WordPress 7.1.4 security release: upgrade-window RCE and a batch of stored XSS fixes ยท updates https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026 WordPress released 7.1.4 on Oct 28 2026 as a security release and recommends updating sites immediately. It fixes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (reported by Umut Bayram), a long list of stored XSS issues (crafted block markup, Privacy Data Removal Requests, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, and specially crafted user logins), a stored denial of service in the Interactivity API, unpublished Customizer changesets being discoverable by unauthenticated users, and Notes being readable by privileged users who can't edit the post. It also updates the bundled root certificates because of the eMudhra revocation. Sites with automatic background updates get it automatically; the fixes are being backported to every branch still eligible for security fixes (back to 4.7), and those backports ship as they become ready. WordPress 7.2 Beta 3 has the same fixes. en Wed, 28 Oct 2026 00:00:00 GMT WordPress 7.1.4 security release: upgrade-window RCE and a batch of stored XSS fixes: WordPress releases 7.1.4, a security release fixing an upgrade-process RCE, multiple stored XSS issues, an Interactivity API stored DoS, unauthenticated discovery of unpublished Customizer changesets and a Notes access issue, plus a root certificate update for the eMudhra revocation. Backports to older branches are in progress. https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026 https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026#2026-10-28-38411086 Wed, 28 Oct 2026 00:00:00 GMT high <p><a href="https://wordpress.org/news/2026/10/wordpress-7-1-4/">Source</a></p>