Dave Cummo

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 3.6.1 **Description** The issue allows remote attackers to bypass intended redirection restrictions by using a crafted string, due to improper validation of URLs before use in an HTTP redirect. **Recommendations** For versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 3.6.1 **Description** The issue allows remote authenticated users to potentially conduct cross-site scripting (XSS) attacks via a crafted file. This is due to the `get allowed mime types` function not requiring the `unfiltered html` capability for uploads of `.htm` and `.html` files. **Recommendations** For versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue.