CVE Database /
CVE-2022-1961
CVE · Medium
CVE-2022-1961 — GTM4WP – A Google Tag Manager (GTM) plugin for WordPress [duracelltomi-google-tag-manager] < 1.15.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-1961
|
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress [duracelltomi-google-tag-manager] < 1.15.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.8
|
< 1.15.2
|
1.15.2 |
2022-05-31 |
—
|
CVE-2022-1961
The GTM4WP plugin through version 1.15.1 contains a stored cross-site scripting vulnerability in the `gtm4wp-options[scroller-contentid]` parameter within the frontend.php file. Administrative users can inject malicious scripts due to inadequate output escaping, which poses a risk particularly in multisite WordPress installations where unfiltered_html capabilities are restricted or disabled for admins. The vulnerability was patched in version 1.15.2.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings