Version 5.4.2

Topics

On June 10, 2020, WordPress 5.4.2 was released to the public.

Installation/Update Information Installation/Update Information

To download WordPress 5.4.2, update automatically from the Dashboard > Updates menu in your site’s admin area or visit WordPress releases archive.

For step-by-step instructions on installing and updating WordPress:

If you are new to WordPress, we recommend that you begin with the following:

Top ↑

Summary Summary

Security updates Security updates

Five security issues affect WordPress versions 5.4 and earlier; version 5.4.2 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.

  • Props to Sam Thomas (jazzy2fives) for finding an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor
  • Props to Luigi – (gubello.me) for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files.
  • Props to Ben Bidner of the WordPress Security Team for finding an open redirect issue in wp_validate_redirect()
  • Props to Nrimo Ing Pandum for finding an authenticated XSS issue via theme uploads
  • Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation
  • Props to Carolina Nymark for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.

Top ↑

Maintenance updates Maintenance updates

WordPress 5.4.2 features 22 bug and regression fixes on both core and default themes.

  • 49956 – Spammers able to share unmoderated comments (see related devnote below)
  • 49749 – Registering rest routes with a slash-prefixed namespace give inconsistent results
  • 49798 – Default WordPress favicon in dark mode browsers
  • 49808 – WordPress 5.4: Deprecated: tag_row_actions is deprecated since version 3.0.0
  • 50121 – About page: correcting the order of headings
  • 50131 – Absent custom favicon triggers wp-admin .htaccess/.htpasswd prompt on frontend in FIrefox
  • 49353 – button padding issue in edit plug on small device
  • 37926 – Twenty Eleven & Twenty Twelve: Dropdown category widget exceeds parent div when strings are long enough
  • 45865 – Twenty Nineteen: Consider decreasing the font size for widget titles
  • 48803 – Twenty Twenty: Custom post type that doesn’t support author, shows author
  • 48916 – Twenty Twenty: anchor links don’t work in mobile menu
  • 49088 – Twenty Twenty: Add icon for g.page links (Google business profile)
  • 49316 – Twenty Twenty missed license for images.
  • 49320 – Twenty Twenty: aligncenter>figcaption missing text-align: center; feature
  • 49322 – Twenty Twenty: Submenu items disappear underneath the Cover block
  • 49435 – Twenty Twenty: inconsistent top and bottom margins for .alignwide and .alignfull on Chrome vs Safari (cross browser issue)
  • 49699 – Twenty Nineteen: Center- and right-aligned heading accents appear broken
  • 49793 – Twenty Twenty: Images in list blocks are not positioned correctly
  • 49893 – TwentyTwenty: TikTok and ResearchGate Social Icons
  • 49932 – Small Typo in Twenty-Twenty

Thank you to everyone who contributed to WordPress 5.4.2:

Andrea Fercia, argentite, M Asif Rahman, Jb Audras, Ayesh Karunaratne, bdcstr, Delowar Hossain, Rob Migchels, donmhico, Emilie LEBRUN, finomeno, garethgillman, Giorgio25b, Gabriel Maldonado, Hector F, Ian Belanger, Mathieu Viet, Javier Casares, Joe McGill, jonkolbert, Jono Alderson, Joy, Tammie Lister, Kjell Reigstad, KT, markusthiel, Mayank Majeji, Mel Choyce-Dwan, mislavjuric, Mukesh Panchal, Nikhil Bhansi, oakesjosh, Dominik Schilling, Arslan Ahmed, Peter Wilson, Carolina Nymark, Stephen Bernhardt, Sam Fullalove, Alain Schlesser, Sergey Biryukov, skarabeq, Toni Viemerö, suzylah, Timothy Jacobs, TeBenachi, Jake Spurlock and yuhin.

For more information, browse the full list of changes on Trac.

Top ↑

Notes for developers Notes for developers

WordPress 5.4.2: Prevent unmoderated comments from search engine indexation

Top ↑

List of Files Revised List of Files Revised

wp-admin/about.php
wp-admin/themes.php
wp-admin/css/common.css
wp-admin/images/w-logo-blue.png
wp-admin/includes/class-wp-site-health.php
wp-admin/includes/class-wp-terms-list-table.php
wp-admin/includes/media.php
wp-admin/includes/misc.php
wp-admin/includes/theme.php
wp-content/themes/twentyeleven/style.css
wp-content/themes/twentynineteen/sass/mixins/_mixins-master.scss
wp-content/themes/twentynineteen/sass/site/secondary/_widgets.scss
wp-content/themes/twentynineteen/style-editor.css
wp-content/themes/twentynineteen/style-rtl.css
wp-content/themes/twentynineteen/style.css
wp-content/themes/twentytwelve/style.css
wp-content/themes/twentytwenty/assets/js/index.js
wp-content/themes/twentytwenty/classes/class-twentytwenty-svg-icons.php
wp-content/themes/twentytwenty/inc/template-tags.php
wp-content/themes/twentytwenty/readme.txt
wp-content/themes/twentytwenty/style-rtl.css
wp-content/themes/twentytwenty/style.css
wp-content/themes/twentytwenty/template-parts/content-cover.php
wp-content/themes/twentytwenty/template-parts/content.php
wp-includes/class-walker-comment.php
wp-includes/class-wp-comment-query.php
wp-includes/class-wp.php
wp-includes/comment-template.php
wp-includes/comment.php
wp-includes/default-filters.php
wp-includes/embed.php
wp-includes/functions.php
wp-includes/images/w-logo-blue-white-bg.png
wp-includes/pluggable.php
wp-includes/rest-api.php
wp-includes/version.php
package-lock.json
package.json
wp-comments-post.php

Top ↑

Updated packages Updated packages

@wordpress/block-library: 2.4.7
@wordpress/edit-post: 3.3.7