Home Blog Page 6

WordPress.org blog: WordPress 7.1.1 Maintenance and Security Release

0

This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 7.1.1 is a short-cycle release. The next major release will be version 7.2 and is currently planned for December.

For more information, please visit the WordPress 7.1.1 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

  • Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
  • HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
  • Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
  • Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
  • Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
  • Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
  • XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
  • Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
  • Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
  • Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by Jakub Herman.
  • Comments, including notes, can be reparented by any authenticated user, reported by Justin Hart, Viridis Security.

Thank you to these WordPress contributors

This release was led by Adam Silverstein, Adrian Duffell, Andrei Draganescu, and Aaron Jorbin.

WordPress 7.1.1 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, abrahamfariaz, Adam Silverstein, Adi Moldovan, Adrian Duffell, Aki Hamano, Alex Concha, Andrea Fercia, andreasca, Andrei Draganescu, Andrew Duthie, Andrew Serong, André Maneiro, annezazu, Anthony White, Arkaprabha Chowdhury, Ashar Fuadi, Azragh, Barry, buffer1024, Chunhui Ouyang, Courtney Robertson, Dagan, Daniel Richards, Daniel Rodriguez, Darshit Rajyaguru, David Biňovec, Deepak Kumar, Dennis Snell, DevSaiful, Dhruvang21, Dominik Schilling, Ehtisham Siddiqui, Ella Van Durpe, Erick Wambua, FahimMurshed, Fernando Tellado, fiocavallari, George Mamadashvili, George Vasiliades, gregbenz, Harish Tewari, Hit Bhalodia, Isabel Brison, Jake Spurlock, Jamie Dąbrowiecki, Jb Audras, Jeffrey Paul, Jeremy Felt, Jiwoon Kim, Joe Dolson, Joe Hoyle, Joe McGill, Joen Asmussen, Johannes Jülg, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Josh, Kamran Abdul Aziz, Khokan Sardar, Kira Schroder, kleisauke, Kushagra Goyal, l1onofjudah, Lance Willett, luksusspokoju, Manzoor Wani, Marco Ciampini, marcs0h, Marin Atanasov, Michael, Mohammad Jangda, mrkenobi, Mukesh Panchal, Nawazkhan Pathan, Nik Tsekouras, Parth Jogi, Pascal Birchler, Paul Biron, Paul Kevan, Peter Wilson, Rafie Muhammad, ramonopoly, Rashed Hossain, Ressl, Riad Benguella, Rudy Faile, Sainath Poojary, Scott Kingsley Clark, Sergey Biryukov, Shail Mehta, Shameem – a11n, siliconforks, Slava Abakumov, Stephen Bernhardt, Sukhendu Sekhar Guria, Ugyen Dorji, Utsav Ladani, vortfu, Weston Ruter, w3bdsgn, wolf45 plus representatives from Automattic, Bluehost, GoDaddy, Pantheon, and WP Engine.

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Props to Ehtisham Siddiqui, Lance Willett, Weston Ruter, and Adam Silverstein for proofreading.

Open Channels FM: Open Source Economics, LibreOffice, and Swiss Digital Sovereignty

0

Shifting budgets and tech priorities drive change for open source events software and government infrastructure.

Matt: OmFest: A Celebration of Curiosity, Connection, and the Future

0

OmFest is coming together quite nicely! The new website is beautiful and highlights some of the experiences available throughout the day. I think Om would be very impressed by the attendee list. We’re doing it at the Swedish American Hall, the same venue as the first WordCamp, where Om, of course, spoke about Blogs and Journalism. (The videos have been lost to digirot, unless anyone has some recordings? I’ve been looking everywhere.)

Below is cross-posted from OmFest.co:

September 29th is when Om would have turned 60. 

When I first started thinking about how to mark the day, I knew I didn’t want a traditional memorial. Om loved bringing interesting people together, and he loved a festival that taught him something he didn’t already know. His curiosity crossed so many worlds and passions: technology, journalism, photography, investing, watches, pens, coffee, design, music, India, New York, San Francisco.

So we’re bringing these worlds together. On September 29 in San Francisco, we’re throwing OmFest—twelve hours of ideas, objects, food, music, and conversation, organized and anchored around a statement Om once said:

“If you pay enough attention to the present, you can see the future.”

Present Future

Instead of tributes or keynotes, we’ll host a series of short talks with one simple challenge: teach us something you’re seeing before everyone else sees it. No pitches, no career retrospectives. You don’t even have to talk about Om. What happens to photography when anyone can generate the perfect image with AI? Why do physical objects become more meaningful as our lives become more digital? Are glasses becoming computers? What does handwriting do to the way we think? Different subjects, same goal: everyone leaves knowing something they didn’t know when they arrived.

A Festival of Om’s Curiosity

Between the talks, there will be plenty to stumble upon. Through Om’s Lens: a gallery of Om’s photography. TIME: an exhibit that uses his watch obsession to spark a discussion about craft and collecting. Field Notes: a communal writing table stocked with fine paper, fountain pens, and ink, where you can write something worth remembering—and either keep it or leave it behind to be bound in a book to commemorate the day. And Om’s Shelf: books he read, loved, and recommended. The collection will start full and slowly empty as his favorite reads pass into other hands.

People from Om’s different worlds will drop in throughout the day to share knowledge and facilitate small, hands-on moments: a photography tutorial, a notebook-binding session, a lesson on the mechanics of a watch, an experience with a coffee you’ve never tried, a tea ceremony. And, woven into this experience, will be OM/60: sixty small discoveries about Om, hidden throughout.

All Roads Lead to Om

The most important part, however, isn’t any of these objects. At check-in, instead of a badge with your company and title, you’ll choose the worlds through which you knew Om: photography, journalism, technology, GigaOm, investing, WordPress, India, coffee, pens and ink, design, music, or simply friends and family.

Then we build a physical map of it. It starts nearly empty. You add yourself, mark how you knew Om and whom he introduced you to, and those people connect to others. By the end of the night, I hope we’ll be able to see what Om spent a lifetime making.

The question I keep asking myself: who will meet because of Om that Om never had the chance to introduce? If OmFest works, his network won’t just be documented that day. It’ll grow.

From Ideas to Celebration

The day flows and builds. Morning is coffee, breakfast, books, photography, and conversation. The middle is deliberately unstructured—wander, eat, write, talk. In the evening, friends share short stories as we raise a glass to Om on his 60th. Then the bars roll in, the lights go down, the music gets louder, and OmFest becomes DesiParty: his old-school New York nights, Asian Underground, bhangra, electronica. We start with ideas and end with dancing. That feels right.

Version 1.0

What we’re building shouldn’t end on September 29. What does registration look like if it’s designed to help strangers talk to each other? How do you design a conference around curiosity instead of status? How do you make something that works for a two-hour visit or a twelve-hour one? How does a room encourage connection without forcing networking?

We’re treating OmFest as an experiment. We’ll document what works—formats, designs, code, templates, check-in, programming—and open source as much of it as we can. Other events can take the best ideas and make them better.

September 29 isn’t the end of OmFest. It’s version 1.0.

Come Build with Us

People from across Om’s life are building OmFest together. Some are contributing photographs. Someone is making a textile; another is bringing tea and guiding ceremonies. Others are helping with watches, eyewear, books, music, writing, and stories. We haven’t discovered whole parts of Om’s world yet. That’s the point.

If Om introduced you to something, or someone, we’d love to know. If there’s something you think people should experience, see, hear, taste, read, or learn that day, tell us.

And if you just want to come, come. You don’t need to have known Om. You only need to be curious.

WordPress Speculative Loading: What It Does and How to Configure It

0

Your WordPress site can load pages before visitors even click. Learn how speculative loading works, what WordPress 6.8 turned on, and how to tune it!

The post WordPress Speculative Loading: What It Does and How to Configure It appeared first on Themeisle Blog.

What WordPress AI Really Builds: 9 Prompts, 9 Unedited Results, and What the Good Ones Have in Common

0

For this post, I decided to use the Section Generator in the free Otter Blocks plugin. I built nine sections of a WordPress site with it, but instead of endlessly prompting until I got it “just right,” I relied on a single prompt. Then I took a screenshot of what that prompt produced so I could share the results.

The post What WordPress AI Really Builds: 9 Prompts, 9 Unedited Results, and What the Good Ones Have in Common appeared first on Themeisle Blog.

Open Channels FM: Scaling Security WordPress Reinvents Protection and Apache Bolsters Infrastructure While Zephyr Expands Ecosystem

0

WordPress, Apache, and Zephyr adapt to AI-driven security and infrastructure demands shaping the future of open source at scale.

Ask Your AI About Your Website Traffic (GA4, Search Console, SEO in One Chat)

0

Skip the analytics tab scavenger hunt. Here’s how to ask your AI about traffic, search queries, and indexing, then have it act on the answer.

The post Ask Your AI About Your Website Traffic (GA4, Search Console, SEO in One Chat) appeared first on Themeisle Blog.

What Is MCP (Model Context Protocol)? A Guide for WordPress Users

0

MCP keeps showing up in AI news, but what is an MCP server actually for? Plain-English answers, plus what it means for your WordPress site.

The post What Is MCP (Model Context Protocol)? A Guide for WordPress Users appeared first on Themeisle Blog.

5 Best WordPress MCP Server Plugins in 2026 (Honest Comparison)

0

Looking for the best MCP server plugin for WordPress? The top 5 WordPress MCP server plugins compared on tools, setup, security, and price. Here’s the honest breakdown.

The post 5 Best WordPress MCP Server Plugins in 2026 (Honest Comparison) appeared first on Themeisle Blog.