Product

GTM4WP (Google Tag Manager for WordPress Plugin) (<= 1.22.3)

1 brief RSS

CVE-2026-16597 - GTM4WP WordPress Plugin Vulnerable to Stored XSS via WooCommerce Billing Fields

The GTM4WP (Google Tag Manager) plugin for WordPress, in versions up to and including 1.22.3, is vulnerable to stored cross-site scripting (XSS) via CVE-2026-16597, allowing unauthenticated attackers to inject arbitrary web scripts through WooCommerce billing fields during a guest checkout, which execute when a user accesses the compromised page.

GTM4WP +1 wordpress plugin xss web-vulnerability e-commerce

1r 1t 1c 1h ago