WordPress 3.0.4, KSES Library Patched

WordPress 3.0.4 was released on December 29, 2010 as the latest WordPress release in 2010. This release is a patch for XSS vulnerabilities in the KSES library. This release is considered a critical security update by WordPress.

What is KSES?
KSES is an HTML/XHTML filter written in PHP. It removes all unwanted HTML elements and attributes, and it also does several checks on attribute values. KSES can be used to avoid Cross-Site Scripting (XSS). KSES is an open source project available on Sourceforge. But it is a dead project and is no longer maintained by the author.

How to produce the vulnerabilities
The KSES HTML filter (wp-includes/kses.php) applies a “bad protocol” check to all attribute values now. It treats strings including a colon (:) as a URI, and if the string doesn’t have an allowed protocol (http, https, ftp, …), it deletes the letters before the colon as a bad protocol.
Example:

<img src="something.png" alt="Something: here" />

will change to:

<img src="something.png" alt="here" />

“Something:” will be deleted because it will be considered a bad protocol.

What files are patched
The core files that need patching are only 2:

wp-includes/formatting.php
wp-includes/kses.php

And other files revised:

wp-includes/version.php
readme.html
wp-admin/includes/update-core.php

For more detail about the changes, see WordPress trac.