CVE-2013-5739 in WordPress
Summary
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Reservation
09/11/2013
Disclosure
09/12/2013
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 10260 | WordPress functions.php get_allowed_mime_types cross site scripting | 79 | Not defined | Official fix | CVE-2013-5739 |