Vulnerabilities & Exploits
WordPress 7.1.4 Addresses RCE Risk in Upgrade Process and Multiple Stored XSS Vulnerabilities
The WordPress development team released version 7.1.4 on October 28, 2026, as a security update addressing several vulnerabilities in the content management system. The release fixes a flaw in the upgrade process that could allow remote code execution during updates. Multiple stored cross-site scripting issues were also resolved, including those exploitable through specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the announcement. Users are strongly urged to apply the update immediately to mitigate potential attacks. The advisory was published by Security NEXT on November 2, 2026.
Security NEXTNov 2, 2026Translated from Japanese