That was totally it — thank you so much! So just to clarify, it wasn’t WordPress 5.0 that broke this, it was that I had a very strict Content Security Policy (CSP) in place (via some code in my functions.php file).
Thanks again for your quick response + helpful reply!