HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-16597 — The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPres...

·Source: NIST NVD

Updated:

Executive Summary

The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses

Analysis

The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the GTM4WP WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA) to be enabled, and is exploited by placing a guest checkout order with a JavaScript payload in a WooCommerce billing field such as the billing first name. CVSS Score: 7.2. Published: 2026-07-29T11:16:48.330.

Indicators of Compromise (1)

CVE (1)
CVE-2026-16597
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 29, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

CFTC fines UBS $8 million for AML failures

The Commodity Futures Trading Commission today announced an order filing and settling charges against UBS Financial Services Inc., a registered futures commission merchant, for failing to diligently supervise the configuration and operation of its anti-money laundering transaction monitoring systems for wire transfers denominated in foreign currencies (FX).

Finextra
MEDIUMVulnerabilityNEW

Mastercard closes acquisition of BVNK

Mastercard (NYSE: MA) today completed its acquisition of BVNK, expanding the company’s strategy to support greater choice in how people and businesses exchange value by enabling interoperability across fiat and digital currencies.

Finextra
CRITICALVulnerabilityNEW

China-Linked Threat Actors Weaponize New Vulnerabilities in Under a Day

Chinese actors exploited the critical React2Shell exploit inside a day, while 88% of exploited vulnerabilities in H1 2026 were compromised within 48 hours of disclosure

Infosecurity Magazine