First, you don't actually send a hash on subsequent connection attempts, you still send the plaintext password. Second, even if you would send a hash, the same hash, every time, this hash would effectively be your new password.
Now for your actual question:
What if someone intercepts the data at this time? What am I missing
here?
The fact that HTTPS is used. HTTPS stands for HTTP-Secure, which means it's HTTP over TLS. Now if your browser properly validates the data it gets from the server (which all browsers do), then you can be sure that the party at the other end of the encrypted TLS connection actually is facebook.com, at which point you also know for sure that the connection hasn't been intercepted.
It says that plaintext is not secure so servers store only hashes of
the passwords. How this works exactly.
Assume we have a secure connection between the client and the server, that is the client knows for sure who the server is (eg facebook.com). TLS achieves this. Now for the registration send the server the username and the password you want to use. The server password-hashes the password and stores it alongside the username. Now on subsequent log-ins you send the password again, the server retrieves some parameters from your username, applies the password hash again and compares the result with the stored value. If they match, you are authenticated, if not, then not.
Why the hashing on the server? Suppose the database of the server where all the password hashes and usernames are stored gets compromised (eg an attacker gets root access to the server or can dump the database using an SQL injection), now if you have stored plaintext passwords, the attacker can immediately use these against your service and any other sevice these users may use (assuming they re-use passwords, many do). Now if you have hashes, the attacker first needs to find inputs that map to these hashes, for this they usually need to try out a lot of passwords, which is infeasible for really good passwords and even for weaker passwords takes a moment of time. So now the passwords aren't complete and utterly compromised when the server's security fails.