wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon; substring.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation.

An input sanitization bypass was discovered in Wordpress, a popular content management framework. An attacker can use this flaw to send malicious scripts to an unsuspecting user.

For Debian 8 'Jessie', this problem has been fixed in version 4.1.29+dfsg-0+deb8u1.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create open redirects, poison cache, and bypass authorization access and input sanitation.

ID	Name	Product	Family	Severity
136373	Debian DSA-4677-1 : wordpress - security update	Nessus	Debian Local Security Checks	critical
132874	Debian DLA-2067-1 : wordpress security update	Nessus	Debian Local Security Checks	critical
132736	Debian DSA-4599-1 : wordpress - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-20041

critical

Tenable Plugins

critical

critical

critical