CVE-2013-5739
EPSS 0.25%Published: 9/12/2013Modified: 5/27/2026
Description
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
Affected packages (1)
- Debian/wordpressfrom 0, < 3.6.1+dfsg-1