CVE-2013-2205
The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Polic…
Published: 2013-07-08 · CVSS: Unscored
The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7