WordPress Urges Immediate Update After Fixing 11 Security Vulnerabilities
WordPress 7.1.1 fixes 11 core vulnerabilities including stored XSS, path traversal, and authorization bypass flaws; admins urged to update immediately.
WordPress released version 7.1.1, a security and maintenance update fixing 11 vulnerabilities including multiple stored XSS flaws, an authenticated path traversal in the WP REST Templates Controller reported by Anthropic, missing authorization checks, and an XML-RPC issue bypassing edit_css checks. The release also includes 17 core bug fixes and 19 Block Editor fixes, with security fixes backported to supported branches through 4.7. No exploitation is reported; administrators are urged to update immediately or rely on automatic background updates.
- 11 vulnerabilities fixed: stored XSS, path traversal, authorization bypass, information disclosure
- Stored XSS in wpautop() lets unauthenticated visitors inject scripts via approved comments
- Anthropic reported an authenticated path traversal in WP REST Templates Controller
- XML-RPC fix blocks publishing customize_changeset posts while bypassing edit_css checks
- Security fixes backported to supported branches through WordPress 4.7
- Vendors
- WordPress
- Products
- WordPress 7.1.1
- Organizations
- Anthropic
From the original article
2 min read at cybersecuritynews.com
WordPress has released version 7. 1. 1, a security and maintenance update that fixes 11 vulnerabilities affecting the widely used content management system.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.