WordPress 7.1.4 Fixes Remote Code Execution Flaw and Multiple XSS Vulnerabilities

WordPress site owners have another important update to install, and this one should not be ignored. WordPress 7.1.4 is now available with security fixes covering multiple vulnerabilities, including a weakness in the upgrade process that could lead to remote code execution. The platform recommends updating sites immediately.

WordPress 7.1.4 patches multiple security vulnerabilities

The latest release addresses several stored cross-site scripting (XSS) vulnerabilities across WordPress features. These include the Interactivity API, Categories block, Playlist and image blocks, and Customizer functionality. Specially crafted block markup and user logins could also trigger security issues.

Interestingly, Anthropic reported two of the vulnerabilities covered by this release. One involves privacy data removal requests that could lead to stored XSS, while another concerns specially crafted user logins. Multiple other researchers and members of the WordPress security team also contributed vulnerability reports.

The update also fixes a stored denial-of-service issue in the Interactivity API. Additionally, WordPress addressed a problem that could expose unpublished Customizer changesets to unauthenticated users. Another fix covers notes that privileged users could read without having permission to edit the associated post.

How to install WordPress 7.1.4

Website administrators can download WordPress 7.1.4 directly from WordPress.org. Alternatively, open the WordPress Dashboard, navigate to Updates, and select Update Now.

Sites supporting automatic background updates may receive the release automatically. However, administrators should verify their installation and ensure the update completed successfully. Keeping WordPress and its components updated helps reduce exposure to known security vulnerabilities.

WordPress 7.2 is coming next

WordPress 7.1.4 is a short-cycle security release, with WordPress 7.2 currently planned for December 8. The WordPress 7.2 Beta 3 release also includes the applicable security fixes. The security team has also backported fixes to eligible older branches, extending through WordPress 4.7. However, the project reminds users that only the latest WordPress version receives active support. If your website runs WordPress 7.1.3 or an older release, updating should be a priority. The remote code execution weakness and multiple XSS fixes make this release particularly important for website security.