CVE-2026-16597

Name of the Vulnerable Software and Affected Versions GTM4WP – A Google Tag Manager (GTM) plugin for WordPress versions prior to 1.22.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by placing a guest checkout order with a JavaScript payload in a WooCommerce billing field, such as the billing first name. This issue requires the WooCommerce order data integration option GTM4WP OPTION INTEGRATE WCORDERDATA to be enabled. The injected scripts execute whenever a user accesses the affected page.

Recommendations Update to a version newer than 1.22.3. Disable the GTM4WP OPTION INTEGRATE WCORDERDATA option as a temporary mitigation measure.