UpHeron
All vulnerabilities

WordPress core

CVE-2019-20042

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Severity
Medium 6.1
Published
27 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.3.1
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • From 3.7 before 5.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-20042
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-20042