CVE-2019-7250

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code (via SCRIPT elements, event handlers, etc.). Since this code is stored by the plugin, the attacker may be able to target anyone who opens the configuration panel of the plugin.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 31, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-72516.5An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 anCVE-2019-72529.8Linear eMerge E3-Series devices have Default Credentials.CVE-2019-72539.8Linear eMerge E3-Series devices allow Directory Traversal.CVE-2019-72547.5Linear eMerge E3-Series devices allow File Inclusion.CVE-2019-72556.1Linear eMerge E3-Series devices allow XSS.CVE-2019-72569.8Linear eMerge E3-Series devices allow Command Injections.CVE-2019-725710.0Linear eMerge E3-Series devices allow Unrestricted File Upload.CVE-2019-72588.8Linear eMerge E3-Series devices allow Privilege Escalation.CVE-2019-72598.8Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.CVE-2019-72609.8Linear eMerge E3-Series devices have Cleartext Credentials in a Database.CVE-2019-72619.8Linear eMerge E3-Series devices have Hard-coded Credentials.CVE-2019-72628.8Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
CVE-2019-7250: Medium severity, CVSS 6.1 | Vulnix