[Bug reporting] two XSS vulnerabilties in wp_kses_bad_protocol in ActivateLinks.php and BKActivateLinks.php(CVE-2019-20041)

[seongil-wi]

Hi

I found two known XSS vulnerabilities in the recent version of bugkick.
In particular, the bug we report is a known bug by CVE-2019-20041.

wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.

Please check this lines:

bugkick/protected/helpers/ActivateLinks.php

Line 522 in badf77f

$string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );

bugkick/protected/modules/forum/components/BKActivateLinks.php

Line 522 in badf77f

$string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );

Thanks!