WordPress 5.2.3 Security and Maintenance Release

WordPress 5.2.3 is now available! This security and maintenance release features 29 fixes and enhancements. Plus, it adds a number of security fixes—see the list below.

These bugs affect WordPress versions 5.2.2 and earlier; version 5.2.3 fixes them, so you’ll want to upgrade.

If you haven’t yet updated to 5.2, there are also updated versions of 5.0 and earlier that fix the bugs for you.

Security Updates

• A cross-site scripting (XSS) vulnerability in post previews by contributors.
• A cross-site scripting vulnerability in stored comments.
• An issue where validation and sanitization of a URL could lead to an open redirect.
• Reflected cross-site scripting during media uploads.
• A vulnerability for cross-site scripting (XSS) in shortcode previews.
• A cross-site scripting in the dashboard.
• An issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.
• In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.

You can browse the full list of changes on Trac.

For more info, browse the full list of changes on Trac or check out the Version 5.2.3 documentation page.

WordPress 5.2.3 is a short-cycle maintenance release. The next major release will be version 5.3.

You can download WordPress 5.2.3 from the button at the top of this page, or visit your Dashboard → Updates and click Update Now.

If you have sites that support automatic background updates, they’ve already started the update process.