WordPress plugin

GTM4WP – A Google Tag Manager (GTM) plugin for WordPress security & vulnerabilities

Q: Is any GTM4WP – A Google Tag Manager (GTM) plugin for WordPress vulnerability listed in CISA KEV?

No. None of the known GTM4WP – A Google Tag Manager (GTM) plugin for WordPress vulnerabilities is currently listed in the CISA KEV catalog.

duracelltomi-google-tag-manager— active installsLast vulnerability Jul 28, 2026

No known unpatched vulnerabilities in the latest version

All 4 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

4Known vulnerabilities

Critical0
High2
Medium2
Low0

Vulnerabilities per year

All GTM4WP – A Google Tag Manager (GTM) plugin for WordPress vulnerabilities

GTM4WP – A Google Tag Manager (GTM) plugin for WordPress vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields ≤1.22.3Update to 1.22.4	CVE-2026-16597	Jul 28
Medium5.5	Stored Cross-Site Scripting via Content Element ID ≤1.15.1Update to 1.15.2	CVE-2022-1961	May 31, 2022
Medium6.1	Reflected Cross-Site Scripting via Site Search ≤1.15Update to 1.15.1	CVE-2022-1707	May 19, 2022
High7.2	Cross-Site Scripting via Cloudflare Country Code ≤1.15Update to 1.15.1	—	May 12, 2022

High7.2
Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
≤1.22.3Update to 1.22.4
CVE-2026-16597Jul 28
Medium5.5
Stored Cross-Site Scripting via Content Element ID
≤1.15.1Update to 1.15.2
CVE-2022-1961May 31, 2022
Medium6.1
Reflected Cross-Site Scripting via Site Search
≤1.15Update to 1.15.1
CVE-2022-1707May 19, 2022
High7.2
Cross-Site Scripting via Cloudflare Country Code
≤1.15Update to 1.15.1
79a41b84-2e19-46eb-9f6b-5155da0b15ccMay 12, 2022

GTM4WP – A Google Tag Manager (GTM) plugin for WordPress: common questions

Does GTM4WP – A Google Tag Manager (GTM) plugin for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 4 known vulnerabilities in GTM4WP – A Google Tag Manager (GTM) plugin for WordPress: 2 high, 2 medium. None are known to affect version null.

How do I check which version of GTM4WP – A Google Tag Manager (GTM) plugin for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent GTM4WP – A Google Tag Manager (GTM) plugin for WordPress vulnerability?

CVE-2026-16597, published Jul 28, 2026: GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields. Severity: High (CVSS 7.2).

Is any GTM4WP – A Google Tag Manager (GTM) plugin for WordPress vulnerability listed in CISA KEV?

No. None of the known GTM4WP – A Google Tag Manager (GTM) plugin for WordPress vulnerabilities is currently listed in the CISA KEV catalog.