Fluid Attacks Database

Description

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	wordpress	>=0 <5.3.2+dfsg1-1	5.3.2+dfsg1-1
debian 11	wordpress	>=0 <5.3.2+dfsg1-1	5.3.2+dfsg1-1
debian 12	wordpress	>=0 <5.3.2+dfsg1-1	5.3.2+dfsg1-1
debian 14	wordpress	>=0 <5.3.2+dfsg1-1	5.3.2+dfsg1-1

Aliases

1. CVE-2019-200422. NVD-2019-200423. OSV-DEBIAN-2019-200424. OSV-2019-200425. SECURITY-TRACKER-CVE-2019-20042

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.