CVE-2022-1707mediumCWE-79

CVE-2022-1707: falha de média gravidade em duracelltomi GTM4WP – A Google Tag Manager…

Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar GTM4WP – A Google Tag Manager plugin for WordPress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

35Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 89%
The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
duracelltomi · GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
CVEs relacionadas — duracelltomi GTM4WP – A Google Tag Manager…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-1961MEDIUMGoogle Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element IDEPSS 1.1%CVE-2026-16597HIGHGTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing FieldsEPSS 0.4%