Stored Cross-Site Scripting Vulnerability in Google Tag Manager for WordPress

CVE-2022-1961

What is CVE-2022-1961?

The Google Tag Manager for WordPress (GTM4WP) plugin contains a vulnerability that allows administrators to inject arbitrary web scripts due to insufficient escaping in the 'gtm4wp-options[scroller-contentid]' parameter within the 'frontend.php' file. This issue primarily impacts multi-site installations where the unfiltered_html capability is disabled for administrators and specific sites that restrict this capability, potentially allowing attackers to exploit the vulnerability when administrative access is gained.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References