{"id":247,"date":"2026-10-28T17:13:02","date_gmt":"2026-10-28T17:13:02","guid":{"rendered":"https:\/\/sripuwath.com\/index.php\/2026\/10\/28\/wordpress-org-blog-wordpress-7-1-4\/"},"modified":"2026-10-28T17:13:02","modified_gmt":"2026-10-28T17:13:02","slug":"wordpress-org-blog-wordpress-7-1-4","status":"publish","type":"post","link":"https:\/\/sripuwath.com\/index.php\/2026\/10\/28\/wordpress-org-blog-wordpress-7-1-4\/","title":{"rendered":"WordPress.org blog: WordPress 7.1.4"},"content":{"rendered":"<p class=\"wp-block-paragraph\">This security release features fixes for multiple issues.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Because this is a security release, it is recommended that you update your sites immediately.<\/strong><\/p>\n<p class=\"wp-block-paragraph\">You can <a href=\"https:\/\/wordpress.org\/download\/\">download WordPress 7.1.4 from WordPress.org<\/a>, or visit your WordPress Dashboard, click \u201cUpdates\u201d, and then click \u201cUpdate Now\u201d. If you have sites that support automatic background updates, the update process will begin automatically.<br \/>WordPress 7.1.4 is a short-cycle release. The next major release will be <a href=\"https:\/\/make.wordpress.org\/core\/7-2\/\">version 7.2<\/a>, currently planned for December 8th.<\/p>\n<p class=\"wp-block-paragraph\">For more information, please visit the <a href=\"https:\/\/wordpress.org\/documentation\/wordpress-version\/version-7-1-4\/\">WordPress 7.1.4 HelpHub site<\/a>.<\/p>\n<h2 class=\"wp-block-heading\">Security updates included in this release<\/h2>\n<p class=\"wp-block-paragraph\">The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:<\/p>\n<ul class=\"wp-block-list\">\n<li>A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window, reported by <a href=\"https:\/\/www.picussecurity.com\/resource\/author\/umut-bayram\">Umut Bayram<\/a>.<\/li>\n<li>A stored XSS with specially crafted block markup, reported by <a href=\"https:\/\/www.linkedin.com\/in\/rafiemuhammad\/\">Rafie Muhammad<\/a> (Awesome Motive, Inc.).<\/li>\n<li>Privacy Data Removal Requests can be created in a way that leads to stored XSS, reported by Anthropic.<\/li>\n<li>Multiple stored XSS issues in the Interactivity API independently discovered by AnC and DatNLQ from VietSunshine Cyber Security, rekter0 and Anas cherni, <a href=\"https:\/\/decentsecurity.io\/\">Marcel Karlsson (whoismarcel)<\/a>, and Weston Ruter, Jon Surrell, Alex Concha, and Luis Herranz of the WordPress Security Team.<\/li>\n<li>A stored denial of service issue in the Interactivity API, reported by Jon Surrell of the WordPress Security Team.<\/li>\n<li>A stored XSS in Customizer selective refresh, reported by <a href=\"https:\/\/www.linkedin.com\/in\/rafiemuhammad\/\">Rafie Muhammad<\/a> (Awesome Motive, Inc.).<\/li>\n<li>A Stored XSS in the Categories block reported by Ben Bidner of the WordPress Security Team.<\/li>\n<li>Specially crafted User Logins can lead to a stored XSS reported by Anthropic.<\/li>\n<li>Unpublished customizer changesets can be discovered by unauthenticated users, reported by <a href=\"https:\/\/www.linkedin.com\/in\/antoniolorensius\/\">Antonio Lorensius Silaban<\/a>.<\/li>\n<li>A Stored XSS in Playlist and image blocks, reported by Ben Bidner of the WordPress Security Team.<\/li>\n<li>Stored XSS in <code>core\/comments-pagination-next<\/code> and <code>core\/comments-pagination-previous<\/code> blocks, reported by Alex Concha of the WordPress Security Team.<\/li>\n<li>Notes can be read by privileged users that lack access to edit the post the note is attached to, reported by Ramon of the WordPress Security Team.<\/li>\n<li>An update to the bundled root certificates due to the eMudhra revocation.<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">Thank you to these WordPress contributors<\/h2>\n<p class=\"wp-block-paragraph\">This release was led by <a href=\"https:\/\/profiles.wordpress.org\/jorbin\/\">Aaron Jorbin<\/a> and <a href=\"https:\/\/profiles.wordpress.org\/ntsekouras\/\">Nik Tsekouras<\/a>. WordPress 7.1.4 would not have been possible without the contributions of the following people:<\/p>\n<p class=\"is-style-wporg-props-medium wp-block-paragraph\"><a href=\"https:\/\/w.org\/@jorbin\">Aaron Jorbin<\/a>, <a href=\"https:\/\/w.org\/@adamsilverstein\">Adam Silverstein<\/a>, <a href=\"https:\/\/w.org\/@xknown\">Alex Concha<\/a>, <a href=\"https:\/\/w.org\/@aduth\">Andrew Duthie<\/a>, <a href=\"https:\/\/w.org\/@andrewserong\">Andrew Serong<\/a>, <a href=\"https:\/\/w.org\/@darerodz\">David Arenas<\/a>, <a href=\"https:\/\/w.org\/@dmsnell\">Dennis Snell<\/a>, <a href=\"https:\/\/w.org\/@ellatrix\">Ella Van Durpe<\/a>, <a href=\"https:\/\/w.org\/@mamaduka\">George Mamadashvili<\/a>, <a href=\"https:\/\/w.org\/@isabel_brison\">Isabel Brison<\/a>, <a href=\"https:\/\/w.org\/@whyisjake\">Jake Spurlock<\/a>, <a href=\"https:\/\/w.org\/@audrasjb\">Jb Audras<\/a>, <a href=\"https:\/\/w.org\/@jeremyfelt\">Jeremy Felt<\/a>, <a href=\"https:\/\/w.org\/@johnbillion\">John Blackbourn<\/a>, <a href=\"https:\/\/w.org\/@jonsurrell\">Jon Surrell<\/a>, <a href=\"https:\/\/w.org\/@desrosj\">Jonathan Desrosiers<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/kirasong\/\">Kira Song,<\/a><a href=\"https:\/\/w.org\/@lancewillett\">Lance Willett<\/a>, <a href=\"https:\/\/w.org\/@luisherranz\">luisherranz<\/a>, <a href=\"https:\/\/w.org\/@mciampini\">Marco Ciampini<\/a>, <a href=\"https:\/\/w.org\/@marcs0h\">marcs0h<\/a>, <a href=\"https:\/\/w.org\/@tyxla\">Marin Atanasov<\/a>, <a href=\"https:\/\/w.org\/@santosguillamot\">Mario Santos<\/a>, <a href=\"https:\/\/w.org\/@mcsf\">Miguel Fonseca<\/a>, <a href=\"https:\/\/w.org\/@ntsekouras\">Nik Tsekouras<\/a>, <a href=\"https:\/\/w.org\/@peterwilsoncc\">Peter Wilson<\/a>, <a href=\"https:\/\/w.org\/@ramonopoly\">ramonopoly<\/a>, <a href=\"https:\/\/w.org\/@rfaile313\">Rudy Faile<\/a>, <a href=\"https:\/\/w.org\/@umut3806\">umut3806<\/a>, <a href=\"https:\/\/w.org\/@westonruter\">Weston Ruter<\/a><\/p>\n<h2 class=\"wp-block-heading\">Backports<\/h2>\n<p class=\"wp-block-paragraph\">As a courtesy, the security fixes were backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, <strong>only the most recent version of WordPress is actively supported<\/strong>. The backports are in progress and will ship as they become ready.<\/p>\n<p class=\"wp-block-paragraph\">WordPress 7.2 Beta 3 has also been released, containing all applicable fixes.<\/p>","protected":false},"excerpt":{"rendered":"<p>This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.4 from WordPress.org, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-247","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/posts\/247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/comments?post=247"}],"version-history":[{"count":0,"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/posts\/247\/revisions"}],"wp:attachment":[{"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/media?parent=247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/categories?post=247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sripuwath.com\/index.php\/wp-json\/wp\/v2\/tags?post=247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}