CVE-2014-4549

2014-07-0220:55:06

CWE-79

mitre

web.nvd.nist.gov

cve-2014-4549

cross-site scripting

xss

woocommerce

sagepay

direct payment gateway

wordpress

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

58.6%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.

Affected configurations

Nvd

Node

woocommerce_sagepay_direct_payment_gateway_projectwoocommerce_sagepay_direct_payment_gatewayRange≤0.1.6.6---wordpress

VendorProductVersionCPE
woocommerce_sagepay_direct_payment_gateway_projectwoocommerce_sagepay_direct_payment_gateway*cpe:2.3:a:woocommerce_sagepay_direct_payment_gateway_project:woocommerce_sagepay_direct_payment_gateway:*:-:-:*:-:wordpress:*:*

Vendor	Product	Version	CPE
woocommerce_sagepay_direct_payment_gateway_project	woocommerce_sagepay_direct_payment_gateway	*	cpe:2.3:a:woocommerce_sagepay_direct_payment_gateway_project:woocommerce_sagepay_direct_payment_gateway::-:-::-:wordpress::