Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming

A critical vulnerability in the Funnel Builder WordPress plugin (affecting versions before 3.15.0.3) is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages; attackers plant GTM-like scripts that load a payment skimmer via a WebSocket C2, stealing credit card numbers, CVVs, billing addresses and other checkout data. Site owners should update to version 3.15.0.3 and review Settings > Checkout > External Scripts for unfamiliar code.