What the vulnerability does
01Description
The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Explanation of Vulnerability in Simple Terms
02Summary
GTM4WP versions up to 1.15.1 contain a stored cross-site scripting (XSS) vulnerability in the plugin's settings. An authenticated administrator can inject malicious JavaScript that executes in the browsers of other site users, including other administrators. The vulnerability affects the plugin's configuration interface and can impact site security and user data.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they view affected plugin settings.
Potential impact on your site
04Site Impact
An admin account compromise could inject malicious code affecting all site users and administrators.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the WordPress site.
Key dates
06Disclosure timeline
June 13, 2022
CVE published
April 8, 2026
Record updated
