Medium severity5.8NVD Advisory· Published Dec 26, 2019· Updated Jun 17, 2026

CVE-2019-16781

Description

In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/WordPressllm-fuzzy3 versions
<5.3.1+ 2 more
- (no CPE)range: <5.3.1
- (no CPE)range: < 5.3.1
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <5.3.1
Package: https://wordpress.org/plugins/wordpress
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9vnvdThird Party Advisory
hackerone.com/reports/731301nvdPermissions RequiredThird Party Advisory
seclists.org/bugtraq/2020/Jan/8nvdMailing ListThird Party Advisory
wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/nvdRelease NotesThird Party Advisory
wpvulndb.com/vulnerabilities/9976nvdThird Party Advisory
www.debian.org/security/2020/dsa-4599nvdThird Party Advisory
www.debian.org/security/2020/dsa-4677nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.377
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000