Unrated severityNVD Advisory· Published Sep 12, 2013· Updated Jun 16, 2026
CVE-2013-5738
CVE-2013-5738
Description
The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <=3.6
- (no CPE)range: < 3.6.1
Patches
Vulnerability mechanics
References
4- core.trac.wordpress.org/changeset/25322nvdPatchVendor Advisory
- wordpress.org/news/2013/09/wordpress-3-6-1/nvdPatchVendor Advisory
- codex.wordpress.org/Version_3.6.1nvdVendor Advisory
- www.debian.org/security/2013/dsa-2757nvd
News mentions
0No linked articles in our index yet.