Wp E Commerce · Swipe Checkout For Wp E-Commerce · CVE-2014-4559
**Name of the Vulnerable Software and Affected Versions**
Swipe Checkout for WP e-Commerce plugin versions 3.1.0 and earlier
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML via the `api key`, `payment page url`, `merchant id`, `api url`, or `currency` parameter in the test-plugin.php file. This can be exploited by injecting malicious code through these parameters.
**Recommendations**
For versions 3.1.0 and earlier, consider disabling the test-plugin.php file or restricting access to it until a patch is available. Avoid using the `api key`, `payment page url`, `merchant id`, `api url`, or `currency` parameters in the affected plugin until the issue is resolved.