CVE-2019-7250

Published: Jan 31, 2019Modified: Jun 17, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code (via SCRIPT elements, event handlers, etc.). Since this code is stored by the plugin, the attacker may be able to target anyone who opens the configuration panel of the plugin.

Affected (1)

Products: Cross Reference Project: Cross Reference

Cross Reference Project

1 product

Cross Reference

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cross Reference Project Cross Reference	Version 36

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/davidrthorn/cross_reference/issues/32

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/davidrthorn/cross_reference/issues/32

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.