Description
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin Redirection PHP Object Injection (2.7.3)
Grafana Insufficiently Protected Credentials Vulnerability (CVE-2019-15635)
SharePoint CVE-2021-31181 Vulnerability (CVE-2021-31181)
WordPress Plugin Anti Plagiarism Cross-Site Scripting (3.60)
WordPress Plugin WordPress Photo Gallery by Gallery Bank Unspecified Vulnerability (3.1.26)