Four ways back in: the WordPress XSS campaign that hides its own admin account

Patchstack researchers have tracked a single malicious campaign abusing two unrelated stored Cross-Site Scripting flaws in WordPress plugins — CVE-2026-93836 in WPC Product Bundles for WooCommerce (up to version 8.6.6) and CVE-2026-94504 in Ninja Forms (up to version 3.15.3) — to deliver the exact same JavaScript implant hosted on imgcdn1.com. First seen on October 4-5, 2026, the script hijacks a logged-in administrator's session to install a disguised rogue plugin, open an unauthenticated file manager, create a visible administrator account, and plant must-use plugins that hide a second administrator from the Users screen while generating a magic login link that impersonates the site's original owner. This gives attackers four separate, persistent paths back into the compromised site that survive removal of the original vulnerable plugin. Site owners should update WPC Product Bundles to 8.6.7 and Ninja Forms to 3.15.4 or later, and specifically hunt for hidden admin accounts, rogue mu-plugins, and the fz_emer_* database options rather than relying on the dashboard alone.