thehackernews.com·May 16, 2026
A serious security vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages, aiming to steal payment data, as reported by Sansec. The vulnerability has yet to receive an official CVE identifier.
The active exploitation of a critical vulnerability in the Funnel Builder plugin for WordPress, which injects malicious JavaScript into WooCommerce checkout pages to steal payment data, highlights the urgent need for continuous monitoring and patch management in your web applications. Prioritize identifying and mitigating such vulnerabilities in your web infrastructure, even those without a CVE identifier, to protect against data breaches.