CVE-2019-20042

score

<0.1

cvss

6.1

epss

2.8%

published

2019-12-27

kev added

—

first seen

2026-10-21

WordPress versions 3.7 to 5.3.0 contain a stored cross-site scripting caused by improper sanitization in wp_targeted_link_rel() in wp-includes/formatting.php, letting attackers execute malicious scripts when the function is exploited, exploit requires attacker to inject malicious content.