VulnerabilityModified
CVE-2014-4549
Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes…
MEDIUM 4.3EPSS 2.06%
Does this matter?
Lower severity and a low EPSS score (2.06%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.06% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- woocommerce sagepay direct payment gateway project/woocommerce sagepay direct payment gateway
- Source
- cve@mitre.org
References
- http://codevigilant.com/disclosure/wp-plugin-sagepay-direct-for-woocommerce-payment-gateway-a3-cross-site-scripting-xssExploit
- http://wordpress.org/plugins/sagepay-direct-for-woocommerce-payment-gateway/changelogPatch
- http://www.securityfocus.com/bid/65355Exploit
- https://github.com/wp-plugins/sagepay-direct-for-woocommerce-payment-gateway/commit/9c6cf939c6c25377c285439b92ef2bb5ebda9db6
- http://codevigilant.com/disclosure/wp-plugin-sagepay-direct-for-woocommerce-payment-gateway-a3-cross-site-scripting-xssExploit
- http://wordpress.org/plugins/sagepay-direct-for-woocommerce-payment-gateway/changelogPatch
- http://www.securityfocus.com/bid/65355Exploit
- https://github.com/wp-plugins/sagepay-direct-for-woocommerce-payment-gateway/commit/9c6cf939c6c25377c285439b92ef2bb5ebda9db6
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.