CVE-2026-93836 - Geek Feed

Security
Tech News

Ninja Forms plugin flaw exploited to hack WordPress sites

October 10, 2026October 10, 2026 geekfeed0Tagged Actively Exploited, Cross-site scripting, CVE-2026-93836, CVE-2026-94504, Exploitation, Ninja Forms, Plugin, vulnerability, WooCommerce, xss

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. Both vulnerabilities received a high severity score and require an authenticated session to exploit. They are tracked as CVE-2026-93836, affecting WPC Product Bundles for WooCommerce versions 8.6.6 […]

3 mins read