Broken kses.php function “wp_kses_named_entities” crashes WordPress

When you use the deprecated CUSTOM_TAGS constant, you have to define the variables WordPress would normally create in kses.php at the top. If you do not then you will encounter this issue.

/**
 * Specifies the default allowable HTML tags.
 *
 * Using `CUSTOM_TAGS` is not recommended and should be considered deprecated. The
 * {@see 'wp_kses_allowed_html'} filter is more powerful and supplies context.
 *
 * @see wp_kses_allowed_html()
 * @since 1.2.0
 *
 * @var array[]|false Array of default allowable HTML tags, or false to use the defaults.
 */
if ( ! defined( 'CUSTOM_TAGS' ) ) {
    define( 'CUSTOM_TAGS', false );
}

Instead, you should use the wp_kses_allowed_html filter to modify which tags are allowed, using the context parameter to control when and where the adjusted tags are usable:

https://developer.wordpress.org/reference/hooks/wp_kses_allowed_html/

Just keep in mind that the list of tags is chosen to avoid allowing dangerous things into posts and comments. E.g. iframes or script tags. Changing these will have significant security consequences.

How is “kses” activated in this case? Is it the content of the blog?

kses functions are used everywhere in WordPress and play a pivotal role in security. E.g. wp_kses_post is used to strip out dangerous tags when saving a post, and wp_kses can strip out tags and attributes that don’t fit a whitelist. wp_kses and it’s wrapper functions act as both pseudo-escaping and as sanitisation functions.

error code: 523