Ninja Forms plugin flaw exploited to hack WordPress sites

Hackers are actively exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins: Ninja Forms and WPC Product Bundles for WooCommerce. The attacks leverage these flaws to install backdoors on compromised WordPress sites and create rogue administrator accounts. Both plugins have distinct vulnerabilities but are being exploited in related campaigns targeting WordPress installations. The exploitation is active in the wild, making this a high-priority security concern for WordPress site administrators. Site owners using either plugin are urged to update immediately to patched versions to prevent unauthorized access and potential full site compromise.