-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 21 Sep 2026 21:21:36 +1000 Source: wordpress Architecture: source Version: 7.1.1+dfsg1-1 Distribution: unstable Urgency: high Maintainer: Craig Small <[email protected]> Changed-By: Craig Small <[email protected]> Closes: 1148368 Changes: wordpress (7.1.1+dfsg1-1) unstable; urgency=high . * New upstream security release Closes: #1148368 Stored XSS in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval). CVE-2026-93485 API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences. Stored XSS in some themes that support custom headers. Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org. (Click2Shell) Site Administrator can network-activate an installed Network-only plugin. Authenticated Path Traversal in WP REST Templates Controller. XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css. Contributor+ Arbitrary Post Overwrite. Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title. Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+. Comments, including notes, can be reparented by any authenticated user. Checksums-Sha1: 7b439e90f62a7ef1138a98f3ae28c11917311919 2359 wordpress_7.1.1+dfsg1-1.dsc 5dd435f4236a7dd9355cfe9ad2b78c66e28101dc 28033048 wordpress_7.1.1+dfsg1.orig.tar.xz b2465d8a34dd48788411fde20c6e7830eab6c59c 1603688 wordpress_7.1.1+dfsg1-1.debian.tar.xz c39570c0cfbf417b35d742b8be0c489748c9b8ef 7229 wordpress_7.1.1+dfsg1-1_amd64.buildinfo Checksums-Sha256: 62f6274ec1013e82f1e0b9e9e319b12f00fd87e9154e47651b623e3f19dbd4d3 2359 wordpress_7.1.1+dfsg1-1.dsc 65b73fd0416a3d208705cc619b54050070775ef6fac9ff67eed49cd6cdb1b3f2 28033048 wordpress_7.1.1+dfsg1.orig.tar.xz eeff5e978e54f083d7c5edd69b7cb88b845dd26fcc28b6508285614722424b93 1603688 wordpress_7.1.1+dfsg1-1.debian.tar.xz 364a0f75fb98a13b315ec9b5039a764f66ad13c559b15dd309b456c8e73f3dca 7229 wordpress_7.1.1+dfsg1-1_amd64.buildinfo Files: 672d2b6e0afe5837f9e681b53025b28b 2359 web optional wordpress_7.1.1+dfsg1-1.dsc 4540177ea4d6fc11955eb4e481e091b0 28033048 web optional wordpress_7.1.1+dfsg1.orig.tar.xz c99018ffbe7bf16c67bd5b1d8fa668a1 1603688 web optional wordpress_7.1.1+dfsg1-1.debian.tar.xz 5abe1d0c161c9f3fc37de7b9609da320 7229 web optional wordpress_7.1.1+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmqxE6AACgkQAiFmwP88 hOOx0g//ToI8qpHOM0QrVuEkzq2ccKZIU8JNCaMVvbRomwbG/6xmWfiiZqlRzNth rqBypAGehuxXxmckhrJklnuj/W3Trd3O79gy8HhUkxm75SxcwHdisVa3T4qtvMi5 npftj2u7nItM7uVHfnPYdmbT/jr7hBflssZ3Xp0yGr2DpFh2XjI4baMdcqnqklYi k+en/pwvtyh3+yQmkGIJQ5GE2/sFZZVj5VVvYv+QGifLYCrec1ZUThyYgoIFzuRx krpV4vZPoY9BRW4jjh5iu/RTXoFUzlKqPs4rKiE9SaAY76/qQ2V/t5u9S1DGaZYA Q9M3Wl/eqEn2qv6jxeOWBdz3v/d21FeFDBqj88f7aUHhbrTfVjFwv5xl6VnB6rw1 ANbJrls5kxgyUTC6/v+B6xWP3gL/OwxWD3BhXKPpDIspv1kbJmsmo1bfpnVm4htm xVLtinXe3mCj+ySZCga0Ia6M/wUsjvbuvumEM/047oHvCrmiaP/SMQ21ohSci43r LNgR3gYxXG0o4Z0iVo/1Aaa1YW1lGWABdWxS0sDoiOb4farQVHtRdwGC4bKPCqgz 1vSCuPqZwDQGM78kpteDscT0vo4jFCL4hu0v54Dne4Uw96fqOIB7ajYIh3hOeJ9o GRTyR/cR9B23wN4aOboNBxOFotlA0W2CPk3zdY+yi8aHWWX9ELg= =w9Bm -----END PGP SIGNATURE-----
pgp1Nh8b5j8Bw.pgp
Description: PGP signature
