The active exploitation of the Funnel Builder WordPress plugin (CAMP-2026-062) marks a return to 'Magecart-style' skimming operations, but with a modern, supply-chain-focused twist. As reported by BleepingComputer, attackers are leveraging a critical vulnerability to inject malicious JavaScript snippets directly into the checkout pages of WooCommerce-enabled sites. This allows for the real-time exfiltration of credit card numbers, CVVs, and personal billing information. The Cyber Tribune’s technical analysis indicates that the vulnerability lies in the plugin's handling of user-defined templates, which fails to properly sanitize input before rendering it on the front end. This 'Stored XSS' (Cross-Site Scripting) vulnerability is particularly dangerous because it resides within a trusted plugin, making it difficult for standard web application firewalls (WAFs) to distinguish between legitimate and malicious script execution. The campaign appears to be highly automated, with scanners identifying vulnerable WordPress installations and deploying the skimmer in a matter of seconds. This mirrors the 'cPanel Backdoor Blitz' (CAMP-2026-050) and the 'ManageWP Phishing Blitz' (CAMP-2026-039), suggesting a concerted effort by cybercriminal syndicates to compromise the WordPress ecosystem, which powers over 40% of the web. The impact radius is significant, potentially affecting thousands of small-to-medium-sized businesses that rely on Funnel Builder for their sales pipelines. Beyond the immediate financial loss for consumers, the breach poses a severe reputational risk for merchants and a compliance nightmare under the FTC’s new enforcement guidelines for the 'Take It Down Act.' The FTC has signaled that it will hold platforms accountable for failing to protect user data from known vulnerabilities. For security teams, the Funnel Builder incident underscores the necessity of 'Zero Trust' for third-party scripts. Implementing a strict Content Security Policy (CSP) is no longer optional; it is a critical defense against the injection of unauthorized code. Furthermore, the use of subresource integrity (SRI) hashes for all external scripts can prevent the execution of modified files. As the 'WordPress Supply Chain Crisis' continues to evolve, the industry must move toward a more rigorous vetting process for plugins, potentially involving mandatory security certifications for any software handling financial transactions.