Ninja Forms & WooCommerce: Active Stored XSS Backdoor Campaign

Threat Overview

An active cyber exploitation campaign is targeting popular WordPress plugins—including Ninja Forms (installed on over 600,000 websites) and WPC Product Bundles for WooCommerce—to compromise administrative accounts. Threat actors inject stored Cross-Site Scripting (XSS) payloads into form submissions and order records. When a site administrator logs in and views the entry in wp-admin, the script executes in their browser session, stealing administrative nonces to silently install a backdoor plugin and create an unauthorized administrator account.

The Breakdown: How the Exploit Works

The campaign relies on unauthenticated input fields that fail to properly sanitize HTML/JavaScript before rendering submission logs inside the WordPress dashboard.

1. Payload Injection: Threat actors submit public contact forms or WooCommerce orders containing crafted JavaScript tags pointing to remote scripts (such as x.js hosted on imgcdn1[.]com).
2. Admin Session Execution: When an administrator opens the Ninja Forms submission viewer or WooCommerce order list, the browser executes the stored payload using the active admin session.
3. Automated Takeover: The script automatically fetches wp-admin security nonces, registers a new administrator account, and downloads a malicious plugin masquerading as “WP Smart Thumbnails” (version 1.2.4 by “MediaPress Labs”) to establish persistent backdoor access.

The Operational Risk: What an Attacker Gains

Successful exploitation results in full administrative control over the target WordPress environment:

• Rogue Admin Accounts: Attackers gain permanent, authenticated access to wp-admin without needing password cracking or email verification.
• Persistent Backdoor Plugins: The stealth plugin “WP Smart Thumbnails” grants remote shell access even if the original vulnerable form plugin is later updated or removed.

Our Take in Plain English

“The fundamental danger of a monolithic dynamic CMS is that administrative control lives on the same server that ingests untrusted user input. A single malicious submission viewed in the dashboard can hijack the admin’s browser session and seize control of the database. A modern decoupled stack keeps user inputs completely isolated from backend administration.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Combines customer-facing intake forms with administrative control interfaces in the same browser DOM, enabling XSS payloads to hijack active administrator sessions.
• Modern Pre-Rendered Architecture: Decouples form submission routing from the management interface. Customer submissions are stored in isolated cloud queues, making client-side dashboard execution impossible.

Immediate Action Items for WordPress Operators

1. Update Plugins Immediately: Upgrade Ninja Forms to 3.15.4 or higher and WPC Product Bundles to 8.6.7 or higher.
2. Check for Rogue Users: Audit wp-admin > Users for unrecognized administrator accounts created recently.
3. Inspect Installed Plugins: Search the /wp-content/plugins/ directory for “WP Smart Thumbnails” or unverified MediaPress Labs directories and remove them immediately.