WordPress security changelog
HIGH CVE-2026-16597 Deferred

GTM4WP WooCommerce order data permits unauthenticated stored XSS

GTM4WP through 1.22.3 lets an unauthenticated attacker place a script payload in a WooCommerce guest-checkout billing field, such as billing first name, when the GTM4WP WooCommerce order-data integration option is enabled. gtm4wp_woocommerce_get_raw_order_datalayer() reads the stored value through WC_Order::get_billing_first_name() and places it in orderData.customer.billing.first_name; the order-data path is compiled into the data layer, and the front-end renderer passes its inline script through wp_kses() before calling htmlspecialchars_decode(). The later decoding defeats the intended script-context protection and allows the stored value to break into executable JavaScript when the affected order data is emitted on a matching front-end page.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
Plugin slug
duracelltomi-google-tag-manager
Affected
<= 1.22.3
Safe version
1.22.4
Published
Jul 29, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Jul 29, 2026 and is one of 2 known issues for this plugin.

What to do

Update, patch or deactivate.

Update GTM4WP to 1.22.4 or later. Version 1.22.4 stops HTML-entity decoding sanitized script blocks and JSON-encodes script-context values with the full hexadecimal escaping flags. Review guest orders created while the WooCommerce order-data integration was enabled for unexpected markup in billing fields.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the GTM4WP WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA) to be enabled, and is exploited by placing a guest checkout order with a JavaScript payload in a WooCommerce billing field such as the billing first name.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources