Update available for WordPress 5.4.2

On June 10, 2020, WordPress 5.4.2 was released to the public.

As noted on the official WordPress blog.

Security updates

Five security issues affect WordPress versions 5.4 and earlier; version 5.4.2 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.

  • Props to Sam Thomas (jazzy2fives) for finding an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor
  • Props to Luigi – (gubello.me) for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files.
  • Props to Ben Bidner of the WordPress Security Team for finding an open redirect issue in wp_validate_redirect()
  • Props to Nrimo Ing Pandum for finding an authenticated XSS issue via theme uploads
  • Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation
  • Props to Carolina Nymark for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.

Maintenance updates

WordPress 5.4.2 features 22 bug and regression fixes on both core and default themes.

  • 49956 – Spammers able to share unmoderated comments (see related devnote below)
  • 49749 – Registering rest routes with a slash-prefixed namespace give inconsistent results
  • 49798 – Default WordPress favicon in dark mode browsers
  • 49808 – WordPress 5.4: Deprecated: tag_row_actions is deprecated since version 3.0.0
  • 50121 – About page: correcting the order of headings
  • 50131 – Absent custom favicon triggers wp-admin .htaccess/.htpasswd prompt on frontend in FIrefox
  • 49353 – button padding issue in edit plug on small device
  • 37926 – Twenty Eleven & Twenty Twelve: Dropdown category widget exceeds parent div when strings are long enough
  • 45865 – Twenty Nineteen: Consider decreasing the font size for widget titles
  • 48803 – Twenty Twenty: Custom post type that doesn’t support author, shows author
  • 48916 – Twenty Twenty: anchor links don’t work in mobile menu
  • 49088 – Twenty Twenty: Add icon for g.page links (Google business profile)
  • 49316 – Twenty Twenty missed license for images.
  • 49320 – Twenty Twenty: aligncenter>figcaption missing text-align: center; feature
  • 49322 – Twenty Twenty: Submenu items disappear underneath the Cover block
  • 49435 – Twenty Twenty: inconsistent top and bottom margins for .alignwide and .alignfull on Chrome vs Safari (cross browser issue)
  • 49699 – Twenty Nineteen: Center- and right-aligned heading accents appear broken
  • 49793 – Twenty Twenty: Images in list blocks are not positioned correctly
  • 49893 – TwentyTwenty: TikTok and ResearchGate Social Icons
  • 49932 – Small Typo in Twenty-Twenty

All WordPress websites managed by Akuto who own the Maintenance & Security Package will be updated schematically, therefore, no action is required.

In the event you don’t know if your website is up to date or not, don’t hesitate to contact us.

Share on facebook
Share on twitter
Share on linkedin
Share on whatsapp

Categories

Tweets

Check our updates.

How to sell on Facebook? What is Facebook Shop? #ecommerce #facebook #socialnetwork #shoponline #sellonline... Read More

Jun 23 2020

🔥 Get 20% off! The promo will expire in just 8 days! 👉 Take advantage now,... Read More

Jun 22 2020

😱 In 2019 almost 2 billion users made online purchases. 🚀 Create your online store, start... Read More

Jun 11 2020