Summary
generated automatically from NVD dataWordPress 2.0.1 and earlier contain multiple cross-site scripting flaws in the "post comment" functionality. Remote attackers can inject arbitrary web script or HTML through the name, website, and comment parameters, which could run malicious content in the browsers of users viewing the affected pages. The issue is rated MEDIUM with a CVSS v2.0 score of 4.3.
NVD description
Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.
EPSS · FIRST.org
3.1%probability of exploitation in the next 30 days
Higher than 87% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 3 mars 2006
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (14)
- http://NeoSecurityTeam.net/advisories/Advisory-17.txtExploitPatchVendor Advisory
- http://NeoSecurityTeam.net/advisories/Advisory-17.txtExploitPatchVendor Advisory
Similar CVEs
Other vulnerabilities of type
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.