Description
wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.
Remediation
References
Related Vulnerabilities
WordPress Plugin Connections Business Directory Cross-Site Scripting (10.4.2)
WordPress Plugin U Extended Comment 'fileurl' Parameter Arbitrary File Download (1.0.1)
WordPress Plugin Comment Rating 'id' Parameter SQL Injection (2.9.23)
WordPress Plugin Gmedia Photo Gallery Multiple Cross-Site Scripting Vulnerabilities (1.18.4)