Exploitation observed; activity peaked at 7 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-22 | 1 | Patch1 |
| 2026-09-24 | 2 | PoC2 |
| 2026-09-28 | 1 | Patch1 |
| 2026-10-06 | 1 | Active Exploitation1 |
| 2026-10-07 | 7 | Active Exploitation6PoC1 |
| 2026-10-08 | 5 | Active Exploitation5 |
| 2026-10-12 | 1 | Active Exploitation1 |
| 2026-10-22 | 1 | Active Exploitation1 |
WordPress「Ninja Forms」の脆弱性 CVE-2026-94504がサイバー攻撃に悪用 https://rocket-boys.co.jp/security-measures-lab/ninja-forms-cve-2026-94504-active-exploitation/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
Post summary
The tweet reports that CVE-2026-94504 in the WordPress Ninja Forms plugin is actively being exploited in cyber attacks, directing readers to a security news article for further details.
🔴 CVE-2026-94504 (CVSS 7.2) – WordPress Ninja Forms eklentisinde ≤3.15.3 sürümlerinde kimlik doğrulama gerektirmeyen Stored XSS açığı için PoC yayınlandı. Açık, herkese açık form üzerinden payload'ın submission'a kaydedilmesine ve ilgili kayıt WordPress admin panelinde açıldığında JavaScript çalıştırılmasına neden oluyor. Bu açığın yamalandığı eklenti sürümü: 3.15.4 https://github.com/cflowsec/cve-2026-94504
Post summary
The tweet announces a public PoC for an unauthenticated Stored XSS in WordPress Ninja Forms <=3.15.3, provides exploitation details, and notes the fixed plugin version 3.15.4.
🚨 HACKERS EXPLOIT NINJA FORMS AND WPC PRODUCT BUNDLES XSS FLAWS TO PLANT HIDDEN WORDPRESS ADMINS Patchstack reports an active campaign abusing two stored XSS bugs in unrelated WordPress plugins, both delivering the same JavaScript payload from imgcdn1[.]com. • CVE-2026-94504: Ninja Forms ≤ 3.15.3 (500K+ installs), fixed in 3.15.4 • CVE-2026-93836: WPC Product Bundles for WooCommerce ≤ 8.6.6 (30K+ installs), fixed in 8.6.7 • Both rated CVSS 7.1; the payload is injected without login and fires when an admin views the poisoned submission or order • It installs a fake "WP Smart Thumbnails" plugin, creates a visible admin plus one hidden from the Users screen, adds a secret login URL and an unauthenticated file manager • First seen Oct 4 (WPC) and Oct 5 (Ninja Forms) ⚠️ Analyst Note: Patchstack says exploitation is limited so far, and neither CVE is in CISA KEV at handoff. Updating stops new infections but does not remove an existing one: check for unknown admins, must-use plugins and the fake thumbnail plugin. Primary: https://patchstack.com/articles/four-ways-back-in-the-wordpress-xss-campaign-that-hides-its-own-admin-account/ #DDW #DarkWeb #CyberSecurity #WordPress #CVE #PatchNow
Post summary
The text reports an active exploitation campaign leveraging two stored XSS vulnerabilities in WordPress plugins (CVE-2026-94504 and CVE-2026-93836) to install hidden admin accounts, noting patches are available but existing compromises require manual remediation.
Two WordPress stored XSS flaws are being chained to plant hidden admin accounts. CVE-2026-94504 has a public exploit, while CVE-2026-93836 has no known public exploit. Both are CVSS 7.2. #WordPress #CyberSecurity https://t.co/nJiTSWuexf
Post summary
The post reports two WordPress stored XSS flaws being chained to plant hidden admin accounts, notes a public exploit for CVE-2026-94504, and gives both CVEs a CVSS score of 7.2. It does not mention a patch or workaround.
Attackers exploit Ninja Forms and WPC Product Bundles stored-XSS flaws to plant hidden WordPress admin backdoors — Patchstack reports a single actor exploiting CVE-2026-94504 (Ninja Forms 3.15.3… #CyberSecurity #InfoSec https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/
Post summary
The text reports that attackers are exploiting a Ninja Forms stored-XSS flaw to plant hidden WordPress admin backdoors. No PoC, named exploit tool, or remediation is mentioned.
WordPress「Ninja Forms」の脆弱性 CVE-2026-94504がサイバー攻撃に悪用 https://rocket-boys.co.jp/security-measures-lab/ninja-forms-cve-2026-94504-active-exploitation/
Post summary
The tweet reports that CVE-2026-94504 in the WordPress Ninja Forms plugin is actively being exploited in cyber attacks.
WordPress Sitelerinde Ninja Forms Açığı Üzerinden Saldırılar Başladı WordPress sitelerinde kullanılan Ninja Forms ile WPC Product Bundles for WooCommerce eklentilerindeki yüksek önem dereceli XSS açıkları saldırılarda kullanılmaya başlandı. CVE-2026-94504 ve CVE-2026-93836 olarak izlenen açıklar, oturum açmış kullanıcıların gerçekleştirebildiği sa https://www.cozumpark.com/wordpress-sitelerinde-ninja-forms-acigi-uzerinden-saldirilar-basladi
Post summary
The text reports that high-severity XSS vulnerabilities CVE-2026-94504 and CVE-2026-93836 in Ninja Forms and WPC Product Bundles for WooCommerce are actively being exploited in attacks on WordPress sites. No PoC, exploit tool, patch, or debunking claim is provided.
Active attack on 530,000+ WordPress sites: Ninja Forms and WPC Product Bundles XSS. → Unauthenticated stored XSS (CVE-2026-94504 and CVE-2026-93836), exploited in the wild per Patchstack → The payload waits in a form entry or order until an admin opens it → It rides the admin's session, so it never needs to steal a cookie → One hit can leave four ways back in, including a hidden admin → Run Ninja Forms 3.15.5 (not just 3.15.4) and the latest WPC Product Bundles (8.7.3) → Check with SQL and the file system, not the Users screen, then rotate salts and credentials https://magicwp.io/blog/ninja-forms-wpc-product-bundles-xss-campaign
Post summary
The post reports an active in-the-wild XSS campaign on Ninja Forms and WPC Product Bundles, describing an unauthenticated stored XSS payload that waits for an admin; it also names patched versions.
WordPressのフォームに仕込んだ1行で、管理者が作られる攻撃が実際に起きていたのでメモ。 何が起きたか ・Ninja Forms（CVE-2026-94504）と WPC Product Bundles（CVE-2026-93836）、どちらも保存型XSS ・問い合わせ内容や注文データに不正なJavaScriptを保存しておく ・管理者が管理画面でそれを開いた瞬間、本人のセッションで実行される ・裏で偽プラグインの導入、隠し管理者の作成、秘密のログインURL設置まで走る 影響を受ける条件 ・Ninja Forms は50万サイト以上、WPC は3万サイト以上が利用 ・Patchstackが10/4〜5に実際の攻撃を観測 今すぐやること ・Ninja Forms は 3.15.4、WPC は 8.6.7 以上に更新 ・DBを直接見て、身に覚えのない管理者がいないか確認 ・mu-plugins フォルダと、最近の不審なプラグインもチェック まとめ 更新しても、すでに入った裏口や偽管理者は残ります。フォーム系を使ってるサイトは、更新とあわせて管理者一覧を一度洗っておくのが安全です。
Post summary
A Japanese security memo reports active in-the-wild exploitation of two stored XSS CVEs in WordPress plugins (Ninja Forms CVE-2026-94504 and WPC Product Bundles CVE-2026-93836), observed by Patchstack, with specific patch versions provided and additional cleanup recommendations for affected sites.
Patchstackが10月6日、問い合わせフォームプラグイン「Ninja Forms」の脆弱性（CVE-2026-94504）を突く攻撃を10月5日より観測したと公表しました。9月21日公開の3.15.4で修正済みです。 管理者が受信内容を画面で開くだけで、管理画面のユーザー一覧に表示されない「隠し管理者アカウント」が作成される攻撃です。管理者アカウントとは別に、元の管理者としてログインできる隠しURLも作られます。 ■ 成立する条件 ・Ninja Forms 3.15.3以下を使用している ・攻撃者が送信した内容を、ログイン中の管理者が管理画面で開く フォームは未ログインで送信可能なため、攻撃者は送信後に管理者が開くのを待つだけで成立します。 ■ 対象のバージョンと修正版 ・CVE-2026-94504：3.15.3以下。3.15.4で修正 修正版の公開から攻撃の観測まで2週間でした。同様の攻撃は「WPC Product Bundles」8.6.6以下でも観測されています。 ■ 確認すること プラグインを更新しても、すでに作成されたアカウントは自動削除されません。 攻撃者は wp-content/mu-plugins に隠蔽用ファイルを置き、作ったアカウントを管理画面のユーザー一覧から隠します。画面上の数字や一覧には出てこないため、データベース側で管理者をカウントし、一覧と突き合わせる必要があります。
Post summary
CVE-2026-94504を突く攻撃が実際に観測されたと報告し、脆弱性の成立条件や影響を説明しています。3.15.4で修正済みですが、実悪用の報告があるため分類はActive Exploitationです。
Attackers are actively exploiting stored cross-site scripting vulnerabilities in two widely used WordPress plugins — Ninja Forms and WPC Product Bundles for WooCommerce — to plant backdoors, install... https://cvetodo.com/news/cve-2026-94504-hackers-exploit-ninja-forms-and-wpc-product-bundles-flaws-to-backdoor-wordpress-sites #WordPress #Kstover #Malware #CVE #InfoSec https://t.co/nQpPwlbMyp
Post summary
The text reports active exploitation of stored cross-site scripting vulnerabilities in two WordPress plugins, with attackers allegedly planting backdoors. No PoC, named exploit tool, or remediation guidance is provided.
🔓 ثغرة في إضافة Ninja Forms على WordPress تُستغل فعليًا لاختراق المواقع كشفت Patchstack في 6 أكتوبر عن حملة اختراق شغالة من 5 أكتوبر تستغل ثغرة CVE-2026-94504 في إضافة النماذج Ninja Forms، المستخدمة في أكثر من 500 ألف موقع. والثغرة تخص النسخة 3.15.3 وما قبلها فقط، والإصلاح موجود من النسخة 3.15.4. 💡 الفكرة ببساطة كالتالي: https://x.com/BleepinComputer/status/2107576811815162251
Post summary
The text reports active in-the-wild exploitation of CVE-2026-94504 in the Ninja Forms WordPress plugin (versions <=3.15.3) and notes that a patch is available in version 3.15.4.
🛡️ CYBER BULLETIN | 2026/10/07 🚨 1) Atlassian disclosed CVE-2026-21589 (CVSS 9.3), a critical flaw in 8 self-hosted Data Center products, including Jira, Confluence and Bitbucket. An attacker with no login can read specific files in the app's web root, as long as they know the exact file name and path. There's no known exploitation yet and Cloud is already patched. If you run Data Center, upgrade to the fixed version now. If you can't, cut off outside access or add the WAF or rewrite rules from the advisory, and check your logs for traversal patterns. 2) Attackers are exploiting stored XSS flaws in two WordPress plugins: Ninja Forms (CVE-2026-94504, 500k+ sites) and WPC Product Bundles for WooCommerce (CVE-2026-93836). They plant JavaScript in form submissions or order data. When an admin opens it, the script installs a fake "WP Smart Thumbnails" plugin and creates a hidden admin account that doesn't show up in the user list. Update to Ninja Forms 3.15.4 or WPC Product Bundles 8.6.7, then look for that plugin and odd admin logins, because updating won't clean an existing infection. 3) A malicious spreadsheet can make LibreOffice and Apache OpenOffice run attacker code as soon as it's opened, with no macro warning, if Java support is on. It chains normal features: an auto-refreshing database range pulls a remote database file, which loads a Java driver from the attacker's server. It's only a proof of concept so far. LibreOffice fixed it (CVE-2026-63277) in 26.2.5 and 26.8.0, but OpenOffice 4.1.16 and earlier are still unpatched (CVE-2026-59265). Update LibreOffice, or turn off Java in OpenOffice until 4.1.17 ships. 4) ASOS confirmed a breach after hackers pushed "ASOS HACKED" notifications to its app users on Tuesday. The group claims it stole data from the retailer's Snowflake environment, which ASOS hasn't confirmed. The company says names and contact details may be exposed, but not card details or passwords. If you shop with ASOS, ignore links in unexpected messages and expect phishing that uses your real name. 5) The FBI says a contractor's missed security patch led to the ShinyHunters breach that exposed data on thousands of bureau employees, and it has removed that contractor. Reuters' sources say it was Accenture and the system was Oracle PeopleSoft, which the group has been targeting. If a vendor runs your HR or PeopleSoft platform, ask them for proof that the latest patches are installed. Who checks that your vendors actually install the patches they promise? #CyberSecurity #InfoSec
Post summary
The bulletin highlights active exploitation of two WordPress plugin vulnerabilities (CVE-2026-94504, CVE-2026-93836) while also disclosing critical flaws in Atlassian Data Center and LibreOffice/OpenOffice with patches and mitigations available.
🚨 Ninja Forms に脆弱性（深刻度 高） 60万サイト以上が利用 / CVSS 7.2 修正版 3.15.4 が公開済み https://shindan.m-g-n.me/alerts/cve-2026-94504/
Post summary
Ninja Forms vulnerability (CVSS 7.2) affecting 600k+ sites; fixed version 3.15.4 released.
En WordPress puede haber un administrador que no ves: Patchstack reporta explotación de fallas XSS en Ninja Forms (CVE-2026-94504, más de 500.000 sitios) y en WPC Product Bundles para WooCommerce (CVE-2026-93836) para dejar administradores ocultos en la lista de usuarios. Cómo funciona, según BleepingComputer (6 de octubre): - Ambas fallas requieren una sesión autenticada. El atacante mete JavaScript (x.js, servido desde imgcdn1[.]com) en datos de pedidos de WooCommerce o en envíos de Ninja Forms. - Cuando un administrador abre ese contenido, el script usa su sesión para instalar un plugin falso, "WP Smart Thumbnails" 1.2.4 de "MediaPress Labs", y crear un administrador. - Deja cuatro puertas: un admin visible, un admin oculto que no aparece en Usuarios ni en los conteos, una URL secreta que entra como el administrador más antiguo y un gestor de archivos sin autenticación. - Si borras el plugin falso, la cuenta oculta y la URL secreta siguen funcionando, gracias a plugins auxiliares con fechas alteradas. Qué hacer: 1. Actualiza Ninja Forms a la 3.15.4 o superior y WPC Product Bundles a la 8.6.7 o superior. 2. Busca "WP Smart Thumbnails" y cualquier plugin que no reconozcas, aunque parezca viejo. 3. Revisa los administradores directamente en la base de datos (tablas de usuarios y sus metadatos), no solo en el panel. 4. Busca imgcdn1[.]com en pedidos, envíos de formularios y registros. Actualizar evita nuevas entradas, pero no limpia una infección. Patchstack dice que, por ahora, la explotación es limitada. La campaña la detectó el 4 de octubre.
Post summary
El texto informa de explotación activa de dos vulnerabilidades XSS para crear administradores ocultos y persistencia en sitios WordPress. También proporciona versiones corregidas y pasos para detectar posibles infecciones.
ExploitGrid tracks CVE-2026-94504 at 36.9/100 and CVE-2026-93836 at 28.9/100. CVE-2026-94504: https://exploitgrid.net/vulnerabilities/CVE-2026-94504 CVE-2026-93836: https://exploitgrid.net/vulnerabilities/CVE-2026-93836 Patch affected plugins and check for compromise.
Post summary
ExploitGrid tracks the exploitability scores of CVE-2026-94504 and CVE-2026-93836, linking to their respective pages, and advises patching affected plugins and checking for compromise.
Ninja Forms was fixed 14 days before Patchstack saw the first attack, and the fix does not clean a hacked site Ninja Forms shipped the fix for CVE-2026-94504 on 21 September 2026. Patchstack recorded the first attempt to exploit it on 5 October. That is 14 days (derived), the window Cyber Essentials v3.3 gives for the update. The NCSC's five-day mark for internet-facing software had passed nine days earlier. 🧮 The attack needs no account. A hostile entry goes in through a public form, waits in the database, and runs when an administrator opens it. Patchstack says it then installs a fake plugin and leaves four ways back in, only one visible in the dashboard. Updating stops new attacks. It does not remove what is already there. Wordfence lists nine Ninja Forms entries from 2 September to 1 October, seven unauthenticated, from three different CVE assigners. 🔍 Figures that travel with this story belong to other things. 600,000 is a downloads claim from an April article, and WordPress[.]org shows 500,000+ installs. 3,600 attacks in 24 hours was the paid File Uploads add-on in April, not this flaw. 50.04% of installs report a version older than 3.15, but the 3.15 bucket mixes fixed and affected releases. Not stated by any source: how many sites were hit, or whether form data was taken. ⚖️ The awkward part for UK charities, councils and schools is the add-on: a separate codebase that updates only with a valid licence. A green tick on the free plugin says nothing about it. Inventory every WordPress site including agency-managed ones, update the plugin and every add-on, check licence dates, and review administrators and uploads. 🔑 Your agency's last report says every plugin is up to date. Does it list the add-ons, their licence dates, and the administrators the Users screen cannot show? Full briefing: https://www.pk-sharma.com/briefing/ninja-forms-fixed-14-days-before-first-attack-seen #WordPress #NinjaForms #Patchstack #Wordfence #CyberEssentials #VulnerabilityManagement #WebSecurity #Plugins #SmallBusiness #InfoSec #CyberSecurity #CISO #WebDev #UKTech
Post summary
The text reports active exploitation of CVE-2026-94504 in Ninja Forms, noting the first attack was observed 14 days post-patch. It details the unauthenticated stored attack chain leading to persistent backdoors and emphasizes that patching prevents future attacks but does not clean existing compromises.
CVE-2026-94504: Ninja Forms 3.15.3 stored XSS, CVSS 7.2. Attacker script runs in WordPress admin origin. No patch yet - restrict submission access and watch vendor advisories. https://www.valtersit.com/cve/CVE-2026-94504/ #CVE #infosec #WordPress #NinjaForms #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet discloses a stored XSS vulnerability in Ninja Forms 3.15.3 (CVE-2026-94504) with a CVSS 7.2 score, noting that no vendor patch is currently available but recommending a workaround to restrict submission access.
🚨 Exploiting #CVE-2026-94504: Ninja Forms 3153 Stored XSS Threat Intelligence and Mitigation Guide + Video -Prediction: 📈 1 Positive | 📉 0 Negative https://undercodetesting.com/exploiting-cve-2026-94504-ninja-forms-3153-stored-xss-threat-intelligence-and-mitigation-guide-video/ Educational Purposes!
Post summary
The post announces an educational guide and video demonstrating the exploitation (PoC) of a Stored XSS vulnerability in Ninja Forms 3153 (CVE-2026-94504) and includes a mitigation guide.