WordPress 7.1.1 was released on September 17, 2026. This security and maintenance release includes 17 core bug fixes, 19 block editor bug fixes and 11 security fixes. The recommendation is to update your sites immediately.
Security fixes in this release
Highlights from the official list of responsibly reported issues:
- A stored XSS in wpautop() that lets an unauthenticated visitor inject script, subject to comment approval
- An HTML API weakness in set_modifiable_text()
- A stored XSS in some themes that support custom headers
- Specially crafted URLs that could install and preview an inactive theme from WordPress.org
- A site administrator being able to network activate a network only plugin
- An authenticated path traversal in the REST templates controller
- XML-RPC publishing of customize changeset posts that bypassed edit_css checks
- An arbitrary post overwrite by contributor level users and above
- Disclosure of a private parent post title, a draft or pending post slug, and comment reparenting, including notes, by any logged in user
The security fixes were backported to all branches eligible for security fixes, back to 4.7 at the time of release. WordPress 7.1.1 is a short cycle release.
Comments, multisite and REST API sites in WordPress 7.1.1
This release touches comments, themes, multisite and the REST API, so it reaches almost every kind of site. Sites that allow public comments, run multisite networks or give contributor access to outside writers should update first. The 36 bug fixes across core and the block editor are a welcome bonus.
Stored XSS in wpautop(). wpautop() formats most post and comment text, so this issue could let a visitor with no account plant script through a comment, although it only ran once the comment was approved. Sites with public comments gain the most. After updating, we spot check comment formatting and make sure moderation is set so nothing goes live without review.
HTML API weakness in set_modifiable_text(). The HTML API is used by core and a growing number of plugins to change markup safely, and this fix hardens one of its methods. Most site owners will not see a difference, but custom code we have written on top of the HTML API gets retested on staging after the update.
Stored XSS in themes with custom headers. Themes that support custom headers let you set header images or text, and in some themes that could be used to store script. If your site runs one of these themes, especially an older classic theme, we test the header on staging after updating and confirm it still displays as expected.
Crafted URLs that install and preview a theme. A crafted link could get WordPress to install and preview an inactive theme from WordPress.org, the kind of link an attacker would try to get a logged in administrator to click. Updating closes it, and we also remove unused themes from client sites, since every installed theme is more code to keep patched.
Network activation of network only plugins. On multisite networks, only network administrators should decide which network only plugins run across every site, and this fix keeps individual site administrators from doing it. For our multisite clients, we review active network plugins after updating and confirm site administrator permissions match how the network is run.
Path traversal in the REST templates controller. This issue required a logged in user, but it could reach files outside the places templates should come from. We test template editing in the Site Editor after updating, along with any headless or app integrations that read templates through the REST API.
XML-RPC publishing of customize changesets. XML-RPC could publish Customizer changesets without the check that limits who can add custom CSS. Many sites do not use XML-RPC at all, and on those we can turn it off, which removes this whole category of risk. If your site depends on XML-RPC for an older publishing tool or integration, we leave it on and test it after the update.
Arbitrary post overwrite by contributors. A contributor should only be able to work on their own drafts, and this issue could let one overwrite other posts. That is a real risk on sites with guest writers or large editorial teams. After updating, we confirm role permissions on staging and make sure backups are recent enough to restore any post that was changed.
Disclosure of private details to logged in users. These issues let any logged in user see things like the title of a private parent page or the slug of an unpublished post, or move comments and notes under a different parent. Membership and community sites, where many people have accounts, gain the most. We test private pages and comment threads as a basic logged in user after the update.
36 core and block editor bug fixes. The 17 core and 19 block editor bug fixes arrive with the security fixes, so there is no reason to wait for them. We run our staging checks of the editor and your key pages, then roll the update out to production once they pass.
Want WordPress 7.1.1 and every release after it handled for you? Our support and maintenance plans cover tested core, theme and plugin updates, uptime monitoring and help when something breaks. Questions about your site? Contact us and we will take a look.
