WordPress 7.1.4 Security Release Fixes Multiple Vulnerabilities

WordPress 7.1.4 was published on October 28, 2026. It is a short-cycle security release that fixes multiple issues, and the WordPress team recommends that site owners update immediately.

The most serious fix addresses a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window. The weakness was reported by Umut Bayram. The rest of the release covers several stored cross-site scripting (XSS) issues in areas including the Interactivity API, Customizer selective refresh, the Categories block, Playlist and image blocks, and comments pagination blocks. It also fixes a stored denial of service issue in the Interactivity API, a flaw that lets unauthenticated users discover unpublished Customizer changesets, and privacy data removal requests that can lead to stored XSS.

Why it matters

Stored XSS flaws let attackers place malicious code on a site so it runs for the people who load those pages. A remote code execution weakness is more serious still, and this one applies during the upgrade itself. Because the list covers so many components, sites that wait leave several known issues open.

What to do

Download WordPress 7.1.4 from WordPress.org, or open your WordPress Dashboard, click “Updates,” and then click “Update Now.” Sites with automatic background updates will start the process on their own. Confirm the details on the WordPress 7.1.4 HelpHub site, and note that the next major release, version 7.2, is currently planned for December 8th.