CVE-2022-1707

🗓️ 13 Jun 2022 12:45:36Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 126 Views🌐 WEB

The Google Tag Manager for WordPress plugin is vulnerable to reflected Cross-Site Scripting via the s parameter

Reporter	Title	Published	Views	Family All 14
CNNVD	WordPress plugin Google Tag Manager cross-site scripting vulnerability	13 Jun 202200:00	–	cnnvd
CNVD	WordPress plugin Google Tag Manager cross-site scripting vulnerability	23 Jun 202200:00	–	cnvd
Check Point Advisories	WordPress Google Tag Manager Plugin Cross-Site Scripting (CVE-2022-1707)	6 Nov 202200:00	–	checkpoint_advisories
Cvelist	CVE-2022-1707 Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search	13 Jun 202212:45	–	cvelist
NVD	CVE-2022-1707	13 Jun 202213:15	–	nvd
OpenVAS	WordPress Google Tag Manager for WordPress Plugin < 1.15.1 XSS Vulnerability	4 Oct 202300:00	–	openvas
osv_cve	CVE-2022-1707 Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search	13 Jun 202212:45	–	osv_cve
Patchstack	WordPress Google Tag Manager plugin <= 1.15 - Reflected Cross-Site Scripting (XSS) vulnerability	19 May 202200:00	–	patchstack
Prion	Cross site scripting	13 Jun 202213:15	–	prion
Positive Technologies	PT-2022-14060	13 Jun 202200:00	–	ptsecurity

NVD

Vulners

Node

gtm4wp google_tag_managerRange<1.15.1wordpress

[
  {
    "vendor": "duracelltomi",
    "product": "GTM4WP – A Google Tag Manager (GTM) plugin for WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.15",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php
github	www.github.com/duracelltomi/gtm4wp/issues/224
wordfence	www.wordfence.com/vulnerability-advisories/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0435ae14-c1fd-4611-acbe-5f3bafd4bb6a
github	www.github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php

Parameter	Position	Path	Description	CWE
s	query param	/public/frontend.php	Reflected Cross-Site Scripting via the s parameter in the Google Tag Manager for WordPress plugin, caused by insufficient sanitization when populating the data layer from the site search.	CWE-79

17 Jun 2026 04:22Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.89276

SSVC

CWE-79