Ninja Forms Hack 2026: Attackers Plant Hidden Admins on WordPress Sites
If your site runs Ninja Forms — the free contact-form plugin on more than 500,000 WordPress sites — this week’s security news is directly about you. Attackers have been actively exploiting a stored cross-site scripting flaw (CVE-2026-94504) in Ninja Forms since October 5, 2026, according to research published by WordPress security firm Patchstack. The same … Read more