Topics
On December 12, 2019, WordPress 5.3.1 was released to the public.
Installation/Update Information Installation/Update Information
To download WordPress 5.3.1, update automatically from the Dashboard > Updates menu in your site’s admin area or visit https://wordpress.org/download/release-archive/.
For step-by-step instructions on installing and updating WordPress:
If you are new to WordPress, we recommend that you begin with the following:
- New To WordPress – Where to Start
- First Steps With WordPress or Upgrading WordPress Extended
- WordPress Lessons
Summary Summary
Security updates Security updates
From the WordPress 5.3.1 release post, WordPress versions 5.3 and earlier are affected by the following bugs, which are fixed in version 5.3.1. Updated versions of WordPress 5.2 and older releases since WordPress 3.7 are also available, for users who have not yet updated to 5.3.
- Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
- Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links.
- Props to the WordPress.org Security Team for hardening
wp_kses_bad_protocol()to ensure that it is aware of the named colon attribute. - Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.
Maintenance updates Maintenance updates
Here are a few of the highlights:
- Administration: improvements to admin form controls height and alignment standardization (see related dev note), dashboard widget links accessibility and alternate color scheme readability issues (see related dev note).
- Block editor: fix Edge scrolling issues and intermittent JavaScript issues.
- Bundled themes: add customizer option to show/hide author bio, replace JS based smooth scroll with CSS (see related dev note) and fix Instagram embed CSS.
- Date/time: improve non-GMT dates calculation, fix date format output in specific languages and make
get_permalink()more resilient against PHP timezone changes. - Embeds: remove CollegeHumor oEmbed provider as the service doesn’t exist anymore.
- External libraries: update
sodium_compat. - Site health: allow the remind interval for the admin email verification to be filtered.
- Uploads: avoid thumbnails overwriting other uploads when filename matches, and exclude PNG images from scaling after upload.
- Users: ensure administration email verification uses the user’s locale instead of the site locale.
For more information, browse the full list of changes on Trac or check out the version 5.3.1 HelpHub documentation page.
Developer notes Developer notes
List of Files Revised List of Files Revised
src/js/_enqueues/lib/admin-bar.js src/js/_enqueues/wp/widgets/media.js src/js/media/views/settings.js src/wp-admin/css/about.css src/wp-admin/css/color-picker.css src/wp-admin/css/colors/_admin.scss src/wp-admin/css/colors/_mixins.scss src/wp-admin/css/colors/_variables.scss src/wp-admin/css/common.css src/wp-admin/css/customize-controls.css src/wp-admin/css/dashboard.css src/wp-admin/css/edit.css src/wp-admin/css/forms.css src/wp-admin/css/install.css src/wp-admin/css/list-tables.css src/wp-admin/css/media.css src/wp-admin/css/themes.css src/wp-admin/includes/class-walker-nav-menu-checklist.php src/wp-admin/includes/class-wp-list-table.php src/wp-admin/includes/class-wp-site-health.php src/wp-admin/includes/credits.php src/wp-admin/includes/dashboard.php src/wp-admin/includes/image.php src/wp-admin/includes/nav-menu.php src/wp-admin/includes/plugin.php src/wp-admin/user-edit.php src/wp-content/themes/twentytwenty/assets/js/color-calculations.js src/wp-content/themes/twentytwenty/assets/js/index.js src/wp-content/themes/twentytwenty/classes/class-twentytwenty-customize.php src/wp-content/themes/twentytwenty/classes/class-twentytwenty-non-latin-languages.php src/wp-content/themes/twentytwenty/footer.php src/wp-content/themes/twentytwenty/inc/template-tags.php src/wp-content/themes/twentytwenty/style-rtl.css src/wp-content/themes/twentytwenty/style.css src/wp-content/themes/twentytwenty/template-parts/entry-author-bio.php src/wp-includes/class-wp-oembed.php src/wp-includes/class-wp-xmlrpc-server.php src/wp-includes/comment-template.php src/wp-includes/css/buttons.css src/wp-includes/css/editor.css src/wp-includes/css/media-views.css src/wp-includes/feed.php src/wp-includes/functions.php src/wp-includes/kses.php src/wp-includes/link-template.php src/wp-includes/media-template.php src/wp-includes/media.php src/wp-includes/option.php src/wp-includes/script-loader.php src/wp-includes/sodium_compat/LICENSE src/wp-includes/sodium_compat/autoload.php src/wp-includes/sodium_compat/composer.json src/wp-includes/sodium_compat/lib/constants.php src/wp-includes/sodium_compat/lib/namespaced.php src/wp-includes/sodium_compat/lib/php72compat.php src/wp-includes/sodium_compat/lib/php72compat_const.php src/wp-includes/sodium_compat/lib/sodium_compat.php src/wp-includes/sodium_compat/src/Compat.php src/wp-includes/sodium_compat/src/Core/BLAKE2b.php src/wp-includes/sodium_compat/src/Core/Base64/Common.php src/wp-includes/sodium_compat/src/Core/Base64/Original.php src/wp-includes/sodium_compat/src/Core/Base64/UrlSafe.php src/wp-includes/sodium_compat/src/Core/Ed25519.php src/wp-includes/sodium_compat/src/Core/Poly1305/State.php src/wp-includes/sodium_compat/src/Core/SecretStream/State.php src/wp-includes/sodium_compat/src/Core/XChaCha20.php src/wp-includes/sodium_compat/src/Core32/BLAKE2b.php src/wp-includes/sodium_compat/src/Core32/Ed25519.php src/wp-includes/sodium_compat/src/Core32/Poly1305/State.php src/wp-includes/sodium_compat/src/Core32/SecretStream/State.php src/wp-includes/sodium_compat/src/Core32/X25519.php src/wp-includes/sodium_compat/src/Crypto.php src/wp-includes/sodium_compat/src/Crypto32.php src/wp-includes/sodium_compat/src/File.php src/wp-includes/sodium_compat/src/PHP52/SplFixedArray.php src/wp-includes/version.php src/wp-login.php
Updated packages Updated packages
@wordpress/block-editor@3.2.5 @wordpress/block-library@2.9.6 @wordpress/core-data@2.7.5 @wordpress/edit-post@3.8.6 @wordpress/editor@9.7.6 @wordpress/format-library@1.9.5 jquery-hoverintent@1.8.3 hoverintent@2.2.1