GTM4WP – A Google Tag Manager (GTM) plugin for WordPress Security & Risk Analysis

The duracelltomi-google-tag-manager plugin, version 1.22.3, exhibits a mixed security posture. On the positive side, the static analysis reveals a relatively small attack surface with only one AJAX handler and no REST API routes, shortcodes, or cron events. Crucially, the single entry point appears to have an authentication check, and there are no detected critical or high severity taint flows, indicating that sensitive data handling is likely robust in the current version. Furthermore, a high percentage of output is properly escaped, mitigating some Cross-Site Scripting (XSS) risks.

However, significant concerns arise from the plugin's vulnerability history. It has a total of three known CVEs, with one high and two medium severity vulnerabilities previously identified, primarily related to Cross-Site Scripting. The fact that there have been multiple historical vulnerabilities of this nature, even if currently patched, suggests a recurring pattern of input sanitization or output escaping deficiencies. The static analysis also shows 2% of SQL queries are not using prepared statements, which can lead to SQL injection vulnerabilities if not properly handled, and a lack of comprehensive capability checks is also noted. The plugin's history of XSS vulnerabilities, coupled with the presence of raw SQL queries and the lack of capability checks, suggests that while current taint analysis might be clean, past issues point to potential weaknesses that could resurface or be exploited in future versions or through different attack vectors.

In conclusion, while the immediate static analysis of version 1.22.3 shows some good security practices like limited attack surface and good output escaping, the plugin's historical vulnerability profile, particularly concerning XSS, and the presence of raw SQL queries are significant weaknesses. Users should remain vigilant and prioritize updating to newer versions as they become available, while developers should focus on addressing the historical patterns of input validation and output escaping flaws.