Unscored severity · published Sep 20, 2012
CVE-2011-5182
Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or…
–
CVSS
3.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Lanoba Social Plugin · Wordpress
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-5182
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-5182
www.securityfocus.com
http://www.securityfocus.com/archive/1/520574/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/520678/100/0/threaded
Exploit
http://www.securityfocus.com/bid/50746
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/71411
Vendor Advisory
https://wordpress.org/support/topic/plugin-lanoba-social-plugin-xss-vulnerabilities