CVE-2019-20041: wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 ...

Severity: Critical

CVSS Score: 9.8

wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.