Security readout for executives and security teams
Plain-English summary
CVE-2019-20042 is a stored cross-site scripting issue in WordPress core. Affected sites run WordPress 3.7 through 5.3.0. WordPress fixed it in 5.3.1 and matching minor security releases for older branches. The business risk is unauthorized script execution in a user’s browser if an attacker can place malicious content that triggers the vulnerable formatting behavior.
Executive priority
Treat this as a required security maintenance item, not an emergency based on current evidence. Patch exposed WordPress sites promptly, especially externally facing sites or sites with multiple content authors, because stored XSS can affect visitors, editors, and administrators depending on where malicious content is stored.
Technical view
The flaw is in wp-includes/formatting.php, specifically wp_targeted_link_rel(). Used in a particular way, it can produce stored XSS. The source bundle does not provide CVSS, CWE, prerequisites, or exploit detail. Patch references include WordPress changeset 46894 and wordpress-develop commit 1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1d.
Likely exposure
Exposure is most likely on internet-facing WordPress sites running core versions 3.7 through 5.3.0 that missed the relevant security release. Sites updated to WordPress 5.3.1 or the patched older minor releases should not be considered exposed based on the provided sources.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation. Public references include a HackerOne report, WPVulnDB entry, WordPress release notes, and Debian advisories, so defenders should assume vulnerability details have been publicly known since disclosure.
Researcher notes
The provided data is incomplete for precise exploitability scoring: no CVSS, CWE, role requirement, or proof of active exploitation is supplied. Analysis should stay anchored to WordPress core version exposure, the wp_targeted_link_rel() patch, and vendor/distribution advisory status.
Mitigation direction
- Update WordPress core to 5.3.1 or the patched minor release for your branch.
- For Debian-packaged WordPress, apply the referenced Debian security updates.
- Confirm managed hosting providers have applied the WordPress core security release.
- If immediate patching is blocked, follow current WordPress or distribution vendor guidance.
- Prioritize patching public WordPress sites and sites with untrusted content contributors.
Validation and detection
- Inventory all WordPress installations and record exact core versions.
- Flag WordPress 3.7 through 5.3.0 unless a patched minor release is confirmed.
- Verify wp-includes/formatting.php includes the vendor patch from the referenced changeset or commit.
- Check package manager records against Debian DSA-4599 or DSA-4677 where applicable.
- Review scanner findings for CVE-2019-20042 or WPVulnDB vulnerability 9975.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-20042 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpvulndb.com/vulnerabilities/9975CVE reference · x_refsource_MISC
- https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/CVE reference · x_refsource_MISC
- https://core.trac.wordpress.org/changeset/46894/trunkCVE reference · x_refsource_MISC
- https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1dCVE reference · x_refsource_MISC
- https://blog.ripstech.com/filter/vulnerabilities/CVE reference · x_refsource_MISC
- 20200108 [SECURITY] [DSA 4599-1] wordpress security updateCVE reference · mailing-list, x_refsource_BUGTRAQ
- DSA-4599CVE reference · vendor-advisory, x_refsource_DEBIAN
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2f4-83m7CVE reference · x_refsource_CONFIRM
- https://hackerone.com/reports/509930CVE reference · x_refsource_MISC
- DSA-4677CVE reference · vendor-advisory, x_refsource_DEBIAN
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.