Skip to content
Threat Feed
Subscribe

Product

WooCommerce

2 briefs RSS
high advisory

CVE-2026-16597 - GTM4WP WordPress Plugin Vulnerable to Stored XSS via WooCommerce Billing Fields

The GTM4WP (Google Tag Manager) plugin for WordPress, in versions up to and including 1.22.3, is vulnerable to stored cross-site scripting (XSS) via CVE-2026-16597, allowing unauthenticated attackers to inject arbitrary web scripts through WooCommerce billing fields during a guest checkout, which execute when a user accesses the compromised page.

GTM4WP +1 wordpress plugin xss web-vulnerability e-commerce
1r 1t 1c
high advisory

CVE-2026-4798 - Avada Builder Plugin SQL Injection Vulnerability

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection (CVE-2026-4798) via the ‘product_order’ parameter in versions up to 3.15.1, potentially allowing unauthenticated attackers to extract sensitive database information if WooCommerce was previously used and deactivated.

Avada Builder plugin +1 sql-injection wordpress avada-builder cve-2026-4798
2r 1t 1c