WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 ships 11 security fixes including unauthenticated stored XSS in wpautop(), path traversal, and theme installation flaws; update immediately.
WordPress 7.1.1 is a short-cycle maintenance and security release fixing 11 security issues alongside 17 core and 19 block editor bug fixes. Flaws include unauthenticated stored XSS in wpautop(), stored XSS in themes with custom headers, authenticated path traversal in the WP REST Templates Controller, and specially crafted URLs that auto-install and preview inactive themes. Fixes are being backported to all branches eligible for security fixes, currently through 4.7; no CVE ids or in-the-wild exploitation were disclosed.
- Unauthenticated stored XSS in wpautop() allows script injection via comments
- Authenticated path traversal in WP REST Templates Controller fixed
- Crafted URLs can auto-install and preview inactive themes from WordPress.org
- Contributor+ arbitrary post overwrite and slug disclosure addressed
- Security fixes backported to all supported branches through 4.7
- Products
- WordPress
- Organizations
- WordPress.org
From the original article
3 min read at wordpress.org
This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.
By Aaron Jorbin · wordpress.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.