Cross-site propagation is the spread of malicious access, code, or control from one WordPress site to another environment. Instead of staying confined to a single compromised host, the attacker reuses credentials, copied files, shared infrastructure, or automation to move the foothold across multiple sites. In WordPress ecosystems, this can happen through stolen administrator passwords, reused hosting accounts, synced file trees, or malware that drops into other sites the operator can reach.
It matters because one infected site can become a launch point for broader compromise. Defenders may remove one backdoor only to find the same implant, accounts, or configuration changes on neighboring sites. Common signs include unexpected admin users, unusual write access to wp-content, identical malicious files across installations, and suspicious outbound traffic. Protection depends on isolating sites, rotating credentials, auditing admin roles, checking file integrity, and reviewing host-level access paths, not just the plugin list.