WP Manifestindependent plugin directory
manifest / analytics / meom-3rd-party-scripts

MEOM 3rd Party Scripts WP RegistryLow-severity findings · 1 findingOpen the reportA-

WordPress plugin for creating settings for 3rd party script like Google Tag Manager and Cookiebot.

by MEOM · github.com/meom/meom-3rd-party-scripts

★ 0stars
9.3kcomposer installs
1.2.5latest · 8mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/meom/meom-3rd-party-scripts/archive/refs/heads/main.zip

On Packagist as meom/meom-3rd-party-scripts:

composer require meom/meom-3rd-party-scripts
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/meom/meom-3rd-party-scripts ↗

Make sure that your theme contains:

wp_head();

And this after you have opened the body tag:

wp_body_open();

Filters

You can modify the output with following filters:

  • mtps_gtm_id
  • mtps_gtm_head_code
  • mtps_cookiebot_id
  • mtps_cookiebot_code
  • mtps_cookiebot_consent_mode
  • mtps_gtm_body_code

Cookie declaration text can be added using shortcode:

[mtps-cookie-declaration]

Releases

10 releases.

Tag
Published
1.2.5 latest
Feb 12, 2026 8mo ago
1.2.4
Feb 12, 2026 8mo ago
1.2.3
Nov 11, 2025 11mo ago
1.2.2
Jun 17, 2025 1 year ago
1.2.1
Jun 12, 2025 1 year ago
1.2.0
Jun 12, 2025 1 year ago
1.1.2
May 21, 2024 2 years ago
1.1.1
Apr 26, 2024 2 years ago
1.1.0
Mar 4, 2022 4 years ago
1.0.0
Apr 22, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

MEOM 3rd Party Scripts 1.2.5 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.2.5
Findings
1
Worst severity
low
Content hash
d9f7256b42a96596ae018775…

Findings

  • low GTM ID inserted into frontend script without sanitization

    missing_escaping

    mtps_settings is registered without a sanitize_callback. mtps_head_scripts concatenates $gtm_id directly into an inline Google Tag Manager script string (Cookiebot path uses esc_attr). Only manage_options can save settings, so this is admin-gated stored script injection / missing hardening rather than a below-admin skimmer.

    src/script-rendering.php:64-75

    Recommendation

    Add sanitize_callback on register_setting to allow only GTM-[A-Z0-9]+; use esc_js() when interpolating into script; consider wp_enqueue_script patterns instead of raw echo.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →