Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2 when Multisite is enabled allows remote authenticated administrators to inject arbitrary web script or HTML and obtain Super Admin privileges via a crafted avatar URL.