Researchers Uncover Active Exploitation of WordPress Plugin Vulnerabilities

Researchers warn that multiple high-severity unauthenticated stored XSS vulnerabilities in WordPress plugins (including CVE-2023-6961, CVE-2023-40000, CVE-2024-2194) are being actively exploited to inject obfuscated JavaScript that creates rogue admin accounts, implants PHP backdoors into plugins/themes, and contacts a remote tracking domain (ur.mystiqueapi.com). Fastly observed exploitation traffic tied to AS202425 and WPScan previously reported similar abuse; site owners are advised to update plugins, audit for malicious admins/backdoors, and remove compromised code.