See: WordPress 5.3.1 Security and Maintenance Release

Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.

• Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
• Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links.
• Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.
• Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.