Ninja Forms plugin flaw exploited to hack WordPress sites

T1Covered by 1 source · first reported by BleepingComputer at 06 Oct, 21:00 UTC

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]