Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts
Teaser from the source
From Oct 24 2026 a Brazilian Magecart group appended a card skimmer to the Plausible analytics tracker hosted on Convertr's own server. Convertr runs the online stores and checkout for dozens of Brazilian fashion brands, and every checkout.convertr page loaded that file, so card numbers, expiry dates, CVVs, cardholder names and CPF numbers were sent to the attacker. Sansec suspects the entry point was CVE-2026-8467 in Convertr's never-updated Plausible Community Edition 3.0 (unconfirmed). Convertr removed the skimmer and upgraded Plausible on Oct 27.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchLinked advisories
- CVE-2026-8467hex phoenix_storybook: Code-Injection
- CVE-2026-8467Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in…
- CVE-2026-8467Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
- CVE-2026-8467PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
- CVE-2026-8467hex phoenix_storybook: Code-Injection
Affected vendors and products
More on self-hosted
Other advisories
- Not ratedosv:CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
- MediumCVE-2026-28330SolarWinds Observability Self-Hosted: Cross-Site-Scripting (XSS)
- MediumCVE-2026-28329SolarWinds Observability Self-Hosted: Server-Side-Request-Forgery (SSRF)
- HighCVE-2026-28328SolarWinds Observability Self-Hosted: fehlerhafte Autorisierung
- MediumCVE-2026-28330SolarWinds Observability Self-Hosted: Cross-Site-Scripting (XSS)
- MediumCVE-2026-28329SolarWinds Observability Self-Hosted: Server-Side-Request-Forgery (SSRF)
- HighCVE-2026-28328SolarWinds Observability Self-Hosted: fehlerhafte Autorisierung
- HighCVE-2026-45165Palo Alto Networks Idira Secrets Manager (Self-Hosted): fehlerhafte Autorisierung
Other news entries
- BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alertNewsCSO Online
- Attackers Target Critical Atlassian Vulnerability Within Hours of PoC PublicationNewsSecurityWeek
- Atlassian warns of critical file-access flaw in Jira, ConfluenceNewsBleepingComputer
- GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted ServersNewsThe Hacker News
- SolarWinds Patches Critical RCE Flaws in Observability Self-HostedNewsSecurityWeek
- SolarWinds Platform (Observability Self-Hosted): Mehrere Schwachstellen ermöglichen CodeausführungVulnerabilityBSI CERT-Bund
- NCSC-2026-0388 [1.00] [M/H] Kwetsbaarheden verholpen in SolarWinds Observability Self-HostedNewsNCSC-NL
- Multiples vulnérabilités dans SolarWinds Observability Self-Hosted (23 septembre 2026)NewsCERT-FR (ANSSI)
Source: https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026
ID