Unrated severityNVD Advisory· Published Dec 27, 2019· Updated Aug 5, 2024
CVE-2019-20041
CVE-2019-20041
Description
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/WordPressdescription
Patches
Vulnerability mechanics
References
6- www.debian.org/security/2020/dsa-4599mitrevendor-advisoryx_refsource_DEBIAN
- www.debian.org/security/2020/dsa-4677mitrevendor-advisoryx_refsource_DEBIAN
- github.com/WordPress/wordpress-develop/commit/b1975463dd995da19bb40d3fa0786498717e3c53mitrex_refsource_MISC
- lists.debian.org/debian-lts-announce/2020/01/msg00010.htmlmitremailing-listx_refsource_MLIST
- seclists.org/bugtraq/2020/Jan/8mitremailing-listx_refsource_BUGTRAQ
- wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.