WordPress 7.1.4 has been released with fixes for 22 vulnerabilities, including a remote code execution flaw and multiple cross-site scripting (XSS) issues. The vulnerabilities patched affect the upgrade process, Interactivity API, Customizer, personal data erasure requests, post notes, and several content blocks.
Most require an authenticated account, with several exploitable by users with Contributor-level access. The remote code execution flaw in the upgrade process requires no account, but an attacker must access the upgrade directory during the brief window when an update is running.
This marks the seventh security release this year, following WordPress 7.0.2 on July 17 that fixed critical RCE and SQL injection vulnerabilities, 7.0.3 released on August 6 with fixes for 12 security vulnerabilities, 7.0.4 patched Author-Level RCE via malicious file upload on August 12, 7.1.1 provided patches for 11 security issues on September 17, 7.1.2 on September 22, and 7.1.3 on October 6.
Security fixes cover the upgrade process, Interactivity API, and blocks
Umut Bayram reported the remote code execution vulnerability in the WordPress upgrade process. According to Patchstack, WordPress previously extracted update packages into predictable directories under wp-content/upgrade/ and removed the index.php file that prevented directory listing. During an update, an attacker could potentially access the extracted files and run the WordPress installer against a database under their control.
This requires the directory to be accessible over the web and the attacker to reach it while the update is in progress. WordPress 7.1.4 changes how the upgrade directory is named and handled to address the issue.
The release also fixes several stored cross-site scripting (XSS) vulnerabilities in the Interactivity API, along with a denial-of-service issue. The XSS flaws involve JavaScript URLs, event handler bindings, prototype pollution, object elements, uploaded text files, and other unsafe handling of specially crafted content. Most require Contributor-level access, while the issue involving uploaded text files requires Author-level access or higher. The denial-of-service vulnerability can cause a visitor’s browser tab to hang. Another fix prevents post content from taking precedence over the Script Module data used by the API.
The Interactivity API vulnerabilities were independently reported by AnC and DatNLQ of VietSunshine Cyber Security, rekter0, Anas cherni, Marcel Karlsson, Weston Ruter, Jon Surrell, Alex Concha, and Luis Herranz.
Rafie Muhammad of Awesome Motive, Inc. reported two stored XSS vulnerabilities. The first involves whitespace in block delimiters. Differences between PHP and JavaScript in how whitespace characters are parsed can cause specially crafted markup to be interpreted differently by the server and the block editor. Exploitation requires an editor or administrator to open the affected post in the block editor.
The second vulnerability affects the Customizer’s selective refresh functionality. It requires a Contributor-level account and an administrator opening the Customizer on the affected content.
Members of the WordPress Security Team reported several other vulnerabilities affecting WordPress blocks and post notes. Ben Bidner reported a stored XSS vulnerability in the Categories block, where a dropdown label could be processed as a format string after filtering. He also reported a hardening issue in the Image and Playlist blocks involving unsafe use of preg_replace() with attacker-controlled replacement text. The latter is classified as a hardening fix and requires Author-level access or higher.
Alex Concha reported a stored XSS vulnerability affecting labels in the Comments Pagination and Post Navigation Link blocks, which were output without proper escaping. Ramon reported an issue that allowed users with the moderate_comments capability to read, edit, or delete notes attached to posts they were not authorized to edit. This affects configurations where a custom role, plugin, or post type grants that capability without also allowing users to edit the associated post. The update requires users to have editing access to the post before accessing its notes.
Anthropic reported a stored XSS vulnerability in the personal data erasure requests screen and another involving specially crafted user logins.
An information disclosure vulnerability reported by Antonio Lorensius Silaban allowed unauthenticated visitors to discover unpublished Customizer changesets. Preview requests without a changeset UUID could adopt the latest unpublished changeset without checking the user’s capability. The release adds a capability check, while the changeset’s setting values were already protected by separate capability checks.
In addition to the vulnerability fixes, WordPress 7.1.4 updates the bundled root certificates following the revocation of certificates associated with eMudhra.
The next major release, WordPress 7.2, is currently planned for December 8, 2026.