Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-1961
CVE-2022-1961:
WordPress vulnerability analysis and mitigation
Overview
The Google Tag Manager for WordPress (GTM4WP) plugin contained a Stored Cross-Site Scripting vulnerability (CVE-2022-1961) discovered in versions up to and including 1.15.1. The vulnerability was identified in the ~/public/frontend.php file, specifically related to insufficient escaping of the gtm4wp-options[scroller-contentid] parameter (NVD, WPScan).
Technical details
The vulnerability exists due to improper escaping of the Content Element ID settings in the scroll tracking functionality. The issue specifically occurs in the public/frontend.php file at line 717, where the gtm4wp-options[scroller-contentid] parameter is not properly sanitized before being output into JavaScript code (GitHub Exploit). The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).
Impact
The vulnerability affects multi-site installations where unfilteredhtml is disabled for administrators, and sites where unfilteredhtml is disabled. When exploited, it allows attackers with administrative user access to inject arbitrary web scripts into the website (NVD).
Mitigation and workarounds
The vulnerability was patched in version 1.15.2 of the plugin. The fix involves properly escaping the content ID parameter using the esc_js() function. Site administrators should update to version 1.15.2 or later to protect against this vulnerability (WordPress Plugin).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management