CVE-2013-5738 in WordPress
Summary
The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.
Reservation
09/11/2013
Disclosure
09/12/2013
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 10264 | WordPress functions.php get_allowed_mime_types input validation | 20 | Proof-of-Concept | Official fix | CVE-2013-5738 |