UPDATED Many versions of SWFUpload ? an applet that combines Flash and JavaScript that?s used in millions of websites, including WordPress sites? are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week.