GTM4WP < 1.22.4 - Unauthenticated Stored XSS via WooCommerce Billing Fields

Description

The plugin does not properly escape WooCommerce billing field values before outputting them in an inline data layer script, allowing unauthenticated users to inject arbitrary JavaScript via a guest checkout order.

The values are escaped with esc_js(), but the whole script block was then passed through htmlspecialchars_decode() after wp_kses(), turning the escaped quotes back into raw characters and re-enabling a break-out of the JavaScript string. This requires the WooCommerce order data integration option to be enabled; the payload executes when the order-received page for that order is loaded.