CVE-2022-1707: Google Tag Manager for WordPress plugin reflected XSS via s parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated reflected XSS with a very high EPSS score and broad WordPress exposure warrants prompt patching despite the medium CVSS rating.

What it is

The Google Tag Manager for WordPress plugin fails to sanitize the site search 's' parameter before populating it into the data layer, allowing reflected cross-site scripting in versions up to and including 1.15. Because the flaw sits in the public frontend, any site visitor can be targeted, and successful exploitation runs script in the victim's browser under the site's origin.

Impact

An attacker can execute arbitrary JavaScript in a victim's browser in the context of the affected WordPress site, enabling session theft, credential phishing, or redirection to malicious content.

Attack surface

Reached over the network through the site search parameter, which is reflected into the data layer on public pages. No authentication is required, but the victim must be induced to click a crafted link (UI:R).

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.89276, 99.77th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Update the Google Tag Manager for WordPress plugin to a version later than 1.15.
• If immediate patching is not possible, disable or restrict the plugin until it can be updated.
• Deploy a WAF rule to block script payloads in the 's' search parameter.
• Sanitize and encode the search parameter before it is written into the data layer.
• Review site search and data layer output for other unsanitized reflected inputs.

Detection

• Search web server and WAF logs for script tags or event handlers in the 's' query parameter.
• Monitor for requests containing encoded JavaScript in search URLs hitting frontend.php.
• Alert on anomalous outbound redirects or script loads originating from search result pages.
• Review plugin version inventory to identify sites still running 1.15 or earlier.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.