Duracelltomi Google Tag Manager Vulnerabilities

The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...

CVSS:

7.2

Affected:

up to 1.22.3

Fixed in:

1.22.4

Disclosed:

Jul 28, 2026

CVE-2026-16597 on NVD →

[en] The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could...

Affected:

up to 1.15.1

Fixed in:

1.15.1

Disclosed:

Jun 13, 2022

CVE-2022-1707 on NVD →

[en] The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in...

Affected:

up to 1.15.2

Fixed in:

1.15.2

Disclosed:

Jun 13, 2022

CVE-2022-1961 on NVD →

The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in vers...

CVSS:

5.5

Affected:

up to 1.15.1

Fixed in:

1.15.2

Disclosed:

May 31, 2022

CVE-2022-1961 on NVD →

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be ex...

CVSS:

6.1

Affected:

up to 1.15

Fixed in:

1.15.1

Disclosed:

May 19, 2022

CVE-2022-1707 on NVD →

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $_SERVER['HTTP_CF_IPCOUNTRY'] value in versions up to, and including, 1.15 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pa...

CVSS:

7.2

Affected:

up to 1.15

Fixed in:

1.15.1

Disclosed:

May 12, 2022

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $_SERVER['HTTP_CF_IPCOUNTRY'] value in versions up to, and including, 1.15 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pa...

Affected:

up to 1.15.1

Fixed in:

1.15.1

Disclosed:

May 12, 2022