On June 10, 2020, WordPress 5.4.2 was released to the public.
Installation/Update Information
To download WordPress 5.4.2, update automatically from the Dashboard > Updates menu in your site’s admin area or visit WordPress releases archive.
For step-by-step instructions on installing and updating WordPress:
If you are new to WordPress, we recommend that you begin with the following:
- New To WordPress – Where to Start
- First Steps With WordPress or Upgrading WordPress Extended
- WordPress Lessons
Summary
Security updates
Five security issues affect WordPress versions 5.4 and earlier; version 5.4.2 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.
- Props to Sam Thomas (jazzy2fives) for finding an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor
- Props to Luigi – (gubello.me) for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files.
- Props to Ben Bidner of the WordPress Security Team for finding an open redirect issue in?wp_validate_redirect()
- Props to?Nrimo Ing Pandum?for finding an authenticated XSS issue via theme uploads
- Props to?Simon Scannell of RIPS Technologies?for finding an issue where?set-screen-option?can be misused by plugins leading to privilege escalation
- Props to?Carolina Nymark?for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.
Maintenance updates
WordPress 5.4.2 features 22 bug and regression fixes on both core and default themes.
- 49956 – Spammers able to share unmoderated comments (see related devnote below)
- 49749 – Registering rest routes with a slash-prefixed namespace give inconsistent results
- 49798 – Default WordPress favicon in dark mode browsers
- 49808 – WordPress 5.4: Deprecated: tag_row_actions is deprecated since version 3.0.0
- 50121 – About page: correcting the order of headings
- 50131 – Absent custom favicon triggers wp-admin .htaccess/.htpasswd prompt on frontend in FIrefox
- 49353 – button padding issue in edit plug on small device
- 37926 – Twenty Eleven & Twenty Twelve: Dropdown category widget exceeds parent div when strings are long enough
- 45865 – Twenty Nineteen: Consider decreasing the font size for widget titles
- 48803 – Twenty Twenty: Custom post type that doesn’t support author, shows author
- 48916 – Twenty Twenty: anchor links don’t work in mobile menu
- 49088 – Twenty Twenty: Add icon for g.page links (Google business profile)
- 49316 – Twenty Twenty missed license for images.
- 49320 – Twenty Twenty: aligncenter>figcaption missing text-align: center; feature
- 49322 – Twenty Twenty: Submenu items disappear underneath the Cover block
- 49435 – Twenty Twenty: inconsistent top and bottom margins for .alignwide and .alignfull on Chrome vs Safari (cross browser issue)
- 49699 – Twenty Nineteen: Center- and right-aligned heading accents appear broken
- 49793 – Twenty Twenty: Images in list blocks are not positioned correctly
- 49893 – TwentyTwenty: TikTok and ResearchGate Social Icons
- 49932 – Small Typo in Twenty-Twenty
Thank you to everyone who contributed to WordPress 5.4.2:
Andrea Fercia, argentite, M Asif Rahman, Jb Audras, Ayesh Karunaratne, bdcstr, Delowar Hossain, Rob Migchels, donmhico, Emilie LEBRUN, finomeno, garethgillman, Giorgio25b, Gabriel Maldonado, Hector F, Ian Belanger, Mathieu Viet, Javier Casares, Joe McGill, jonkolbert, Jono Alderson, Joy, Tammie Lister, Kjell Reigstad, KT, markusthiel, Mayank Majeji, Mel Choyce-Dwan, mislavjuric, Mukesh Panchal, Nikhil Bhansi, oakesjosh, Dominik Schilling, Arslan Ahmed, Peter Wilson, Carolina Nymark, Stephen Bernhardt, Sam Fullalove, Alain Schlesser, Sergey Biryukov, skarabeq, Toni Viemer?, suzylah, Timothy Jacobs, TeBenachi, Jake Spurlock and yuhin.
For more information, browse the full list of changes on Trac.
Notes for developers
List of Files Revised
wp-admin/about.php wp-admin/themes.php wp-admin/css/common.css wp-admin/images/w-logo-blue.png wp-admin/includes/class-wp-site-health.php wp-admin/includes/class-wp-terms-list-table.php wp-admin/includes/media.php wp-admin/includes/misc.php wp-admin/includes/theme.php wp-content/themes/twentyeleven/style.css wp-content/themes/twentynineteen/sass/mixins/_mixins-master.scss wp-content/themes/twentynineteen/sass/site/secondary/_widgets.scss wp-content/themes/twentynineteen/style-editor.css wp-content/themes/twentynineteen/style-rtl.css wp-content/themes/twentynineteen/style.css wp-content/themes/twentytwelve/style.css wp-content/themes/twentytwenty/assets/js/index.js wp-content/themes/twentytwenty/classes/class-twentytwenty-svg-icons.php wp-content/themes/twentytwenty/inc/template-tags.php wp-content/themes/twentytwenty/readme.txt wp-content/themes/twentytwenty/style-rtl.css wp-content/themes/twentytwenty/style.css wp-content/themes/twentytwenty/template-parts/content-cover.php wp-content/themes/twentytwenty/template-parts/content.php wp-includes/class-walker-comment.php wp-includes/class-wp-comment-query.php wp-includes/class-wp.php wp-includes/comment-template.php wp-includes/comment.php wp-includes/default-filters.php wp-includes/embed.php wp-includes/functions.php wp-includes/images/w-logo-blue-white-bg.png wp-includes/pluggable.php wp-includes/rest-api.php wp-includes/version.php package-lock.json package.json wp-comments-post.php
Updated packages
@wordpress/block-library: 2.4.7 @wordpress/edit-post: 3.3.7