Your message dated Thu, 29 Oct 2026 09:38:39 +0000
with message-id <[email protected]>
and subject line Bug#1152426: fixed in wordpress 7.1.4+dfsg1-1
has caused the Debian Bug report #1152426,
regarding wordpress: Security issues fixed in WordPress 7.1.4 release
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1152426: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152426
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: wordpress
Version: 7.1.3+dfsg1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi Craig,
https://wordpress.org/news/2026/10/wordpress-7-1-4/ lists a batch of
security fixes applied (likely affecting as well the other older
series):
- A weakness in the WordPress upgrade process which can lead to remote
code execution during the upgrade window, reported by Umut Bayram.
- A stored XSS with specially crafted block markup, reported by Rafie
Muhammad (Awesome Motive, Inc.).
- Privacy Data Removal Requests can be created in a way that leads to
stored XSS, reported by Anthropic.
- Multiple stored XSS issues in the Interactivity API independently
discovered by AnC and DatNLQ from VietSunshine Cyber Security, rekter0
and Anas cherni, Marcel Karlsson (whoismarcel), and Weston Ruter, Jon
Surrell, Alex Concha, and Luis Herranz of the WordPress Security Team.
- A stored denial of service issue in the Interactivity API, reported by
Jon Surrell of the WordPress Security Team.
- A stored XSS in Customizer selective refresh, reported by Rafie
Muhammad (Awesome Motive, Inc.).
- A Stored XSS in the Categories block reported by Ben Bidner of the
WordPress Security Team.
- Specially crafted User Logins can lead to a stored XSS reported by
Anthropic.
- Unpublished customizer changesets can be discovered by unauthenticated
users, reported by Antonio Lorensius Silaban.
- A Stored XSS in Playlist and image blocks, reported by Ben Bidner of
the WordPress Security Team.
- Stored XSS in core/comments-pagination-next and core/comments-pagination-
previous blocks, reported by Alex Concha of the WordPress
Security Team.
- Notes can be read by privileged users that lack access to edit the
post the note is attached to, reported by Ramon of the WordPress
Security Team.
- An update to the bundled root certificates due to the eMudhra
revocation.
Regards
Salvatore
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 7.1.4+dfsg1-1
Done: Craig Small <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 29 Oct 2026 20:05:27 +1100
Source: wordpress
Architecture: source
Version: 7.1.4+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Closes: 1152426
Changes:
wordpress (7.1.4+dfsg1-1) unstable; urgency=high
.
* New upstream security release Closes: #1152426
Stored XSS with specially crafted block markup.
Privacy Data Removal Requests can be created in a way that leads to
stored XSS.
Multiple stored XSS issues in the Interactivity API.
Stored DoS issue in the Interactivity API.
Stored XSS in Customizer selective refresh.
Stored XSS in the Categories block.
Specially crafted User Logins can lead to a stored XSS.
Unpublished customizer changesets can be discovered by unauthenticated
users.
Stored XSS in Playlist and image blocks.
Stored XSS in core/comments-pagination-next and
core/comments-pagination-previous blocks.
Notes can be read by privileged users that lack access to edit the post
the note is attached to.
* Possibly not applicable but updated anyway:
An update to the bundled root certificates due to the eMudhra revocation.
A weakness in the WordPress upgrade process which can lead to remote code
execution during the upgrade window.
Checksums-Sha1:
6089b197f2086ee6d54c66da3be4d318f3f15e52 2359 wordpress_7.1.4+dfsg1-1.dsc
6efc78716513621b5bc385ec9a7c6b2faebeb16f 28043760
wordpress_7.1.4+dfsg1.orig.tar.xz
677ab8c24a248144ef6424f50f45c9c0e9d2e50b 1603740
wordpress_7.1.4+dfsg1-1.debian.tar.xz
645bc84ce861d7ba7899abbecd702c3eb447437a 7414
wordpress_7.1.4+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
e7cdfff4e79342cc92959faf7ec37618ae5e3731e8d8b89d8de2da28cf451ca7 2359
wordpress_7.1.4+dfsg1-1.dsc
2286e61f7607695cca28b13ab056298937d9381d2e2e9b5635d1bae5c96aaf28 28043760
wordpress_7.1.4+dfsg1.orig.tar.xz
6d82c7d658ed498ea079cd4ca4aa19dfdf35d4cd965d3cd376935937b1ead0e6 1603740
wordpress_7.1.4+dfsg1-1.debian.tar.xz
e2afe92f390696289b45a66d12e852295d3897ad4b2e790632ec6b383aec3e1a 7414
wordpress_7.1.4+dfsg1-1_amd64.buildinfo
Files:
52f91b360efbc6466829adbafb953416 2359 web optional wordpress_7.1.4+dfsg1-1.dsc
c48d4d338b64b96fa55259ca972b6b9a 28043760 web optional
wordpress_7.1.4+dfsg1.orig.tar.xz
160d0779b737ca98899b45703fd7e1bb 1603740 web optional
wordpress_7.1.4+dfsg1-1.debian.tar.xz
bd296537b14d21bffd82d7db5bdd33be 7414 web optional
wordpress_7.1.4+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmrjDrgACgkQAiFmwP88
hONZnw/9GIWc7HDw8WNU/bau8lXtxBG4Cu+aStdWT1to9ul+tcnebrCKCcQGby7h
kIJx+voGOV3RNigmf4V44590VIH7N1muypArFPULVuA5pqJMcEuvjVDbXP5Z6kpZ
5jrozQS2Fg7FAog8AyE8DYypRUexUzzKlzBcD0TjD6ZATBIutYdW2e4IDyzwEFXQ
VfSs9SAwiYOo21XzwPZznJcwgLwO0apaNQEnL6s2RUCvp1jT0cHZ4lt1NzoZz8ss
YH2udj/Iis+jxzkrHzh1soZTCZm0qDZPLWr+74krw7xVsUhMd28CpS/OQxBUifBF
TlgnFyaVQnMx473cFF/FtNQTFjSJu8B4KpNQeWdi8QDoyztn6e1W6dQg890jGR08
twBcgLCdbL+0yhlc/f8rT2e3CpTAHJsBm2o8jTSkm0pXNUwaW+dFNQ2AX2Q+Z/Oa
wnJ+4+M/kYGydCbudRpROamhLiAsK0hnWLtyBCKLMH1sY0I2nX9LNAZIHT16VKuF
3ZEbouApda91YY7uE7WYsIVcPeT8NbZCxXYUTjvo15oVd6WLkDDn/pEZbDCNspYh
wTtYhuG50VcDvWKm4qHPhBBxtxYgrNIN8aZl9rFvPwMtpedZhxZ/DsEWn2imsxfS
U31TloWwd9tVHJIa0WZ2lyyJemoZisd0SmTS/KZhhSRAbBvtu0U=
=bp3f
-----END PGP SIGNATURE-----
pgpnGA5iJbH9R.pgp
Description: PGP signature
--- End Message ---
