CVE-2022-1707

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17087.5A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecS CVE-2022-17094.3The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending),CVE-2022-17104.8The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allo CVE-2022-17117.5Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.CVE-2022-17124.3The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to m CVE-2022-17137.5SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This CVE-2022-17147.1Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented CVE-2022-17159.8Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-17164.6Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to acce CVE-2022-17174.8The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could al CVE-2022-17187.5The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to ca CVE-2022-17195.4Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a ma