Since October 4, attackers have been trying to exploit stored cross-site scripting (XSS) flaws in two WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to deliver a single JavaScript payload. When an administrator opens the poisoned form submission or order, the script uses that administrator’s logged-in session to install a fake plugin and create an administrator account … Continue reading Attackers Target Ninja Forms and a WooCommerce Plugin to Hide a WordPress Admin