WordPress 7.1.4 is a security release: it patches 21 vulnerabilities present in version 7.1.2 and earlier. Below is the list from the vulnerability database we check for every monitored WordPress site.
What WordPress 7.1.4 fixes
- WP 4.9 - 7.1.3 - Editor+ Stored XSS via Data Erasure Requests (WPScan)
- Stored XSS in Multisite Network Users Screen (Defense-in-Depth) (WPScan)
- WP 6.9 - 7.1.3 - Post Note Disclosure, Modification and Deletion via Comment Moderation Capability (WPScan)
- Unauthenticated RCE During Core Update (WPScan)
- WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Customizer Selective Refresh (WPScan)
- WP 4.9 - 7.1.3 - Unauthenticated Customizer Changeset Disclosure (WPScan)
- WP 6.7 - 7.1.3 - Contributor+ Stored XSS via Categories Block (WPScan)
- WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Playlist and Image Blocks (WPScan)
- WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Context Namespace Pollution (WPScan)
- WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Bind Directive Prototype Pollution (WPScan)
- WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Style Directive Object Write (WPScan)
- WP 6.6 - 7.1.3 - Contributor+ Stored XSS via Script Module Data Shadowing (WPScan)
- WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Prototype-Chain Property Injection (WPScan)
- WP 6.5 - 7.1.3 - Contributor+ Stored DoS via Interactivity API Bindings (WPScan)
- WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API href Binding (WPScan)
- WP 6.6 - 7.1.3 - Author+ Stored XSS via Interactivity Router (WPScan)
- WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Event Handler Bindings (WPScan)
- WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Previous Block (WPScan)
- WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Block Markup Parsing (WPScan)
- WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Next Block (WPScan)
- WP 6.6 - 7.1.3 - Contributor+ KSES Restriction Bypass via Interactivity API Object Bindings (WPScan)
Vulnerability names are given as they appear in the WPScan database. You will find the full list for every version in our WordPress vulnerability (CVE) database.
How to check whether your site is affected
You can see your WordPress version under Dashboard → Updates. Every version below 7.1.4 in this branch has the flaws listed above. If you have no access to the admin area, enter the address in the free website scanner — it shows the version and the number of known vulnerabilities without logging in.
How to update safely
- Take a full backup of files and the database.
- If you have a staging environment, update there first.
- Update to 7.1.4 (Dashboard → Updates) and make sure automatic minor-release updates are not disabled.
- After updating, test login, forms and — on a store — cart and checkout.
Hear about the next flaw before someone exploits it
MonitorWWW.com compares your installed WordPress version with the known-vulnerability database and alerts you when your site has an unpatched flaw.
Create a free accountThis post was generated automatically from the vulnerability database on the day the fixes from release 7.1.4 appeared in it. The list is extended as the database receives more entries.