CVE-2019-20042

MEDIUM 6.1CVE-2019-20042 · Published 27/12/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
wordpress wordpress	`≥ 3.7, < 5.3.1`	`5.3.1`

Description

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

References

blog.ripstech.com/filter/vulnerabilities · Not Applicable
core.trac.wordpress.org/changeset/46894/trunk · Patch
WordPress/wordpress-develop commit 1f7f3f1 · Patch
WordPress/wordpress-develop security advisory · Third Party Advisory
hackerone.com/reports/509930 · Third Party Advisory
seclists.org/bugtraq/2020/Jan/8 · Mailing List
wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release · Release Notes
wpvulndb.com/vulnerabilities/9975 · Release Notes
debian.org/security/2020/dsa-4599 · Third Party Advisory
debian.org/security/2020/dsa-4677 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free