Critical FunnelKit Bug Leaves WooCommerce Stores Open To Attacks

A critical unauthenticated remote code-injection vulnerability in the Funnel Builder (FunnelKit) plugin (affecting versions before 3.15.0.3) enables attackers to write malicious entries to the plugin's External Scripts setting so injected scripts run on every checkout page; threat actors are actively exploiting the flaw to deploy disguised payment skimmers across an estimated 40,000+ WooCommerce stores. Administrators are advised to update the plugin, manually inspect Settings → Checkout → External Scripts for unfamiliar code, and run ecommerce malware scanners. Notable IOCs provided include analytics-reports.com/wss/jquery-lib.js and wss://protect-wss.com/ws.