WordPress before 5.2.3 allows reflected XSS in the dashboard.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16221.json"