CVE-2013-5738

The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.

• CWE-20

• http://codex.wordpress.org/Version_3.6.1Vendor Advisory
• http://core.trac.wordpress.org/changeset/25322Patch, Vendor Advisory
• http://wordpress.org/news/2013/09/wordpress-3-6-1/Patch, Vendor Advisory
• http://www.debian.org/security/2013/dsa-2757
• http://codex.wordpress.org/Version_3.6.1Vendor Advisory
• http://core.trac.wordpress.org/changeset/25322Patch, Vendor Advisory
• http://wordpress.org/news/2013/09/wordpress-3-6-1/Patch, Vendor Advisory
• http://www.debian.org/security/2013/dsa-2757

Published

Sep 12, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-5722Unspecified vulnerability in the LDAP dissector in Wireshark…
• CVE-2013-5723SQL injection vulnerability in SAP NetWeaver 7.30 allows rem…
• CVE-2013-5724Phpbb3 before 3.0.11-4 for Debian GNU/Linux uses world-writa…
• CVE-2013-5725The Metaclassy Byword app 2.x before 2.1 for iOS does not re…
• CVE-2013-5726Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does …
• CVE-2013-5730Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2013-5739The default configuration of WordPress before 3.6.1 does not…
• CVE-2013-5740Unspecified vulnerability in the Intel Trusted Execution Tec…
• CVE-2013-5741Triangle Research International (aka Tri) Nano-10 PLC device…
• CVE-2013-5743Multiple SQL injection vulnerabilities in Zabbix 1.8.x befor…9.8
• CVE-2013-5744Cross-site scripting (XSS) vulnerability in Feng Office 2.3.…
• CVE-2013-5745The vino_server_client_data_pending function in vino-server.…