What is the CVSS score of EUVD-2026-50266?

EUVD-2026-50266 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of GTM4WP are affected by EUVD-2026-50266?

GTM4WP, a widely-deployed WordPress analytics plugin, contains a stored cross-site scripting flaw that allows unauthenticated attackers to inject malicious code into customer checkout data; any…

How to fix or mitigate EUVD-2026-50266?

Within 24 hours: Identify all WordPress instances running GTM4WP and verify which have the WooCommerce order-data integration enabled; for at-risk deployments, immediately disable this integration setting in the plugin configuration to eliminate the attack vector. Within 7 days: Implement input validation and HTML/JavaScript escaping on all WooCommerce billing-field outputs, notify the GTM4WP vendor of your deployment to escalate security response, and deploy web application firewall rules to block script injection attempts in checkout parameters. Within 30 days: Either patch GTM4WP to a vendor-released security version when available, or migrate to an alternative tag-manager integration that does not process customer checkout data, depending on vendor timeline and your organization's risk tolerance.

GTM4WP EUVD-2026-50266

| CVE-2026-16597 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-29 Wordfence

GHSA-x9cm-w8j6-hh5q

WordPress XSS Google Wordpress Plugin Gtm4Wp A Google Tag Manager Gtm Plugin For Wordpress

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated guest checkout gives PR:N/AV:N/AC:L; stored script runs in other users' browsers (S:C) with limited C:L/I:L and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 10:53 vuln.today

CVE Published

Jul 29, 2026 - 09:31 cve.org

HIGH 7.2

DescriptionCVE.org

The GTM4WP - A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the GTM4WP WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA) to be enabled, and is exploited by placing a guest checkout order with a JavaScript payload in a WooCommerce billing field such as the billing first name.

AnalysisAI

Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.

Technical ContextAI

GTM4WP (vendor duracelltomi, CPE cpe:2.3:a:duracelltomi:gtm4wp_-_a_google_tag_manager_(gtm)_plugin_for_wordpress) injects a Google Tag Manager dataLayer into WordPress pages, and its WooCommerce integration reflects order/customer attributes into that dataLayer for e-commerce tracking. The root cause is CWE-79 (improper neutralization of input during web page generation): billing field values supplied at checkout are written into the frontend output (see public/frontend.php around L1148 and integration/woocommerce.php L265/L664/L942) without sufficient sanitization on input or escaping on output, so a value like the billing first name is emitted into the page/JavaScript context verbatim. Because the tainted data is stored with the order and rendered later, it is a persistent (stored) XSS rather than reflected.

RemediationAI

Upgrade the plugin to GTM4WP 1.22.4 or later; the fix is confirmed by the WordPress.org changeset diffing tag 1.22.3 against 1.22.4 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fduracelltomi-google-tag-manager/tags/1.22.3&new_path=%2Fduracelltomi-google-tag-manager/tags/1.22.4 and the frontend.php changeset https://plugins.trac.wordpress.org/changeset/3618063/duracelltomi-google-tag-manager/trunk/public/frontend.php), with details in the Wordfence advisory linked above. If immediate patching is not possible, disable the GTM4WP WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA), which removes the vulnerable data path at the cost of losing WooCommerce order/customer data in the GTM dataLayer (breaking enhanced e-commerce tracking); as an additional layer, deploy a WAF/virtual-patch rule to block script-like payloads in WooCommerce billing fields and review existing orders for injected markup before it is rendered in the admin.