CVE-2006-0733
** DISPUTED ** Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote...
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
- Record
CVE-2006-0733- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
- Record
CVE-2006-0733- Updated
- 2026-11-02
EUVDEUVD-2006-0740 No score
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
- Record
EUVD-2006-0740- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwhv-j4q5-f4g2 No score
** DISPUTED ** Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote...
** DISPUTED ** Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability.
- Record
GHSA-pwhv-j4q5-f4g2- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
- Record
CVE-2006-0733- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-0733 No score
Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
- Record
DEBIAN-CVE-2006-0733- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
All versions, plus listed versions 6.1.1+dfsg1-16.1.6+dfsg1-0+deb12u16.1.9+dfsg1-0+deb12u16.2+dfsg1-16.2.1+dfsg1-1 Show 26 moreShow less6.2.2+dfsg1-16.3+dfsg1-16.3.1+dfsg1-16.3.2+dfsg1-16.4.1+dfsg1-16.4.1+dfsg1-1.16.4.2+dfsg1-16.4.3+dfsg1-16.5+dfsg1-16.5.2+dfsg1-16.5.3+dfsg1-16.5.5+dfsg1-16.6.1+dfsg1-16.7.2+dfsg1-16.7.2+dfsg1-1.16.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
wordpressDebian:13 |
All versions, plus listed versions 6.8.1+dfsg1-16.8.10+dfsg1-0+deb13u16.8.3+dfsg1-0+deb13u16.8.3+dfsg1-16.8.6+dfsg1-0+deb13u1 Show 10 moreShow less6.8.7+dfsg1-0+deb13u16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
wordpressDebian:14 |
All versions, plus listed versions 6.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-1 Show 6 moreShow less7.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Core 2.0 - Comment Post HTML Injection | 2006-02-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0733 is a low vulnerability (CVSS 2.6) in Wordpress, published February 16, 2006. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.83%, the 92nd percentile.
References
myimei.com/security/2006-02-15/wordpress200autors-websitexss-attack.html
exchange.xforce.ibmcloud.com/vulnerabilities/24736
securityfocus.com/archive/1/425043/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2006-0733
github.com/advisories/GHSA-pwhv-j4q5-f4g2
security-tracker.debian.org/tracker/CVE-2006-0733