WP Manifestindependent plugin directory
manifest / analytics / taggrs-wordpress

TAGGRS - Server Side Tracking WP RegistryMedium-severity findings · 4 findingsOpen the reportB-

Easily integrate your Wordpress/Woocommerce site with TAGGRS Server Side Tracking!

by TAGGRS BV · github.com/taggrs/taggrs-wordpress

★ 11stars
51release downloads
1.2.9latest · 1mo ago

Install

Download taggrs-wordpress-plugin.zip From the 1.0.5 release on GitHub, Jun 22, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/taggrs/taggrs-wordpress/releases/download/1.0.5/taggrs-wordpress-plugin.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.
Readme github.com/taggrs/taggrs-wordpress ↗

Integrate Google Analytics 4 (GA4) with server-side capabilities into your WooCommerce store for enhanced e-commerce analytics and user behavior tracking.

Summary

  • Requires at least: WordPress 4.5
  • Tested up to: WordPress 6.8
  • Stable tag: 1.2.8
  • Requires PHP: 7.2
  • License: GPLv2 or later
  • License URI: https://www.gnu.org/licenses/gpl-2.0.html

    Description

    This TAGGRS Server-Side Integration plugin seamlessly embeds Google Analytics 4 (GA4) data layer into your WooCommerce site, combining client-side and server-side tracking for a more comprehensive analysis of customer interactions. With this plugin, store owners gain deeper insights into their sales funnel and user behavior, enabling data-driven decision-making and improved store performance.

Features:

  • Easy integration of GA4 with WooCommerce.
  • Dual tracking: Combines client-side and server-side data collection.
  • Enhanced data accuracy and reliability.
  • Better privacy compliance.
  • Enhanced Conversions.
  • In-depth insights into customer journey and sales metrics via GA4.
  • Can be updated from within Wordpress.

Installation

  1. Upload the plugin to the /wp-content/plugins/ directory and unzip it, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the 'Plugins' screen in WordPress.
  3. Use the TAGGRS screen in the menu bar to configure the plugin.
  4. Enter your GTM code to link your Google Tag Manager account.

Frequently Asked Questions

Do I need a Google Tag Manager account to use this plugin?

Yes, you need to have a GoogleTag Manager account and a GTM code to integrate the plugin with GA4.

Do I need a TAGGRS account to use this plugin?

No, its not required to have a TAGGRS account. We recommend it to get the most out of your tracking.

Is this plugin compliant with privacy regulations like GDPR?

The plugin adheres to privacy regulations by providing server-side tracking, which enhances data privacy and compliance.

Third-Party Service Dependencies

Google Tag Manager

This TAGGRS Server-Side Integration plugin integrates with Google Tag Manager (GTM) for server-side tracking. This integration allows us to send data directly to GTM servers without requiring client-side scripting. This approach enhances data accuracy and privacy compliance.

Why We Use Google Tag Manager

We leverage Google Tag Manager due to its robust infrastructure and flexibility in handling server-side tracking. This enables our users to implement custom tracking solutions that meet their unique business needs while ensuring data is managed securely and efficiently.

Data Transmission Disclosure

Please be aware that by using this TAGGRS Server-Side Integration plugin, data will be transmitted to Google's servers as part of the tracking process. This may include, but is not limited to, user interactions, IP addresses, and other data you configure to track via GTM.

Third-Party Links

TAGGRS.io

This TAGGRS Server-Side Integration plugin integrates with TAGGRS for server-side tracking. This integration allows us to send data directly to TAGGRS servers without requiring client-side scripting. This approach enhances data accuracy and privacy compliance.

Why We Use TAGGRS

We leverage TAGGRS due to its robust infrastructure and flexibility in handling server-side tracking. This enables our users to implement custom tracking solutions that meet their unique business needs while ensuring data is managed securely and efficiently.

Data Transmission Disclosure

Please be aware that by using this TAGGRS Server-Side Integration plugin, data will be transmitted to TAGGRS's servers as part of the tracking process. This may include, but is not limited to, user interactions, IP addresses, and other data you configure to track.

Third-Party Links

Legal Compliance

We advise all users to review Google Tag Manager's Terms of Service and Privacy Policy to ensure compliance with data protection and privacy laws applicable to your use case. It is your responsibility to adhere to any legal requirements pertaining to data collection and processing activities conducted through GTM.

Changelog

1.0.5

  • Removed unnecessary navigation tabs in admin page

1.0.4

  • Improved script robustness in the remove_from_cart event.

1.0.3

  • Added TAGGRS Logo to the admins include files.
  • Changed all function names to "tggr_".
  • Changed versions in documents.
  • Added TAGGRS third party usage notice.
  • Added tggr_format_item & tggr_format_cart_items for consistency

1.0.2

  • Added categories to ad_to_cart AJAX event.

1.0.1

  • Update licenses to GPLv2
  • Included TAGGRS logo, limiting external dependencies
  • Updated required version
  • Replaced short php codes to full php codes.
  • Documented use of Google Tag Manager
  • Properly escaped all echos
  • Added prefix to all functions "tggr"
  • Made all files non-directly accessible

1.0.0

  • Initial release.

Upgrade Notice

1.0.0

Initial release. Please backup your website before installing.

Releases

Newest 25 of 27 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.2.9 latest
Sep 11, 2026 1mo ago
tag only
—
1.2.8
Aug 29, 2026 1mo ago
tag only
—
1.2.7
Aug 10, 2026 2mo ago
tag only
—
1.2.6
Jul 25, 2026 3mo ago
tag only
—
1.2.5
Jun 27, 2026 3mo ago
tag only
—
1.2.4
May 8, 2026 5mo ago
tag only
—
1.2.3
Mar 28, 2026 6mo ago
tag only
—
1.2.2
Mar 14, 2026 7mo ago
tag only
—
1.2.1
Feb 28, 2026 7mo ago
tag only
—
1.2
Jan 22, 2026 9mo ago
tag only
—
1.1.9
Nov 5, 2025 11mo ago
tag only
—
1.1.8
Sep 4, 2025 1 year ago
tag only
—
1.1.7
Jul 3, 2025 1 year ago
tag only
—
1.1.6
Jun 17, 2025 1 year ago
tag only
—
1.1.5
Jun 12, 2025 1 year ago
tag only
—
1.1.4
Jun 7, 2025 1 year ago
tag only
—
1.1.3
May 17, 2025 1 year ago
tag only
—
1.1.2
Apr 12, 2025 1 year ago
tag only
—
1.1.1
Apr 5, 2025 1 year ago
tag only
—
1.1.0
Mar 29, 2025 1 year ago
tag only
—
1.0.9
Feb 17, 2025 1 year ago
tag only
—
1.0.8
Jan 30, 2025 1 year ago
tag only
—
1.0.7
Jan 22, 2025 1 year ago
tag only
—
1.0.6
Jan 18, 2025 1 year ago
tag only
—
1.0.5
Jun 22, 2024 2 years ago
taggrs-wordpress-plugin.zip
37
All releases on GitHub →
B- grade

Security

TAGGRS - Server Side Tracking 1.0.3 · audited by WP Registry

Medium-severity findings.

2 medium 2 low
Audited release
1.0.3
Findings
4
Worst severity
medium
Content hash
28ff9a57bc26d899750d8eda…

Findings

  • medium Hardcoded TAGGRS API bearer token used by an unscoped dashboard widget

    hardcoded_credentials

    The plugin embeds a Laravel Sanctum-style bearer token and a TAGGRS container UUID in the dashboard widget, then sends them as Authorization: Bearer on every dashboard load via fetch_container_data(). wp_add_dashboard_widget() is registered with no capability, so any user who can view the WordPress dashboard (Subscriber and up, unless another plugin redirects them) triggers the authenticated request and is shown container name, tagging domain, plan, and request counts. The same token is repeated in commented-out GTM injection code. The secret is in publicly distributed plugin source (GitHub tag 1.0.5). It does not grant WordPress admin or a storefront skimmer, but it is a live vendor credential shared across every install. Later upstream versions removed the widget and token entirely.

    includes/widgets/taggrs_container_stats.php:5-47

    Recommendation

    Remove the hardcoded token and container UUID from the plugin. If container stats are required, authenticate with per-site credentials stored in the options table (not in source) and restrict the widget to manage_options. Rotate the leaked TAGGRS token.

  • medium Unauthenticated AJAX product oracle returns unpublished catalog data

    information_disclosure

    tggr_get_product_details_callback is registered on both wp_ajax_get_product_details and wp_ajax_nopriv_get_product_details with no nonce, capability check, or WooCommerce product-visibility check. Any unauthenticated visitor can POST product_id to admin-ajax.php and receive JSON containing name, price, currency, and categories. wc_get_product() loads the product by ID regardless of publish status or catalog visibility, so draft, private, pending, and hidden products are enumerable by sequential IDs. The same endpoint is invoked from a footer script on every page when remove_from_cart is enabled (hardcoded /wp-admin/admin-ajax.php). This is a read-only leak of merchant catalog data, not customer PII or a state change. Upstream later deleted this AJAX action.

    includes/events/remove_from_cart.php:140-177

    Recommendation

    Drop the AJAX action (current upstream uses a first-party cookie instead). If kept, require a nonce, and refuse products that are not published and catalog-visible.

  • low Debug dump of the full WooCommerce cart is printed on checkout

    debug_code

    When the add_shipping_info event is enabled (it is 1 in default_option_tggr_options), tggr_add_shipping_info echoes json_encode($cart->get_cart()) into a visible <p> on the checkout shipping form. Native json_encode is not HTML-escaped. The dump exposes internal cart keys, line tax data, and data hashes to every checkout visitor and is leftover debug (the rest of the function already pushes a proper dataLayer event). Upstream removed this echo.

    includes/events/add_shipping_info.php:27-29

    Recommendation

    Remove the debug echo. If cart contents must be passed to JavaScript, use wp_json_encode inside a script tag (as the following dataLayer.push already does).

  • low Plugin header version does not match the distributed GitHub tag

    version_mismatch

    The plugin header and readme Stable tag both say 1.0.3, while the GitHub release/tag for this zip is 1.0.5 and the changelog documents 1.0.4 and 1.0.5. Update clients and vulnerability scanners that key off the Version header will mis-identify the installed build.

    taggrs-datalayer.php:5-5

    Recommendation

    Set the plugin header Version, readme Stable tag, and git tag to the same value before each release.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →