Google Doc Embedder Security Vulnerabilities

CVE-2012-4915

Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to libs/pdf.php.

CVE-2014-9173

SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.

CVE-2015-1879

Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.

CVE-2016-10880

The google-document-embedder plugin before 2.6.1 for WordPress has XSS.

CVE-2016-10881

The google-document-embedder plugin before 2.6.2 for WordPress has XSS.

CVE-2016-10882

The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.