CVE-2011-5106

Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin...

4.3 MediumPublic exploit

Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

Exploit likelihood

10.9%Up 8.9 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2011-5106
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-5106
Updated: 2026-11-02

EUVDEUVD-2011-5006 No score

Record: EUVD-2011-5006
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w5j7-j9wm-9x8q No score

Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin...

Record: GHSA-w5j7-j9wm-9x8q
Weakness: CWE-79
Updated: 2026-11-02

Affected products

fractalia flexible custom post type

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin Flexible Custom Post Type - 'id' Cross-Site Scripting	2011-11-17
Nuclei	WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-5106 is a medium vulnerability (CVSS 4.3) in Fractalia Flexible Custom Post Type, published August 23, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.9%, the 95th percentile. No source names a fixed version.