CVE-2019-20041: Debian Linux

Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days.

wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon; substring.

Affected products

Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
WordPress WordPress: before 5.3.1 (fixed in 5.3.1)

Published 2019-12-27. Last modified 2026-06-17.