CVE-2019-16780

WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.

• CWE-79
• CWE-79

• https://github.com/WordPress/wordpress-develop/commit/505dd6a20b6fc3d06130018c1caeff764248c29ePatch, Third Party Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94Third Party Advisory
• https://hackerone.com/reports/738644Permissions Required, Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
• https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9976Third Party Advisory
• https://www.debian.org/security/2020/dsa-4599Third Party Advisory
• https://www.debian.org/security/2020/dsa-4677Third Party Advisory
• https://github.com/WordPress/wordpress-develop/commit/505dd6a20b6fc3d06130018c1caeff764248c29ePatch, Third Party Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94Third Party Advisory
• https://hackerone.com/reports/738644Permissions Required, Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
• https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9976Third Party Advisory
• https://www.debian.org/security/2020/dsa-4599Third Party Advisory
• https://www.debian.org/security/2020/dsa-4677Third Party Advisory

Published

Dec 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16775Versions of the npm CLI prior to 6.13.3 are vulnerable to an…6.5
• CVE-2019-16776Versions of the npm CLI prior to 6.13.3 are vulnerable to an…8.1
• CVE-2019-16777Versions of the npm CLI prior to 6.13.4 are vulnerable to an…6.5
• CVE-2019-16778In TensorFlow before 1.15, a heap buffer overflow in Unsorte…9.8
• CVE-2019-16779In RubyGem excon before 0.71.0, there was a race condition a…5.9
• CVE-2019-1678A vulnerability in Cisco Meeting Server could allow an authe…4.3
• CVE-2019-16781In WordPress before 5.3.1, authenticated users with lower pr…5.4
• CVE-2019-16782There's a possible information leak / session hijack vulnera…5.9
• CVE-2019-16784In PyInstaller before version 3.6, only on Windows, a local …7.8
• CVE-2019-16785Waitress through version 1.3.1 implemented a "MAY" part of t…7.5
• CVE-2019-16786Waitress through version 1.3.1 would parse the Transfer-Enco…7.5
• CVE-2019-16787Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…