turned into a global victim count.
The administrator session provides the foothold
The script uses the existing WordPress session to install a plugin and create access. In Patchstack's analysis, it does not need to steal the cookie to carry out those actions.
This exposes the limits of a password-only response. Even robust authentication cannot independently prevent an action carried out through a legitimate session after the script has executed.
Install the corrected versions
Ninja Forms through 3.15.3 is affected by CVE-2026-94504, with the documented fix in 3.15.4. WPC Product Bundles through 8.6.6 is affected by CVE-2026-93836, fixed in 8.6.7. Have both plugins checked if your website uses them.
Before maintenance, coordinate with your provider to preserve useful evidence and plan the return of forms or checkout functions. Test those functions after installing the patched versions.
Look for access the attack can leave behind
The malicious plugin in this campaign presents itself as wp-smart-thumbnails. The analysis also documents a hidden administrator, must-use plugins in mu-plugins, and a backdoor login mechanism. A concealed account may not appear in the usual user list.
Request examination of the actual database accounts and files. The dashboard alone does not establish site integrity, and deleting the visible plugin does not guarantee removal of every persistence mechanism.
Clean up before resuming privileged access
If the inspection finds compromise, have the added files, accounts and login mechanisms addressed, then handle privileged secrets through the response process. Preserve logs before cleanup removes evidence.
Our guide after a password compromise supports credential replacement planning. A password management review can then clarify who holds access to the website.
The connection with Soclyde
Soclyde keeps distinct credentials in an encrypted vault on your devices. For a shop working with a web provider, this helps locate the required accounts and avoid using one password across several services.
Soclyde does not patch WordPress plugins or remove hidden accounts. Checks and revocation happen in WordPress and with the host. Explore Soclyde features for organising the secrets themselves.
What to remember
Update affected plugins and investigate persistence if an administrator may have opened poisoned content. A corrected version closes the vulnerability; it does not establish that the site is clean. Recovery needs inspection of files, accounts and privileged access together.
Our guide after a password compromise helps you prepare credential replacement.
