CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0216 – Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery
https://notcve.org/view.php?id=CVE-2024-0216
The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. El complemento Google Doc Embedder para WordPress es vulnerable a Server Side Request Forgery a través del código abreviado 'gview' en versiones hasta la 2.6.4 incluida. Esto puede permitir a atacantes autenticados con permisos de nivel de colaborador o superior realizar solicitudes web a ubicaciones arbitrarias que se originen en la aplicación web y puede usarse para consultar y modificar información de servicios internos. • https://plugins.trac.wordpress.org/browser/google-document-embedder/tags/2.6.4/functions.php#L187 https://www.wordfence.com/threat-intel/vulnerabilities/id/75e55138-b091-4113-89da-e1ca45fb99ea?source=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10881 – Google Doc Embedder <= 2.6.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10881
The google-document-embedder plugin before 2.6.2 for WordPress has XSS. El plugin google-document-embedder versiones anteriores a 2.6.2 para WordPress, presenta una vulnerabilidad de tipo XSS. • https://wordpress.org/plugins/google-document-embedder/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10882 – Google Doc Embedder <= 2.6.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2016-10882
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. El plugin google-document-embedder versiones anteriores a 2.6.2 para WordPress, presenta una vulnerabilidad de tipo CSRF. The Google Doc Embedder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.1. This makes it possible for unauthenticated attackers to conduct attacks such as cross-site scripting via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wordpress.org/plugins/google-document-embedder/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10880 – Google Doc Embedder <= 2.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10880
The google-document-embedder plugin before 2.6.1 for WordPress has XSS. El plugin google-document-embedder versiones anteriores a 2.6.1 para WordPress, presenta una vulnerabilidad de tipo XSS. • https://wordpress.org/plugins/google-document-embedder/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2015-1879 – Google Doc Embedder <= 2.5.18 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-1879
Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php. Vulnerabilidad de XSS en el plugin Google Doc Embedder anterior a 2.5.19 para WordPress permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro profile en una acción de editar en la página gde-settings en wp-admin/options-general.php. • http://packetstormsecurity.com/files/130309/WordPress-Google-Doc-Embedder-2.5.18-Cross-Site-Scripting.html http://www.securityfocus.com/bid/72547 https://wordpress.org/plugins/google-document-embedder/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •