WordPress 7.1.4 fixes an upgrade-window code execution flaw and a run of stored XSS bugs

WordPress 7.1.4 fixes an upgrade-window code execution flaw and a run of stored XSS bugs

28 October 2026: WordPress 7.1.4, released on 28 October, is a security release, and the project recommends updating sites immediately. Sites with automatic background updates will start the update on their own. Security fixes have been backported to every branch still eligible for them, currently back to 4.7, but those backports are still in progress and will ship as each is ready.

Not yet independently verified. This rests on the WordPress project's own release post. No CVE identifiers or severity scores were published with it. We will update this when it can be confirmed, and remove this note.

What it fixes

The most serious item is "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window". The project gives no more detail, which is normal while sites are still updating.

Most of the remaining fixes are stored cross-site scripting, the kind of flaw where a user who can save content plants script that runs in an administrator's browser:

• specially crafted block markup;
• privacy data removal requests;
• several issues in the Interactivity API, found independently by different researchers, plus a stored denial of service there;
• Customizer selective refresh;
• the Categories block, the Playlist and image blocks, and the comments pagination blocks;
• specially crafted user logins.

Two information leaks are also fixed: unauthenticated users could discover unpublished Customizer changesets, and privileged users without edit rights to a post could read the notes attached to it.

The certificate change

The release also updates the root certificates WordPress bundles for outgoing HTTPS requests, because of the eMudhra revocation. WordPress joins the language runtimes, browsers and operating systems that have removed the eMudhra roots in recent weeks. Plugins and themes that make their own HTTPS calls through WordPress' HTTP API will pick up the new bundle with the update.

What site owners should do

For most sites the automatic update will handle it, but three groups should act by hand. Sites that have turned off automatic core updates, often agency-managed or heavily customised sites, need a manual update. Sites still on older branches should watch for their backport release rather than assume they are covered today. And because the code execution flaw sits in the upgrade window itself, hosts that run large batches of updates should make sure the update runs promptly rather than in a long staggered queue.

Sites with many contributors, authors or shop customers who can create accounts are the most exposed to the stored XSS fixes, because those are the users who can plant content. The next major release, 7.2, is planned for 8 December; its third beta, also out on 28 October, carries the same fixes.

Sources

• WordPress.org: WordPress 7.1.4 (28 October 2026), 28 October 2026