CVE-2015-1879

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-02-19 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.

Affected products

Google Doc Embedder: 2.5.18

References

http://packetstormsecurity.com/files/130309/WordPress-Google-Doc-Embedder-2.5.18-Cross-Site-Scripting.html
http://www.securityfocus.com/bid/72547
https://wordpress.org/plugins/google-document-embedder/changelog/
http://packetstormsecurity.com/files/130309/WordPress-Google-Doc-Embedder-2.5.18-Cross-Site-Scripting.html
http://www.securityfocus.com/bid/72547
https://wordpress.org/plugins/google-document-embedder/changelog/

Get alerted when CVE-2015-1879 or the next vulnerability affects your stack