CVE-2014-4549

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-07-02 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.

Affected products

Woocommerce Sagepay Direct Payment Gateway Project Woocommerce Sagepay Direct Payment Gateway: through 0.1.6.6

References

http://codevigilant.com/disclosure/wp-plugin-sagepay-direct-for-woocommerce-payment-gateway-a3-cross-site-scripting-xss
http://wordpress.org/plugins/sagepay-direct-for-woocommerce-payment-gateway/changelog
http://www.securityfocus.com/bid/65355
https://github.com/wp-plugins/sagepay-direct-for-woocommerce-payment-gateway/commit/9c6cf939c6c25377c285439b92ef2bb5ebda9db6
http://codevigilant.com/disclosure/wp-plugin-sagepay-direct-for-woocommerce-payment-gateway-a3-cross-site-scripting-xss
http://wordpress.org/plugins/sagepay-direct-for-woocommerce-payment-gateway/changelog
http://www.securityfocus.com/bid/65355
https://github.com/wp-plugins/sagepay-direct-for-woocommerce-payment-gateway/commit/9c6cf939c6c25377c285439b92ef2bb5ebda9db6

Get alerted when CVE-2014-4549 or the next vulnerability affects your stack