WordPress 4.9.2 Patches XSS Vulnerability
![rw-book-cover]()
π **Source:** [WordPress 4.9.2 Patches XSS Vulnerability](https://wptavern.com/wordpress-4-9-2-patches-xss-vulnerability)
> [!note]+ Document Notes
> ---
> tags: [wordpress, security, xss, mediaelement, wp-tavern-archive, wp-tavern-2018]
> author: Jeff Chandler
> source: WP Tavern
> reference: https://wptavern.com/wordpress-4-9-2-patches-xss-vulnerability
> date created: 2026-04-17 11:29
> ---
> # WordPress 4.9.2 Patches XSS Vulnerability
> ## π Summary
> - WordPress 4.9.2 was released to patch a cross-site scripting vulnerability in Flash fallback files within the MediaElement library.
> - Flash fallback files have been removed from WordPress core; users needing them can install the MediaElement Flash Fallback plugin.
> - Enguerran Gillier and Widiz responsibly disclosed the vulnerability.
> - The release also fixes 21 additional bugs, including JavaScript errors preventing post saves in Firefox and widget assignment restoration when switching themes.
> ## π¬ Comments (0)
> No comments.
WordPress 4.9.2 has been released and patches a cross-site scripting vulnerability in the Flash fallback files in the MediaElement library. [According to Ian Dunn](https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/), the Flash files are rarely needed and have been removed from WordPress.
If you need access to the Flash fallback files, they can be obtained using the [MediaElement Flash Fallback](https://wordpress.org/plugins/mediaelement-flash-fallbacks/) plugin. [Enguerran Gillier](https://opnsec.com)Β andΒ [Widiz](https://widiz.com/) are credited with responsibly disclosing the vulnerability.Β ο»Ώ
In addition to the patch, this releases fixes 21 bugs. JavaScript errors that prevented saving posts in Firefox has been fixed and switching themes will attempt to restore previous widget assignments, even if no sidebars exist.
You can view detailed information about the changes in 4.9.2 by [reading the following Codex article](https://codex.wordpress.org/Version_4.9.2).
Category: [WordPress](https://wptavern.com/category/wordpressorg)Tags: [4.9.2](https://wptavern.com/tag/4-9-2), [mediaelement](https://wptavern.com/tag/mediaelement), [security](https://wptavern.com/tag/security), [xss](https://wptavern.com/tag/xss), WordPress 4.9.2 Patches XSS Vulnerability, Jeff Chandler, 01kpe0yxdt0dbtr1cj54mw43kg.