Malicious JavaScript in WordPress checkout pages steals payment data, hides in wp_options, and exfiltrates encrypted details.