Hi Craig,

https://wordpress.org/news/2026/10/wordpress-7-1-4/ lists a batch of
security fixes applied (likely affecting as well the other older
series):

- A weakness in the WordPress upgrade process which can lead to remote
  code execution during the upgrade window, reported by Umut Bayram.
- A stored XSS with specially crafted block markup, reported by Rafie
  Muhammad (Awesome Motive, Inc.).
- Privacy Data Removal Requests can be created in a way that leads to
  stored XSS, reported by Anthropic.
- Multiple stored XSS issues in the Interactivity API independently
  discovered by AnC and DatNLQ from VietSunshine Cyber Security, rekter0
  and Anas cherni, Marcel Karlsson (whoismarcel), and Weston Ruter, Jon
  Surrell, Alex Concha, and Luis Herranz of the WordPress Security Team.
- A stored denial of service issue in the Interactivity API, reported by
  Jon Surrell of the WordPress Security Team.
- A stored XSS in Customizer selective refresh, reported by Rafie
  Muhammad (Awesome Motive, Inc.).
- A Stored XSS in the Categories block reported by Ben Bidner of the
  WordPress Security Team.
- Specially crafted User Logins can lead to a stored XSS reported by
  Anthropic.
- Unpublished customizer changesets can be discovered by unauthenticated
  users, reported by Antonio Lorensius Silaban.
- A Stored XSS in Playlist and image blocks, reported by Ben Bidner of
  the WordPress Security Team.
- Stored XSS in core/comments-pagination-next and core/comments-pagination-
  previous blocks, reported by Alex Concha of the WordPress
  Security Team.
- Notes can be read by privileged users that lack access to edit the
  post the note is attached to, reported by Ramon of the WordPress
  Security Team.
- An update to the bundled root certificates due to the eMudhra
  revocation.

Regards
Salvatore

Hello,

Bug #1152426 in wordpress reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/wordpress/-/commit/93bb0c51d34b9ae588edd2e4e04c2e5ad5a59c11
------------------------------------------------------------------------
New upstream security release 7.1.4

* New upstream security release Closes: #1152426
  Stored XSS with specially crafted block markup.
  Privacy Data Removal Requests can be created in a way that leads to
   stored XSS.
  Multiple stored XSS issues in the Interactivity API.
  Stored DoS issue in the Interactivity API.
  Stored XSS in Customizer selective refresh.
  Stored XSS in the Categories block.
  Specially crafted User Logins can lead to a stored XSS.
  Unpublished customizer changesets can be discovered by unauthenticated
   users.
  Stored XSS in Playlist and image blocks.
  Stored XSS in core/comments-pagination-next and
   core/comments-pagination-previous blocks.
  Notes can be read by privileged users that lack access to edit the post
   the note is attached to.
* Possibly not applicable but updated anyway:
  An update to the bundled root certificates due to the eMudhra revocation.
  A weakness in the WordPress upgrade process which can lead to remote code
   execution during the upgrade window.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1152426

We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152426@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Craig Small <csmall@debian.org> (supplier of updated wordpress package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 29 Oct 2026 20:05:27 +1100
Source: wordpress
Architecture: source
Version: 7.1.4+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: Craig Small <csmall@debian.org>
Changed-By: Craig Small <csmall@debian.org>
Closes: 1152426
Changes:
 wordpress (7.1.4+dfsg1-1) unstable; urgency=high
 .
   * New upstream security release Closes: #1152426
     Stored XSS with specially crafted block markup.
     Privacy Data Removal Requests can be created in a way that leads to
      stored XSS.
     Multiple stored XSS issues in the Interactivity API.
     Stored DoS issue in the Interactivity API.
     Stored XSS in Customizer selective refresh.
     Stored XSS in the Categories block.
     Specially crafted User Logins can lead to a stored XSS.
     Unpublished customizer changesets can be discovered by unauthenticated
      users.
     Stored XSS in Playlist and image blocks.
     Stored XSS in core/comments-pagination-next and
      core/comments-pagination-previous blocks.
     Notes can be read by privileged users that lack access to edit the post
      the note is attached to.
   * Possibly not applicable but updated anyway:
     An update to the bundled root certificates due to the eMudhra revocation.
     A weakness in the WordPress upgrade process which can lead to remote code
      execution during the upgrade window.
Checksums-Sha1:
 6089b197f2086ee6d54c66da3be4d318f3f15e52 2359 wordpress_7.1.4+dfsg1-1.dsc
 6efc78716513621b5bc385ec9a7c6b2faebeb16f 28043760 wordpress_7.1.4+dfsg1.orig.tar.xz
 677ab8c24a248144ef6424f50f45c9c0e9d2e50b 1603740 wordpress_7.1.4+dfsg1-1.debian.tar.xz
 645bc84ce861d7ba7899abbecd702c3eb447437a 7414 wordpress_7.1.4+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
 e7cdfff4e79342cc92959faf7ec37618ae5e3731e8d8b89d8de2da28cf451ca7 2359 wordpress_7.1.4+dfsg1-1.dsc
 2286e61f7607695cca28b13ab056298937d9381d2e2e9b5635d1bae5c96aaf28 28043760 wordpress_7.1.4+dfsg1.orig.tar.xz
 6d82c7d658ed498ea079cd4ca4aa19dfdf35d4cd965d3cd376935937b1ead0e6 1603740 wordpress_7.1.4+dfsg1-1.debian.tar.xz
 e2afe92f390696289b45a66d12e852295d3897ad4b2e790632ec6b383aec3e1a 7414 wordpress_7.1.4+dfsg1-1_amd64.buildinfo
Files:
 52f91b360efbc6466829adbafb953416 2359 web optional wordpress_7.1.4+dfsg1-1.dsc
 c48d4d338b64b96fa55259ca972b6b9a 28043760 web optional wordpress_7.1.4+dfsg1.orig.tar.xz
 160d0779b737ca98899b45703fd7e1bb 1603740 web optional wordpress_7.1.4+dfsg1-1.debian.tar.xz
 bd296537b14d21bffd82d7db5bdd33be 7414 web optional wordpress_7.1.4+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmrjDrgACgkQAiFmwP88
hONZnw/9GIWc7HDw8WNU/bau8lXtxBG4Cu+aStdWT1to9ul+tcnebrCKCcQGby7h
kIJx+voGOV3RNigmf4V44590VIH7N1muypArFPULVuA5pqJMcEuvjVDbXP5Z6kpZ
5jrozQS2Fg7FAog8AyE8DYypRUexUzzKlzBcD0TjD6ZATBIutYdW2e4IDyzwEFXQ
VfSs9SAwiYOo21XzwPZznJcwgLwO0apaNQEnL6s2RUCvp1jT0cHZ4lt1NzoZz8ss
YH2udj/Iis+jxzkrHzh1soZTCZm0qDZPLWr+74krw7xVsUhMd28CpS/OQxBUifBF
TlgnFyaVQnMx473cFF/FtNQTFjSJu8B4KpNQeWdi8QDoyztn6e1W6dQg890jGR08
twBcgLCdbL+0yhlc/f8rT2e3CpTAHJsBm2o8jTSkm0pXNUwaW+dFNQ2AX2Q+Z/Oa
wnJ+4+M/kYGydCbudRpROamhLiAsK0hnWLtyBCKLMH1sY0I2nX9LNAZIHT16VKuF
3ZEbouApda91YY7uE7WYsIVcPeT8NbZCxXYUTjvo15oVd6WLkDDn/pEZbDCNspYh
wTtYhuG50VcDvWKm4qHPhBBxtxYgrNIN8aZl9rFvPwMtpedZhxZ/DsEWn2imsxfS
U31TloWwd9tVHJIa0WZ2lyyJemoZisd0SmTS/KZhhSRAbBvtu0U=
=bp3f
-----END PGP SIGNATURE-----