Title: Version 5.2.4
Author: Jb Audras
Published: October 14, 2019

---

# Version 5.2.4

## In this article

 * [Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-5-2-4/?output_format=md#installation-update-information)
 * [Summary](https://wordpress.org/documentation/wordpress-version/version-5-2-4/?output_format=md#summary)
 * [List of Files Revised](https://wordpress.org/documentation/wordpress-version/version-5-2-4/?output_format=md#list-of-files-revised)

[ Back to top](https://wordpress.org/documentation/wordpress-version/version-5-2-4/?output_format=md#wp--skip-link--target)

On Oct. 14, 2019, WordPress 5.2.4 was released to the public.

## 󠀁[Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-5-2-4/?output_format=md#installation-update-information)󠁿

To download WordPress 5.2.4, update automatically from the Dashboard > Updates menu
in your site’s admin area or visit [https://wordpress.org/download/release-archive/](https://wordpress.org/download/release-archive/).

For step-by-step instructions on installing and updating WordPress:

 *  [Updating WordPress](https://wordpress.org/documentation/article/updating-wordpress/)

If you are new to WordPress, we recommend that you begin with the following:

 *  [New To WordPress – Where to Start](https://wordpress.org/support/article/new_to_wordpress_-_where_to_start/?output_format=md)
 *  [First Steps With WordPress](https://wordpress.org/support/article/first-steps-with-wordpress/?output_format=md)
   or [Upgrading WordPress Extended](https://wordpress.org/documentation/article/upgrading-wordpress-extended-instructions/)
 *  [WordPress Lessons](https://wordpress.org/support/article/wordpress-lessons/?output_format=md)

## 󠀁[Summary](https://wordpress.org/documentation/wordpress-version/version-5-2-4/?output_format=md#summary)󠁿

From the [WordPress 5.2.4 release post](https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/),
WordPress versions 5.2 and earlier are affected by the following bugs, which are
fixed in version 5.2.4. Updated versions of WordPress 5.1 and older releases since
WordPress 3.7 are also available, for users who have not yet updated to 5.2.

 * Props to [Evan Ricafort](https://evanricafort.com/) for finding an issue where
   stored XSS (cross-site scripting) could be added via the Customizer.
 * Props to [J.D. Grimes](https://codesymphony.co/) who found and disclosed a method
   of viewing unauthenticated posts.
 * Props to [Weston Ruter](https://weston.ruter.net/) for finding a way to create
   a stored XSS to inject Javascript into style tags.
 * Props to David Newman for highlighting a method to poison the cache of JSON GET
   requests via the Vary: Origin header.
 * Props to [Eugene Kolodenker](http://eugenekolo.com/) who found a server-side 
   request forgery in the way that URLs are validated.
 * Props to Ben Bidner of the WordPress Security Team who discovered issues related
   to referrer validation in the admin.

## 󠀁[List of Files Revised](https://wordpress.org/documentation/wordpress-version/version-5-2-4/?output_format=md#list-of-files-revised)󠁿

    ```wp-block-preformatted
    /wp-includes/class-wp.php
     /wp-includes/class-wp-query.php
     /wp-includes/functions.php
     /wp-includes/http.php
     /wp-includes/pluggable.php
     /wp-includes/rest-api.php 
    ```

First published

October 14, 2019

Last updated