CVE-2019-16781

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WordPress	WordPress	>= < 5.3.1, < 5.3.1

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9vThird Party Advisory
https://hackerone.com/reports/731301Permissions Required, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9976Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9vThird Party Advisory
https://hackerone.com/reports/731301Permissions Required, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9976Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory

Timeline

Published: Dec 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167825.9There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 CVE-2019-167847.8In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a soft CVE-2019-167857.5Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and he CVE-2019-167867.5Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunk CVE-2019-167898.2In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypass CVE-2019-16795.0A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Se CVE-2019-167908.8In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are CVE-2019-167915.9In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of CVE-2019-167927.5Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Cont CVE-2019-16804.3A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser CVE-2019-16817.5A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated, remote attacker CVE-2019-16827.8A vulnerability in the FUSE filesystem functionality for Cisco Application Policy Infrastructure Controller (APIC) software could allow an a