Hackers Exploit Ninja Forms Plugin Flaw

Hackers exploit a stored cross-site scripting flaw in Ninja Forms and WPC Product Bundles for WooCommerce plugins. The campaign was identified on October 4 by Patchstack researchers. The Ninja Forms plugin affects over 500,000 sites, while the other plugin impacts more than 30,000 WordPress sites. Attackers deliver malicious JavaScript from imgcdn1[.]com to install backdoors and create rogue admin accounts.