CVE-2011-5182

MEDIUM 4.3 CVSS 2.0

Published: September 20, 2012
Last modified: June 16, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-79
CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf.

Affected products and versions

n/a n/a — Versions not specified

References

www.securityfocus.com http://www.securityfocus.com/archive/1/520574/100/0/threaded
www.securityfocus.com http://www.securityfocus.com/archive/1/520678/100/0/threaded
www.securityfocus.com http://www.securityfocus.com/bid/50746 Exploit
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/71411
wordpress.org https://wordpress.org/support/topic/plugin-lanoba-social-plugin-xss-vulnerabilities Vendor Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References