Description

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.

Remediation

References

CVE-2013-5739

Related Vulnerabilities

Joomla! Core 3.x.x Multiple Vulnerabilities (3.0.0 - 3.6.4)

MySQL CVE-2015-2576 Vulnerability (CVE-2015-2576)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-4342)

SugarCRM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-17306)

WordPress Plugin WPMovieLibrary Multiple Cross-Site Scripting Vulnerabilities (2.1.4.1)

Severity

Low

Classification

CVE-2013-5739 CWE-707

Tags

Missing Update Known Vulnerabilities