CVE-2014-4549

2014-07-0220:55:06

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-4549

cross-site scripting

xss

woocommerce

sagepay

direct payment gateway

wordpress

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.

Affected configurations

NVD

Node

woocommerce_sagepay_direct_payment_gateway_projectwoocommerce_sagepay_direct_payment_gatewayRange≤0.1.6.6---wordpress

CPENameOperatorVersion
woocommerce_sagepay_direct_payment_gateway_project:woocommerce_sagepay_direct_payment_gatewaywoocommerce sagepay direct payment gateway project woocommerce sagepay direct payment gatewayle0.1.6.6

CPE	Name	Operator	Version
woocommerce_sagepay_direct_payment_gateway_project:woocommerce_sagepay_direct_payment_gateway	woocommerce sagepay direct payment gateway project woocommerce sagepay direct payment gateway	le	0.1.6.6