CVE-2022-1707

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-1707
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1707.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-1707
Published
2022-06-13T12:45:36Z
Modified
2026-07-15T01:49:07.076832445Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search
Details

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1707.json",
    "cna_assigner": "Wordfence"
}
References

Affected packages

Git / github.com/duracelltomi/gtm4wp

Affected ranges

Type
GIT
Repo
https://github.com/duracelltomi/gtm4wp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
de15527c94af603cc6646b2ef9a36e2519401a37
Database specific 
{
    "cpe": "cpe:2.3:a:gtm4wp:google_tag_manager:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.15"
        },
        {
            "fixed": "1.15.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

1.*
1.10
1.10.1
1.10beta1
1.11
1.11.3
1.11.4
1.11beta1
1.11beta2
1.12
1.12.1
1.12.2
1.12beta1
1.13
1.13.1
1.14
1.14.1
1.14.2
1.14beta1
1.14beta2
1.14beta3
1.15
1.15beta1
1.15beta2
1.4.0
1.5.0
1.5.0rc
1.6.0
1.6.0rc
1.6.1
1.7
1.7.1
1.7.2
1.7beta2
1.7beta3
1.7rc1
1.7rc2
1.8
1.8.1
1.8.1beta
1.8.1beta2
1.8beta1
1.9
1.9.1
1.9.1beta
1.9.2
1.9beta1
v1.*
v1.13beta1
v1.7beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1707.json"