The Ninja Forms flaw is being used in live campaigns, with threat actors leveraging the XSS to inject malicious scripts that persist on compromised pages. Because the injection is stored, the payload executes for any visitor loading the affected content, giving attackers a foothold to escalate access. In parallel, the WPC Product Bundles for WooCommerce vulnerability is being abused for the same purpose, despite the two plugins having no connection to one another.

Once exploitation succeeds, the attackers move to establish persistence and control:

• Deploying backdoors for continued access
• Creating unauthorized admin accounts
• Maintaining long-term control over the compromised WordPress installation

Site operators running either plugin should treat this as an active threat. Given the nature of stored XSS, simply removing visible malicious content is not enough — a full compromise assessment is warranted.

Neither the article nor the advisory provides a specific CVE identifier for either flaw, so no CVE is cited here. Administrators should check vendor advisories and update both plugins to their latest patched versions as a priority.

Source: Bleeping Computer

If your organization runs either of these plugins, have you already patched and audited for rogue admin accounts?