WordPress 7.1.4 was released on October 28, 2026. It is a security release, and the WordPress Security Team recommends that you update your sites immediately. The WordPress 7.1.4 HelpHub page lists 22 fixed vulnerabilities, led by a weakness in the upgrade process that can lead to remote code execution during the upgrade window, along with stored XSS fixes across blocks, the Interactivity API, the Customizer and user logins.
What shipped
WordPress 7.1.4 is a short cycle release. The next major release, WordPress 7.2, is currently planned for December 8, 2026, and WordPress 7.2 Beta 3 was released with all applicable fixes. The official announcement lists these responsibly reported issues:
- A weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window
- A stored XSS with specially crafted block markup
- Privacy Data Removal Requests that can be created in a way that leads to stored XSS
- Multiple stored XSS issues in the Interactivity API
- A stored denial of service issue in the Interactivity API
- A stored XSS in Customizer selective refresh
- A stored XSS in the Categories block
- Specially crafted user logins that can lead to a stored XSS
- Unpublished Customizer changesets that can be discovered by unauthenticated users
- A stored XSS in the Playlist and image blocks
- Stored XSS in the core/comments-pagination-next and core/comments-pagination-previous blocks
- Notes that can be read by privileged users who lack access to edit the post the note is attached to
- An update to the bundled root certificates because of the eMudhra revocation
As a courtesy, the security fixes were backported to all branches eligible for security fixes, currently through 4.7. The HelpHub page lists the backport releases as 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34 and 4.7.39. Versions 4.6 and earlier no longer receive security fixes, and only the most recent version of WordPress is actively supported. The release was led by Aaron Jorbin and Nik Tsekouras.
What it means for you
Most of these fixes close paths for stored script: content saved by one account that later runs in another person's browser, often an administrator's. Sites with contributors, open registration, comments or privacy requests have the most exposure. The upgrade process fix matters to every site, because every site runs upgrades.
Sites that support automatic updates in the background will start the update on their own. Sites that block automatic updates, or that are pinned to an older branch, need someone to update them by hand.
How we use it in WordPress builds
Remote code execution during the upgrade window. A weakness in the WordPress upgrade process could lead to remote code execution while an upgrade is running. This is the most serious item on the list, and it is the reason to update on a schedule you control rather than waiting. We run core updates during a quiet window, confirm the update finished cleanly, and check the file system afterwards for anything that should not be there.
Stored XSS through crafted block markup. Specially crafted block markup could store script in content. Any account that can save posts is a possible source, so sites with outside contributors or guest authors benefit most. After updating, we open recent posts from contributor accounts in the editor and on the front end.
Stored XSS through Privacy Data Removal Requests. Removal requests could be created in a way that stores script, which then runs when an administrator opens the privacy tools. We check the Erase Personal Data screen after the update on sites that receive requests.
Multiple stored XSS issues and a stored denial of service in the Interactivity API. The Interactivity API powers interactive blocks such as search, navigation and query loops. Several stored XSS issues and one stored denial of service issue were fixed. Sites with custom interactive blocks should retest them after updating, which we do on staging first.
Stored XSS in Customizer selective refresh. Selective refresh updates parts of the Customizer preview without reloading. A stored XSS here affects administrators working in the Customizer, mostly on classic themes.
Stored XSS in the Categories, Playlist and image blocks, and in the comments pagination blocks. Fixes cover the Categories block, the Playlist and image blocks, and the core/comments-pagination-next and core/comments-pagination-previous blocks. We load archive pages, galleries and paginated comment threads after the update to confirm they still render.
Stored XSS through specially crafted user logins. A crafted user login could store script. This matters most on sites with open registration, such as membership, community and store sites. We review new registrations after the update.
Unpublished Customizer changesets visible to unauthenticated users. Draft Customizer changes could be discovered without logging in, which can leak design or content changes before launch. The fix needs no action beyond updating.
Notes readable without edit access. Notes, the block level review comments added in WordPress 6.9, could be read by privileged users who lack access to edit the post the note is attached to. Teams that use Notes for editorial review should update.
Updated bundled root certificates. The bundled root certificates were updated because of the eMudhra revocation. This affects outgoing HTTPS requests that WordPress makes, such as calls to payment, email or API services.
On every site we manage, we confirm the reported version after the update, because a site that blocks automatic updates can sit on an old version without anyone noticing. Our WordPress security hardening checklist covers the account and file permission settings that limit what a stored XSS can reach.
What it means for mobile apps
AppPresser apps load content, logins and blocks from your WordPress site, so the fixes apply to your app as soon as the site is updated. No new app build or store submission is needed. If your app shows interactive blocks or paginated comments, we open those screens in the app after the update. Ask our mobile app team if you want that check done for you.
What to do next
- Update to WordPress 7.1.4 now, or to the patched release for your branch.
- Confirm the version on each site under Dashboard, then Updates.
- Retest custom interactive blocks, the Customizer and registration forms on staging.
- Let our support and maintenance team handle the update and checks, or host with our WordPress security and hosting plans.
Earlier releases in the 7.1 branch: WordPress 7.1.3, WordPress 7.1.2, WordPress 7.1.1 and WordPress 7.1.
Frequently asked questions
Will my site update to WordPress 7.1.4 on its own?
Sites that support automatic updates in the background will start the update automatically. Sites that block automatic updates, or that use a host or plugin that holds core updates, need a manual update from Dashboard, then Updates.
I am on an older branch. Am I protected?
The fixes were backported to every branch through 4.7, for example 7.0.8 and 6.9.11. Versions 4.6 and earlier no longer receive security fixes, and only the latest version is actively supported, so plan a move to 7.1.4.
Does WordPress 7.1.4 change any features?
The announcement lists only security fixes and the root certificate update. It is a short cycle release, and new features are planned for WordPress 7.2.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
