CVE-2022-1707

Katalog CVE

CVSS 6.1 · Medium EPSS 89,3%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada gtm4wp google tag manager. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.

Rincian

Terbit di NVD

13 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

89,3% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/0435ae14-c1fd-4611-acbe-5f3bafd4bb6a?source=cve advisory pihak ketiga
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1707 advisory pihak ketiga
• https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L298 product
• https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L782 product
• https://github.com/duracelltomi/gtm4wp/issues/224 issue tracking