Funnel Builder WordPress plugin bug exploited to steal credit cards

A critical unauthenticated vulnerability in the Funnel Builder (FunnelKit) WordPress plugin (affecting versions before 3.15.0.3) is being actively exploited to inject a fake Google Tag Manager/Analytics script (analytics-reports.com/wss/jquery-lib.js) into WooCommerce checkout pages; the malicious script opens a WebSocket (wss://protect-wss.com/ws) and delivers a payment-card skimmer that steals card numbers, CVVs, billing addresses and other customer data. FunnelKit released version 3.15.0.3 to address the issue and recommends updating and checking Settings > Checkout > External Scripts for rogue entries.