Version 4.8.12

On December 12, 2019, WordPress 4.8.12 was released to the public.

Installation/Update Information

To download WordPress 4.8.12, update automatically from the Dashboard > Updates menu in your site’s admin area or visit https://wordpress.org/download/release-archive/.

For step-by-step instructions on installing and updating WordPress:

If you are new to WordPress, we recommend that you begin with the following:

Summary

From the WordPress 5.3.1 release post, WordPress versions 5.3 and earlier are affected by the following bugs, which are fixed in version 5.3.1. Updated versions of WordPress 5.2 and older releases since WordPress 3.7 are also available, for users who have not yet updated to 5.3.

  • Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
  • Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links.
  • Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.

List of Files Revised

wp-includes/kses.php 
wp-includes/default-filters.php
wp-includes/formatting.php

First published

Last updated