MeridianMeridian

WordPress 7.1.4 Addresses RCE Risk in Upgrade Process and Multiple Stored XSS Vulnerabilities

The WordPress development team released version 7.1.4 on October 28, 2026, as a security update addressing several vulnerabilities in the content management system. The release fixes a flaw in the upgrade process that could allow remote code execution during updates. Multiple stored cross-site scripting issues were also resolved, including those exploitable through specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the announcement. Users are strongly urged to apply the update immediately to mitigate potential attacks. The advisory was published by Security NEXT on November 2, 2026.

Security NEXTTranslated from Japanese

Read at source

The WordPress development team has released version 7.1.4 to address multiple security vulnerabilities in the popular content management system. The security-focused update was made available on October 28, 2026, and administrators are advised to upgrade without delay.

One of the corrected issues resides in the WordPress upgrade mechanism. Attackers could potentially exploit this flaw to execute arbitrary code remotely while the update process is running.

Additional fixes target several instances of stored cross-site scripting. These vulnerabilities can be triggered by specially crafted block markup or by constructing privacy data deletion requests in a particular manner, allowing malicious scripts to be stored and later executed in users' browsers.

The announcement did not include specific CVE identifiers. Nevertheless, the update resolves multiple security problems that could lead to unauthorized code execution or unauthorized script injection.

WordPressWordPress 7.1.4
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Top Security Stories Last Week: Microsoft .NET Patch, Chrome Fixes, and Linux Kernel Exploits Lead
Vulnerabilities & Exploits

Top Security Stories Last Week: Microsoft .NET Patch, Chrome Fixes, and Linux Kernel Exploits Lead

Security NEXT published its weekly ranking of the most viewed articles from October 25 to October 31, 2026. Microsoft released an out-of-band update addressing a .NET vulnerability tied to Brotli compression handling. Google fixed 52 issues in Chrome, four of which received critical severity ratings. US authorities confirmed active exploitation of flaws in the Linux kernel and VMware ESX. Additional high-interest items included new PHP vulnerabilities, Apple iOS 27.2 updates, Node.js remote code execution risks, and multiple Apache Tomcat weaknesses. The list also highlighted ongoing concerns around the PHP2Shell exploit and a Google Brotli decoder flaw affecting diverse environments.

Security NEXTNov 2, 2026Translated from Japanese

CISA Adds Two Ivanti Connect Secure Vulnerabilities to KEV Catalog Following Confirmed Exploitation
Vulnerabilities & Exploits

CISA Adds Two Ivanti Connect Secure Vulnerabilities to KEV Catalog Following Confirmed Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog after real-world exploitation was confirmed. The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, can be chained with a third vulnerability to achieve remote compromise. CVE-2026-111357 allows local authenticated attackers to escalate privileges due to missing authentication in a critical function. CVE-2026-118527 permits remote upload of arbitrary files to disk despite requiring authentication because of predictable identifiers. CISA first listed CVE-2026-111357 on October 29 before briefly removing it and re-adding both issues on October 30, highlighting ongoing tracking confusion.

Security NEXTNov 2, 2026Translated from Japanese

Bluetooth Flaw in Airoha Chips Exposes Link Keys, Enabling WhatsApp Hijacks via Headphones
Vulnerabilities & Exploits

Bluetooth Flaw in Airoha Chips Exposes Link Keys, Enabling WhatsApp Hijacks via Headphones

Two German researchers discovered a critical unauthenticated service interface in Airoha Bluetooth SoCs used by millions of headphones from Sony, JBL, Marshall and others. The flaw allows any nearby attacker to extract cryptographic Link Keys over Bluetooth without pairing or PIN entry. Researchers reverse-engineered firmware update utilities and the proprietary RACE protocol to dump flash memory and locate stored pairing secrets in the NVDM partition. With stolen keys attackers can impersonate legitimate headphones, connect via the HFP profile and intercept calls to hijack WhatsApp and Amazon accounts. The vulnerability affects both Auracast-enabled devices and classic Bluetooth headsets because OEMs left the RACE command set unprotected. Tools built with Bumble and BTstack demonstrated practical attacks that leave victims unaware while audio continues uninterrupted.

HabrOct 31, 2026Translated from Russian