CVE-2022-1961mediumCWE-79

CVE-2022-1961: falha de média gravidade em duracelltomi GTM4WP – A Google Tag Manager…

Google Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element ID

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar GTM4WP – A Google Tag Manager plugin for WordPress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.5epss 1.1%
The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
duracelltomi · GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
CVEs relacionadas — duracelltomi GTM4WP – A Google Tag Manager…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-1707MEDIUMGoogle Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site SearchEPSS 89.3%CVE-2026-16597HIGHGTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing FieldsEPSS 0.4%