CVE-2013-5738
wordpress wordpress: no CVSS score yet. EPSS 2.4% chance of exploitation in the next 30 days.
The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wordpress:wordpress