Description

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.

Remediation

References

CVE-2013-5739

Related Vulnerabilities

WebLogic Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-17359)

WordPress Plugin Clicky by Yoast Multiple Cross-Site Scripting Vulnerabilities (1.5)

WordPress Plugin VIDEO GALLERY 'upload1.php' Arbitrary File Upload (1.3)

WordPress Plugin miniOrange's Google Authenticator-WordPress Two Factor Authentication (2FA, MFA, OTP SMS and Email)-Passwordless login Cross-Site Scripting (5.4.39)

WordPress Plugin Advanced Custom Fields (ACF) Information Disclosure (6.0.2)

Severity

Low

Classification

CVE-2013-5739 CWE-707

Tags

Missing Update Known Vulnerabilities