Unscored severity · published Feb 16, 2006
CVE-2006-0733
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2)…
–
CVSS
4.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · WordPress
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0733
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0733
Exploit
http://myimei.com/security/2006-02-15/wordpress200autors-websitexss-attack.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/425043/100/0/threaded
Exploit
http://www.securityfocus.com/bid/16656
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/24736
More from WordPress
9.8
CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
9.8
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
8.1
CVE-2026-87902
WordPress Core Remote File Inclusion Vulnerability
7.5
CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability