WP Manifestindependent plugin directory
manifest / analytics / uri-gtm-injector

URI GTM Injector WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

URI GTM Injector

by URI Web Communications · github.com/uriweb/uri-gtm-injector · website

★ 0stars
402composer installs
v1.0.1latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/uriweb/uri-gtm-injector/archive/refs/heads/develop.zip

On Packagist as uriweb/uri-gtm-injector:

composer require uriweb/uri-gtm-injector
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/uriweb/uri-gtm-injector ↗

A super lightweight plugin to inject a GTM tag across a WordPress multisite network.

Setup

Note: This plugin requires the active theme to support wp_head and wp_body_open.

  1. Ensure that GTM is not being injected in any other way prior to using this plugin. GTM might already be injected by the active theme, another plugin, or directly via a script tag on a page, post, or widget, etc.
  2. Network-activate the URI GTM Injector plugin.
  3. In the plugin's network settings, enter your GTM property ID and save.
  4. Check Google Analytics to make sure the property is connected and data is flowing.

Plugin Details

Contributors: Brandon Fuller
Tags: plugins
Requires at least: 5.2
Tested up to: 6.8.2
Stable tag: 1.0.1
License: GPL-3.0

Releases

2 releases.

Tag
Published
v1.0.1 latest
Sep 12, 2025 1 year ago
v1.0.0
Jul 18, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

URI GTM Injector 1.0.1 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.0.1
Findings
2
Worst severity
high
Content hash
7524db5bf95a305a379cefae…

Findings

  • high CSRF + unsanitized GTM ID stored and echoed in frontend script context

    csrf

    uri_gtm_injector_save_options updates uri_gtm_injector_id from raw $_POST without check_admin_referer or an explicit capability check. The value is later echoed unescaped inside an inline GTM bootstrap script on wp_head/wp_body_open. A forged network-admin POST can inject arbitrary JavaScript site-wide (stored XSS / skimmer-class injection via GTM ID).

    inc/uri-gtm-injector-settings.php:128-140

    Recommendation

    Call check_admin_referer matching settings_fields; require manage_options/manage_network_options; sanitize with a strict GTM-ID allowlist (e.g. /^GTM-[A-Z0-9]+$/) and echo via esc_js().

  • high GTM container ID printed without escaping in script tag

    xss_stored

    uri_gtm_injector() and uri_gtm_injector_noscript() echo get_site_option('uri_gtm_injector_id') directly into JavaScript/HTML attribute contexts without esc_js/esc_attr, so any stored value becomes executable script on every public page.

    inc/uri-gtm-injector-actions.php:12-36

    Recommendation

    Validate GTM IDs on save and escape with esc_js()/esc_attr() on output.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →