# GTM4WP – A Google Tag Manager (GTM) plugin for WordPress

> Advanced tag management for WordPress with Google Tag Manager

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:37 UTC.

## Facts (WordPress.org)

- Slug: `duracelltomi-google-tag-manager`
- Author: Thomas Geiger
- Version: 2.1.1
- Active installs: 700,000+
- Last update: 2026-11-05 (8 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.3, PHP 8.0
- Tags: google ads, google analytics, google tag manager, gtm, tag manager
- Page: https://wordpress.org/plugins/duracelltomi-google-tag-manager/

## Checks (against WordPress 7.1.4)

- OK: Updated 8 days ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 8.0 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Phones home ↔ Private, Heavy ↔ Light, Behind ↔ Current, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit.

## Known vulnerabilities

- 2026-07-29 HIGH: Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields (up to 1.22.3). CVE-2026-16597, https://www.wordfence.com/threat-intel/vulnerabilities/id/03542812-b6e5-421d-9ba6-43f1c779940f?source=api-prod
- 2022-05-31 MEDIUM: Stored Cross-Site Scripting via Content Element ID (up to 1.15.1). CVE-2022-1961, https://www.wordfence.com/threat-intel/vulnerabilities/id/202c14d0-9207-47cb-9410-ca4c70d7b6d2?source=api-prod
- 2022-05-19 MEDIUM: Reflected Cross-Site Scripting via Site Search (up to 1.15). CVE-2022-1707, https://www.wordfence.com/threat-intel/vulnerabilities/id/0435ae14-c1fd-4611-acbe-5f3bafd4bb6a?source=api-prod
- 2022-05-12 HIGH: Cross-Site Scripting via Cloudflare Country Code (up to 1.15). WF-79a41b84-2e19-46eb-9f6b-5155da0b15cc, https://www.wordfence.com/threat-intel/vulnerabilities/id/79a41b84-2e19-46eb-9f6b-5155da0b15cc?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=duracelltomi-google-tag-manager · HTML: https://todaywp.com/plugins/duracelltomi-google-tag-manager