CVE-2019-16223

MEDIUM

WordPress < 5.2.3 - Authenticated Cross-Site Scripting in Post Preview

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-16223. PoCs published by gx1.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in WordPress <= 5.2.2 via post previews, leveraging improper URL sanitization in wp_kses_bad_protocol_once() and URL-encoded character conversion in get_the_content().

Description

WordPress before 5.2.3 allows XSS in post previews by authenticated users.

Exploits (1)

exploitdb WORKING POC
by gx1 · textwebappsphp
https://www.exploit-db.com/exploits/49338

This exploit demonstrates a stored XSS vulnerability in WordPress <= 5.2.2 via post previews, leveraging improper URL sanitization in wp_kses_bad_protocol_once() and URL-encoded character conversion in get_the_content().

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WordPress <= 5.2.2
Auth required
Prerequisites: Authenticated WordPress user with post creation privileges
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9862
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2020/Jan/8
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4599
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4677
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/160745/WordPress-Core-5.2.2-Cross-Site-Scripting.html

Scores

CVSS v3 5.4
EPSS 0.0518
EPSS Percentile 91.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (4)
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
wordpress/wordpress < 5.2.3
Published Sep 11, 2019
Tracked Since Feb 18, 2026