ByteOS Network

NVD Vulnerability Details :

CVE-2022-1707

Modified

Source-security@wordfence.com

Published At-13 Jun, 2022 | 13:15

Updated At-05 May, 2025 | 17:17

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

gtm4wp>>google_tag_manager>>Versions before 1.15.1(exclusive)

cpe:2.3:a:gtm4wp:google_tag_manager:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L298	security@wordfence.com	Product
https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L782	security@wordfence.com	Product
https://github.com/duracelltomi/gtm4wp/issues/224	security@wordfence.com	Issue Tracking
https://www.wordfence.com/threat-intel/vulnerabilities/id/0435ae14-c1fd-4611-acbe-5f3bafd4bb6a?source=cve	security@wordfence.com	Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1707	security@wordfence.com	Third Party Advisory
https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L298	af854a3a-2127-422b-91ae-364da2661108	Product
https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L782	af854a3a-2127-422b-91ae-364da2661108	Product
https://github.com/duracelltomi/gtm4wp/issues/224	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking
https://www.wordfence.com/threat-intel/vulnerabilities/id/0435ae14-c1fd-4611-acbe-5f3bafd4bb6a?source=cve	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1707	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History