WordPress 5.2.3 has now been released. This is a security and maintenance release features 29 fixes and enhancements and adds several security fixes.

These bugs affect WordPress versions 5.2.2 and earlier; version 5.2.3 fixes them, so we recommend all WordPress-users to upgrade.

If you haven’t yet updated to 5.2 yet, there are also updated versions of 5.0 and earlier that fix the bugs for you.

Security Updates

  • Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments.
  • Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.
  • Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.
  • Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting (XSS) in shortcode previews.
  • Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard.
  • Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.
  • In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.

Leave a Reply

Your email address will not be published. Required fields are marked *