Description WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. Remediation References CVE-2019-17674 Related Vulnerabilities WordPress Plugin Shield Security-Smart Bot Blocking & Intrusion Prevention Security Cross-Site Scripting (18.5.7) WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-28040) Liferay DXP Incorrect Default Permissions Vulnerability (CVE-2021-33334) WordPress Plugin Appointment Booking Calendar Cross-Site Scripting (1.3.18) WordPress Plugin CM Pop-Up banners for WordPress SQL Injection (1.5.10) Severity Medium Classification CVE-2019-17674 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Tags Missing Update Known Vulnerabilities