GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress integrates Google Tag Manager with WordPress and adds data for tracking website interactions.
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress (duracelltomi-google-tag-manager) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 29, 2026; the highest published CVSS base score is 7.2.
duracelltomi-google-tag-managerCVE-2026-16597: GTM4WP WooCommerce order data permits unauthenticated stored XSS
GTM4WP through 1.22.3 lets an unauthenticated attacker place a script payload in a WooCommerce guest-checkout billing field, such as billing first name, when the GTM4WP WooCommerce order-data integration option is enabled. gtm4wp_woocommerce_get_raw_order_datalayer() reads the stored value through WC_Order::get_billing_first_name() and places it in orderData.customer.billing.first_name; the order-data path is compiled into the data layer, and the front-end renderer passes its inline script through wp_kses() before calling htmlspecialchars_decode(). The later decoding defeats the intended script-context protection and allows the stored value to break into executable JavaScript when the affected order data is emitted on a matching front-end page.
| Safe version |
|
||
|---|---|---|---|
| Jul 29, 2026 |
CVE-2026-16597
GTM4WP WooCommerce order data permits unauthenticated stored XSS
GTM4WP through 1.22.3 lets an unauthenticated attacker place a script payload in a WooCommerce guest-checkout billing field, such as billing first name, when the GTM4WP WooCommerce order-data integration option is enabled. gtm4wp_woocommerce_get_raw_order_datalayer() reads the stored value through WC_Order::get_billing_first_name() and places it in orderData.customer.billing.first_name; the order-data path is compiled into the data layer, and the front-end renderer passes its inline script through wp_kses() before calling htmlspecialchars_decode(). The later decoding defeats the intended script-context protection and allows the stored value to break into executable JavaScript when the affected order data is emitted on a matching front-end page.
|
1.22.4 |
CVE7.2
NVDPending
|
| Jun 13, 2022 |
CVE-2022-1961
Duracelltomi Google Tag Manager: Cross-site scripting
Duracelltomi Google Tag Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.5
NVD4.8
|