Active Attack Campaigns Target Ninja Forms and WPC Product Bundles Plugins

October 11, 2026 Qamar Abbas 8 min read

Active Attack Campaigns Target Ninja Forms and WPC Product Bundles Plugins

The Ninja Forms XSS campaign is a live, active attack operation: security firm Patchstack confirmed stored cross-site scripting flaws in Ninja Forms (CVE-2026-94504, versions 3.15.3 and older — over 500,000 sites) and WPC Product Bundles for WooCommerce (CVE-2026-93836, versions 8.6.6 and earlier — over 30,000 sites) being exploited on October 4 and 5, 2026. Both attacks deliver the identical JavaScript payload from the domain imgcdn1.com, install a fake “WP Smart Thumbnails” plugin, and establish four separate backdoor access mechanisms — including an administrator account hidden from the WordPress user list. The Ninja Forms XSS campaign is a full site-takeover operation, and unpatched sites are exposed to it right now.

What Happened: the Ninja Forms XSS Campaign

Patchstack’s researchers first observed the Ninja Forms XSS campaign on October 4, 2026, at 10:39 UTC, when attack requests targeted a WooCommerce product URL and delivered a malicious loader through the woosb_ids parameter — the URL-encoded value containing a <script> tag pointing at imgcdn1.com/fz/x.js. That first wave hit WPC Product Bundles for WooCommerce (CVE-2026-93836). The very next day, October 5, the same infrastructure pivoted to Ninja Forms (CVE-2026-94504), with the identical payload and the identical objective.

The Ninja Forms XSS campaign’s attack chain is a study in how stored XSS becomes total compromise. The attacker plants the malicious JavaScript in WooCommerce order data or in Ninja Forms submissions. Nothing happens until a logged-in administrator views the poisoned content — at which point the script executes inside the administrator’s own authenticated WordPress session. It then retrieves the necessary administrative nonces and abuses legitimate WordPress functions to install a malicious plugin masquerading as “WP Smart Thumbnails” version 1.2.4, supposedly from “MediaPress Labs.” From there, the Ninja Forms XSS campaign’s payload establishes four persistence mechanisms: a visible administrator account, an administrator account concealed from the WordPress Users dashboard, a secret login URL that authenticates as the site’s oldest existing administrator, and an unauthenticated file manager.

The operational tradecraft is unusually careful. The Ninja Forms XSS campaign backdates its files to the oldest WordPress-root timestamp, which makes filesystem modification-time review unreliable — defenders who sort by “recently modified” will walk right past the implants. The fake plugin ships a packed file manager and an emergency runner, uses two must-use plugin paths, and adds a token-based login route (/?_wplogin=<token>). The source IPs differ across attempts — four of five observed addresses are Tor exit nodes — while the second-stage infrastructure and malware stay identical, consistent with scanning spread across several hosts behind one centralized payload and command server. The timing, Patchstack notes, fits infrastructure stood up specifically for this campaign. One IP, 43.250.53.42, also appears in the separate CVE-2026-87902 WordPress core exploitation wave, suggesting shared operator tooling.

Who Is Affected by the Ninja Forms XSS Campaign

The Ninja Forms XSS campaign’s target pools are enormous and asymmetric. Ninja Forms is installed on more than 500,000 sites — one of the most popular form builders in the ecosystem, running on business contact pages, lead-generation forms, and customer surveys. WPC Product Bundles for WooCommerce, at more than 30,000 active installations, puts revenue directly in the blast radius: compromised WooCommerce stores risk order-data theft and payment-flow tampering on top of the site takeover itself.

Both vulnerabilities require an authenticated session to inject the payload — the attacker needs some low-level account or an exploitable submission path — but that is a thin defense. Form builders and WooCommerce stores are designed to accept input from strangers; a “requires authentication” checkbox on the CVE does not make half a million sites safe. Patchstack’s telemetry showed limited exploitation volume at publication, but the firm explicitly warns that neither that number nor the two confirmed plugins is a ceiling: the post-exploitation stage is plugin-agnostic, so any stored XSS that puts JavaScript in front of a WordPress administrator is a candidate vector for the same implant. The Ninja Forms XSS campaign is a template, not a one-off.

Why the Ninja Forms XSS Campaign Matters

The Ninja Forms XSS campaign matters because it breaks the two assumptions defenders lean on most. First, that deleting a malicious plugin ends the incident: here, removing the fake “WP Smart Thumbnails” plugin does not remove the hidden administrator account, the secret login URL, or the file manager. Second, that timestamps tell you what changed: the campaign deliberately backdates files, so “show me everything modified this week” returns nothing suspicious. Incident responders must hunt with request logs, DNS evidence, file hashes, and Syslog data instead of relying on modification times — a fundamentally more expensive investigation.

It also matters because the payload design is reusable. The implant does not care which plugin delivered it; once JavaScript runs in an administrator’s browser, the same four-access-mechanism playbook applies. Every stored XSS in every WordPress plugin is now a potential entry point for this exact backdoor kit. And with over 500,000 Ninja Forms installations, the Ninja Forms XSS campaign only needs a fraction of unpatched sites to maintain a large, persistent botnet of compromised WordPress installations — hosting SEO spam, phishing pages, or serving as launchpads for further attacks.

What to Do Now After the Ninja Forms XSS Campaign

If you run either plugin, treat the Ninja Forms XSS campaign as an active-threat response, not a routine update.

Update Ninja Forms to 3.15.4 or later and WPC Product Bundles for WooCommerce to 8.6.7 or later immediately. These are the fixed versions that close CVE-2026-94504 and CVE-2026-93836.
Hunt for the known indicators of the Ninja Forms XSS campaign. Search your user list (including via the database, not just wp-admin) for unknown administrator accounts; check for a plugin named “WP Smart Thumbnails” by “MediaPress Labs”; look for /?_wplogin= access patterns and requests to imgcdn1.com in your logs.
Do not trust file timestamps. The Ninja Forms XSS campaign backdates files — verify integrity against known-good copies or a clean reinstall instead of sorting by modification date.
Assume persistence beyond the plugin. If you find any implant, rotate all administrator passwords, revoke and regenerate salts in wp-config.php, and audit must-use plugins and the uploads directory for the packed file manager and emergency runner.
Rebuild if the backdoor was fully established. Security guidance for this class of compromise is blunt: if a web shell or rogue admin existed, assume configuration, certificates, and stored credentials are exposed — rebuild from clean sources, then rotate everything.
Block the delivery infrastructure at the firewall and DNS level. Patchstack’s published indicators (the imgcdn1.com payload domain and the observed source IPs) are worth blocking, though Tor-exit sourcing means IP blocking alone is not durable.
Get professional incident response on retainer. The Ninja Forms XSS campaign is exactly the kind of multi-stage compromise where cleanup has to be complete to count. Qamar Digital Ventures LLC‘s website care plans include malware scanning, emergency patching, and rapid response — visit https://qamardigitalventuresllc.com/ to get protected.

Ninja Forms XSS Campaign: Frequently Asked Questions

What is the Ninja Forms XSS campaign?
An active attack operation first observed October 4–5, 2026, exploiting stored XSS flaws in WPC Product Bundles for WooCommerce (CVE-2026-93836) and Ninja Forms (CVE-2026-94504). Attackers inject JavaScript from imgcdn1.com into order data or form submissions; when an administrator views it, the payload installs a fake “WP Smart Thumbnails” plugin and creates hidden backdoor access.

Which versions are affected?
Ninja Forms 3.15.3 and older (fixed in 3.15.4); WPC Product Bundles for WooCommerce 8.6.6 and older (fixed in 8.6.7). Both flaws are rated high severity and require an authenticated session to plant the initial payload.

Why is this worse than a typical XSS?
Because of the persistence design: the Ninja Forms XSS campaign establishes four access mechanisms (visible admin, hidden admin, secret login URL, unauthenticated file manager), backdates files to defeat timestamp review, and survives deletion of the fake plugin. Cleaning the plugin alone leaves the backdoors in place.

How do I check if my site was hit?
Look for unknown admin accounts (check the database directly), the fake “WP Smart Thumbnails” plugin, ?_wplogin= login-route hits, and imgcdn1.com references in logs. Because of timestamp backdating, compare files against clean copies rather than trusting modification dates.

Ninja Forms XSS Campaign: Conclusion

The Ninja Forms XSS campaign is the shape of modern WordPress attacks: a stored XSS entry point, a payload engineered for persistence rather than smash-and-grab, and tradecraft — hidden admins, backdated timestamps, token login routes — designed to survive casual cleanup. With more than 500,000 Ninja Forms installations and 30,000-plus WPC Product Bundles stores in the target pool, the campaign’s two confirmed plugins are almost certainly not its final list; Patchstack warns explicitly that any stored XSS reaching an administrator’s browser can carry the same implant. The fixes are simple — Ninja Forms 3.15.4, WPC Product Bundles 8.6.7 — but the response discipline has to match the attacker’s: verify users at the database level, distrust timestamps, and assume that finding one backdoor means looking for the other three.

Multi-stage compromises like the Ninja Forms XSS campaign are why reactive patching is not enough. Qamar Digital Ventures LLC’s website care plans pair same-day updates with malware scanning and rapid incident response, so a campaign like this gets caught at the payload stage — not months later. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to discuss a care plan for your site.

Sources

Free website & SEO audit

Want results like these?

Get a plain-English teardown of your website and Google visibility — what is broken, what to fix first, and what it would take to outrank your competitors in Albuquerque.

Get My Free Audit

No pressure, no 40-page PDF. Real answers.