New WordPress update (4.9.2) released yesterday covering the fix for XSS vulnerability and 21 other bugs. The Vulnerability resides with the Flash fallback files in MediaElement plugin. It impacts all the WordPress version since WordPress 3.7.
Read this post on gbhackers.com