Description
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin Dharma booking Local/Remote File Inclusion (2.38.3)
SharePoint CVE-2019-1035 Vulnerability (CVE-2019-1035)
WordPress Plugin Portfolio-WordPress Portfolio Cross-Site Request Forgery (2.8.8)
WordPress Plugin Content Blocks (Custom Post Widget) Local File Inclusion (3.3.0)
WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-5113)