CVE-2019-16222

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://core.trac.wordpress.org/changeset/45997Patch, Vendor Advisory
https://github.com/WordPress/WordPress/commit/30ac67579559fe42251b5a9f887211bf61a8ed68Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00023.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9867Exploit, Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory
https://core.trac.wordpress.org/changeset/45997Patch, Vendor Advisory
https://github.com/WordPress/WordPress/commit/30ac67579559fe42251b5a9f887211bf61a8ed68Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00023.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9867Exploit, Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory

Timeline

Published: Sep 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-162235.4WordPress before 5.2.3 allows XSS in post previews by authenticated users.CVE-2019-162249.8An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading CVE-2019-162259.8An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_pg[mc->top], leading CVE-2019-162267.5An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an in CVE-2019-162279.8An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation wi CVE-2019-162287.5An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdb_env_open2 if mdb_env_read_header obtains a zero CVE-2019-162294.1drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL poi CVE-2019-16236.7A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary comm CVE-2019-162304.7drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointe CVE-2019-162314.1drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereferen CVE-2019-162324.1drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NUL CVE-2019-162334.1drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer derefere