Thousands of WordPress websites hacked via plugin looking to steal user data

Plugins are displaying fake popups, scaring WordPress users into downloading malware.