The GTM4WP – A Google Tag Manager plugin for WordPress contains a flaw that allows an attacker to store malicious JavaScript in WooCommerce billing fields when the WooCommerce order data integration option is enabled. The plugin fails to properly sanitize or escape user input, so a payload injected into a billing field such as the first name is later rendered as part of a page viewed by any user. If executed, the script runs with the privileges of the viewer’s browser; based on the description, it is inferred that this could allow session hijacking, phishing, or data theft.

This weakness affects all installations of the GTM4WP plugin version 1.22.3 or older that have the WooCommerce integration feature turned on. The vulnerability exists in the plugin’s handling of billing fields within the WooCommerce checkout flow.

With a CVSS score of 7.2, the vulnerability is classified as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation currently, and the flaw is not listed in the CISA KEV catalog. An attacker does not need authentication to trigger the bug; they can create a guest checkout order with malicious content in a billing field. The injected script will execute when any user accesses a page that renders the stored order data, making the issue potentially visible to many visitors if the attacker targets high‑traffic sites.