Description
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP SEO Redirect 301 Cross-Site Request Forgery (2.3.1)
Oracle Database Server CVE-2014-6483 Vulnerability (CVE-2014-6483)
PHP Improper Input Validation Vulnerability (CVE-2012-4388)
WordPress Plugin Calendar Event Multi View Unspecified Vulnerability (1.3.58)
WordPress Plugin wp audio gallery playlist 'playlist.php' SQL Injection (0.12)