Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts.
WordPress 6.9.9 Security Release Security updates included in this release Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902 WordPress 6.9.8 Security Release ...
WordPress 6.9.9 Security Release Security updates included in this release Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902 WordPress 6.9.8 Security Release ...
The WordPress plugin preserves content structure, metadata and taxonomy; Smart Agent retrieves from connected apps and web sources. The release is now available.