Tracking is often treated as a marketing task: add a container, define events, measure campaigns. In a WooCommerce shop, however, tracking is also part of the technical attack surface.
A current GTM4WP notice illustrates the point. Tenable lists CVE-2026-16597 as a stored XSS issue through version 1.22.3 under a specific condition: the GTM4WP integration for WooCommerce order data must be enabled. The vendor states that the corrected 1.22.4 release is available.
What this means for marketing and shop operations
This does not mean that every shop using Google Tag Manager is compromised. It shows something more general: tracking code carries data through publicly reachable systems. It needs the same operational discipline as payment, form and login components.
When a plugin writes order data into a page or data layer, it is no longer only about measurement. It is also about how inputs are cleaned, rendered and tested after an update.
Check more than the plugin version
Version is the starting point. Then ask whether GTM4WP is installed and active, whether the affected integration is enabled, whether guest checkout is possible, which templates or admin views render order or tracking data, and whether checkout and measurement have a defined post-update test.
Update and tracking test belong together
After an update, run a test order where possible, check the confirmation and critical shop pages, confirm expected data-layer events, inspect only designated test signals in analytics, and document the result and version. The test does not need to be long; it needs to be repeatable and owned.
Plan major changes deliberately
The vendor describes GTM4WP 2.0 as a rebuild, initially offered as an opt-in beta. That is the appropriate approach for business-critical sites: a beta belongs in development or staging, not untested in a running shop. Later stable major releases should still test the container, data layer, consent integration and checkout measurement as one package.
CTA: The WordPress Security & Performance Check helps treat security updates, checkout and tracking as one traceable operating process.