WordPress core

CVE-2019-16780

Stored cross-site scripting (XSS) in WordPress block editor

Severity: Medium 5.4
Published: 20 Dec 2019
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.3.1
Also known as: GHSA-x3wp-h3qx-9w94
Sources: NVD, WordPress

Description

WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to…

Affected software

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	After 3.7 before 5.3.1 Version 3.7 Version 5.0.7 Version 5.1.3 Version 5.2.4 Version 5.3.0

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2019-16780
CVE.org https://www.cve.org/CVERecord?id=CVE-2019-16780
GitHub Advisory Database https://github.com/advisories/GHSA-x3wp-h3qx-9w94
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94