CVE-2019-20042

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

• CWE-79

• https://blog.ripstech.com/filter/vulnerabilities/Not Applicable
• https://core.trac.wordpress.org/changeset/46894/trunkPatch
• https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1dPatch
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2f4-83m7Third Party Advisory
• https://hackerone.com/reports/509930Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
• https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/9975Release Notes, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4599Third Party Advisory
• https://www.debian.org/security/2020/dsa-4677Third Party Advisory
• https://blog.ripstech.com/filter/vulnerabilities/Not Applicable
• https://core.trac.wordpress.org/changeset/46894/trunkPatch
• https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1dPatch
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2f4-83m7Third Party Advisory
• https://hackerone.com/reports/509930Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
• https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/9975Release Notes, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4599Third Party Advisory
• https://www.debian.org/security/2020/dsa-4677Third Party Advisory

Published

Dec 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20030An attacker with knowledge of the modem access number on a N…7.8
• CVE-2019-20031NEC UM8000, UM4730 and prior non-InMail voicemail systems wi…9.1
• CVE-2019-20032An attacker with access to an InMail voicemail box equipped …6.5
• CVE-2019-20033On Aspire-derived NEC PBXes, including all versions of SV810…9.8
• CVE-2019-2004In publishKeyEvent, publishMotionEvent and sendUnchainedFini…
• CVE-2019-20041wp_kses_bad_protocol in wp-includes/kses.php in WordPress be…9.8
• CVE-2019-20043In in wp-includes/rest-api/endpoints/class-wp-rest-posts-con…4.3
• CVE-2019-20044In Zsh before 5.8, attackers able to execute commands can re…7.8
• CVE-2019-20045The Synergy Systems & Solutions PLC & RTU system has a vulne…7.5
• CVE-2019-20046The Synergy Systems & Solutions PLC & RTU system has a vulne…9.8
• CVE-2019-20047An issue was discovered on Alcatel-Lucent OmniVista 4760 dev…7.5
• CVE-2019-20048An issue was discovered on Alcatel-Lucent OmniVista 8770 dev…7.2