CVE-2026-16597: GTM4WP WordPress Plugin XSS Vulnerability

CVE-2026-16597 Overview

CVE-2026-16597 is a stored Cross-Site Scripting (XSS) vulnerability in the GTM4WP – A Google Tag Manager (GTM) plugin for WordPress. The flaw affects all versions up to and including 1.22.3 and stems from insufficient input sanitization and output escaping in WooCommerce billing field handling. Unauthenticated attackers can inject arbitrary JavaScript by placing a guest checkout order with a payload in a WooCommerce billing field such as the billing first name. The injected script executes when any user views the affected page. Exploitation requires the GTM4WP_OPTION_INTEGRATE_WCORDERDATA option to be enabled.

Critical Impact
Unauthenticated stored XSS via guest checkout allows persistent script injection into pages viewed by site visitors and administrators, enabling session theft, defacement, and drive-by attacks.

Affected Products

GTM4WP – A Google Tag Manager (GTM) plugin for WordPress, versions up to and including 1.22.3
Sites running WooCommerce with the GTM4WP WooCommerce order data integration enabled
WordPress installations exposing guest checkout with the vulnerable plugin active

Discovery Timeline

2026-07-29 - CVE-2026-16597 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2026-16597

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified under [CWE-79]. GTM4WP integrates WooCommerce order data into the Google Tag Manager data layer that renders on frontend pages. When the plugin reads billing fields submitted during checkout, it fails to sanitize input and does not escape the values when writing them into the data layer output. An attacker completing a guest checkout order can supply a JavaScript payload in fields such as the billing first name. The stored value is later rendered inline within the page markup and executed in the browser of any user who visits an affected page.

Root Cause

The root cause is missing input sanitization on inbound WooCommerce billing field values and missing output escaping when those values are injected into the GTM data layer script. The vulnerable rendering paths are referenced in integration/woocommerce.php and public/frontend.php in the plugin's 1.22.3 source tree. Because guest checkout does not require authentication, the attack surface is exposed to any unauthenticated visitor when the GTM4WP_OPTION_INTEGRATE_WCORDERDATA setting is enabled.

Attack Vector

The attack is delivered over the network with no privileges and no user interaction. An attacker submits a guest checkout order and places a JavaScript payload into a WooCommerce billing field. The payload is stored server-side and reflected into GTM data layer markup on order-related pages. When a legitimate user, including a store administrator viewing order details, loads such a page, the browser executes the attacker-controlled script in the context of the WordPress origin.

No verified proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis and the plugin source at WooCommerce Integration Code for technical details.

Detection Methods for CVE-2026-16597

Indicators of Compromise

WooCommerce orders whose billing fields contain HTML tags, <script>, onerror=, onload=, or javascript: sequences
Unexpected outbound requests from browsers loading order confirmation, thank-you, or order-received pages
New or unfamiliar admin accounts, session cookies exfiltrated to external hosts, or modified WordPress user records following visits to order pages
GTM data layer output on rendered pages containing raw markup or script fragments sourced from billing fields

Detection Strategies

Query the WooCommerce database (wp_postmeta billing keys such as _billing_first_name) for entries containing angle brackets, quote characters, or scripting keywords.
Inspect rendered HTML of order-related pages and confirm GTM data layer values are JSON-escaped and free of executable markup.
Correlate web server access logs of POST /?wc-ajax=checkout or checkout endpoints with subsequent GET traffic to order-received pages that trigger anomalous browser behavior.

Monitoring Recommendations

Enable WordPress and WooCommerce audit logging for order creation events and monitor billing field content for suspicious tokens.
Deploy a Content Security Policy (CSP) that restricts inline script execution and alert on CSP violation reports from WooCommerce pages.
Track browser telemetry from administrative sessions viewing order data for indicators of session hijacking or credential access.

How to Mitigate CVE-2026-16597

Immediate Actions Required

Update the GTM4WP plugin to version 1.22.4 or later on all WordPress sites that use it.
If patching is delayed, disable the WooCommerce order data integration by turning off GTM4WP_OPTION_INTEGRATE_WCORDERDATA in plugin settings.
Review recent WooCommerce orders for malicious payloads in billing fields and sanitize or remove offending records.
Rotate administrator credentials and invalidate active sessions if you observe evidence of script execution against admin users.

Patch Information

The vendor released version 1.22.4 of the GTM4WP plugin, which adds output escaping for WooCommerce billing values rendered into the GTM data layer. See the WordPress Version Update 1.22.3 to 1.22.4 diff and WordPress Change Set 3618063 for the specific code changes in public/frontend.php.

Workarounds

Disable the GTM4WP WooCommerce order data integration until the plugin is updated.
Deploy a web application firewall rule to block checkout submissions that contain <script, on\w+=, or javascript: patterns in billing fields.
Enforce a strict Content Security Policy that blocks inline scripts on WooCommerce order pages to reduce impact of stored payloads.

bash

# Configuration example: WP-CLI commands to update the plugin and verify version
wp plugin update duracelltomi-google-tag-manager --version=1.22.4
wp plugin get duracelltomi-google-tag-manager --field=version