{"cve":"CVE-2011-5182","nvd":{"published":"2012-09-20T10:55:26.820","modified":"2026-06-16T23:36:06.103","status":"Modified","description":"Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.  NOTE: the vendor disputes this issue, stating \"Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-79"],"references":["http://www.securityfocus.com/archive/1/520574/100/0/threaded","http://www.securityfocus.com/archive/1/520678/100/0/threaded","http://www.securityfocus.com/bid/50746","https://exchange.xforce.ibmcloud.com/vulnerabilities/71411","https://wordpress.org/support/topic/plugin-lanoba-social-plugin-xss-vulnerabilities"],"products":["wordpress:lanoba_social_plugin"],"source":"nvd","synced_at":"2026-10-19T20:25:53.526315492+00:00"},"epss":{"cve":"CVE-2011-5182","score":0.03604,"percentile":0.89469,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}