WordPress before 5.2.3 allows reflected XSS in the dashboard.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16221.json"