Critical Vulnerability in Funnel Builder Plugin Allows JS Injection into WooCommerce Checkout

A critical security vulnerability affecting the Funnel Builder plugin for WordPress has been actively exploited in the wild. The flaw allows attackers to inject malicious JavaScript code into WooCommerce checkout pages. The injected script is designed to steal payment data from customers. The vulnerability has not yet been assigned an official CVE identifier. The attackers are using the flaw to compromise e‑commerce sites. The issue is being reported by Sansec. The plugin is widely used in WordPress‑based e‑commerce sites. The flaw is considered high risk.

The vulnerability is due to insufficient input sanitization in the plugin’s checkout integration. The attackers can bypass the checkout flow and capture card details. The issue is not limited to a specific version of Funnel Builder. The plugin developers have not released a patch yet. Site owners should check the plugin version. The vulnerability is actively exploited. The issue underscores the importance of secure plugin development. The attackers are targeting high‑value e‑commerce sites.