WordPress 5.3.1 Security and Maintenance Release

Date: December 13, 2019

Written by: Jb Audras

WordPress 5.3.1 is now available!

This security and maintenance release features 46 fixes and enhancements. Plus, it adds a number of security fixes—see the list below.

WordPress 5.3.1 is a short-cycle maintenance release. The next major release will be version 5.4.

You can download WordPress 5.3.1 by clicking the button at the top of this page, or visit your Dashboard → Updates and click Update Now.

If you have sites that support automatic background updates, they’ve already started the update process.

Security updates:

Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.

  • Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
  • Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links.
  • Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.
  • Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.

Maintenance updates:

Here are a few of the highlights:

  • Administration: improvements to admin form controls height and alignment standardization (see related dev note), dashboard widget links accessibility and alternate color scheme readability issues (see related dev note).
  • Block editor: fix Edge scrolling issues and intermittent JavaScript issues.
  • Bundled themes: add customizer option to show/hide author bio, replace JS based smooth scroll with CSS (see related dev note) and fix Instagram embed CSS.
  • Date/time: improve non-GMT dates calculation, fix date format output in specific languages and make get_permalink() more resilient against PHP timezone changes.
  • Embeds: remove CollegeHumor oEmbed provider as the service doesn’t exist anymore.
  • External libraries: update sodium_compat.
  • Site health: allow the remind interval for the admin email verification to be filtered.
  • Uploads: avoid thumbnails overwriting other uploads when filename matches, and exclude PNG images from scaling after upload.
  • Users: ensure administration email verification uses the user’s locale instead of the site locale.

For more information, browse the full list of changes on Trac or check out the version 5.3.1 HelpHub documentation page.


In addition to the security researchers mentioned above, thank you to everyone who contributed to WordPress 5.3.1:

123hostacosminAdam SilversteinAlbert Juhé LluverasAlex ConchaAlex MillsAnantajit JGAnders NorénandraganescuAndrea FerciaAndrew DuthieAndrew OzzAndrey “Rarst” Savchenkoaravindajitharchon810Ate Up With MotorAyesh KarunaratneBirgir Erlendsson (birgire)Boga86Boone GorgesCarolina NymarkChetan PrajapatiCsaba (LittleBigThings)DademaruDaniel BachhuberDaniele ScasciafratteDaniel RichardsDavid BaumwaldDavid HerreraDion hulseehtisElla van DurpeepiquerasFabianFelix ArntzflaviozavanGarrett HyderGlennGrzegorz (Greg) ZiółkowskiGrzegorz.JanoszkaHareesh PillaiIan BelangerispreviewJake SpurlockJames HuffJames KosterJarretJasper van der MeerJb AudrasjeichornJer ClarkeJeremy FeltJip MoorsJoe HoyleJohn James JacobyJonathan DesrosiersJonny HarrisJoost de ValkJorge CostaJoyJuliette Reinders FolmerjustdaivKelly DwanKharis SulistiyonoKitekyliesabralisotalukaswaudentioMaciej Mackowiakmarcelo2605Marius L. J.Mat LipemayanksonawatMel Choyce-DwanMichael Arestadmiette49Miguel FonsecamihdanMike AuteriMikko SaariMilan PetrovicMukesh PanchalNextScriptsNick DaughertyNiels LangenoyleOv3rflyParagon Initiative EnterprisesPaul BironPeter WilsonRachel PeterRiad BenguellaRicard TorresRoland MurgRyan McCueRyan WelcherSamuelFernandezsathyapulseScott TaylorscvleonSergey BiryukovsergiomdgomesSGr33nsimonjaninsmerrimansteevithakStephen BernhardtStephen EdgarSteve DufresneSubrata MalSultan Nasir UddinSybre WaaijerTammie ListerTanvirul HaqueTellyworthtimon33Timothy JacobsTimothée BrosilletmatsuurTung DuVeminomvortfuwaleedt93williampattonwpgurudev, and Zack Tollman.

Feel free to join The 4K Media Group:




Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s