CVE-2019-20041

CVE-2019-20041 is a critical input sanitization bypass vulnerability in WordPress versions prior to 5.3.1, specifically affecting the wp_kses_bad_protocol function. This flaw allows attackers to circumvent HTML5 colon named entity sanitization, exemplified by the "javascript:" substring, impacting various Debian and WordPress installations. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, its high FAUCET Risk Score of 80/100 indicates a substantial theoretical threat.