CVE-2013-2205: WordPress

Medium severity, CVSS 4.3. EPSS: 3% chance of exploitation in the next 30 days.

The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.

Affected products

• WordPress WordPress: up to and including 3.5.1; version 0.71 only; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.1.1 only; …

Published 2013-07-08. Last modified 2026-06-16.