blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-1707

MEDIUM 6.1 CVSS 3.1
Published
June 13, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.

Affected WordPress components

  • GTM4WP – A Google Tag Manager (GTM) plugin for WordPress Plugin · duracelltomi-google-tag-manager
    Confirmed match Active
    Up to and including 1.15
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • duracelltomi GTM4WP – A Google Tag Manager (GTM) plugin for WordPress — Up to and including 1.15
  • gtm4wp google_tag_manager — Before 1.15.1

References

  • github.com https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L298 Product
  • github.com https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L782 Product
  • github.com https://github.com/duracelltomi/gtm4wp/issues/224 Issue Tracking
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/0435ae14-c1fd-4611-acbe-5f3bafd4bb6a?source=cve Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1707 Third Party Advisory
  • nvd.nist.gov Official NVD record