Recent releases from organizations and products in the Framework category.
Expo1This security release fixes 12 vulnerabilities, including a critical pre-auth reflected XSS on the login screen with potential for PHP code execution (CVE-2026-64638), a privilege escalation issue on multisite networks, and multiple stored XSS flaws. Fixes are being backported to eligible branches through 4.7.
Gutenberg 23.7 fixes floated blocks overlapping sticky blocks and restores Pullquote custom line height in the editor. The Gallery block's "Convert to images" button is renamed "Detach" with an explanatory modal, and Global Styles inheritance UI is now opt-in.
Deno1
Expo1Nuxt2WordPress 7.1 has entered the Release Candidate phase. All commits to trunk require double sign-off by two core committers until the 7.1 branch is created, and a hard string freeze is in effect (no new strings allowed, with exceptions for critical strings). Only regressions and test suite expansion tickets may remain on the 7.1 milestone.
Field guide for WordPress 7.1 details developer features: client-side media processing APIs, a new Abilities API, SVG Icon API, DataViews/DataForm/View Config APIs, accessible tooltips in core, and an enforced iframed editor. Media Library infinite scrolling is now default with a per-user opt-out, and classic block, real-time collaboration, and "On This Day" widget did not make the release.
The notify_post_author filter now has the final say on post author notifications: approval status is incorporated into the default value passed to the filter, and its return value is always honored. Callbacks like __return_true will now also send notifications for comments in moderation, spam, or trash. The default is now always a strict boolean, and invalid comment IDs return false without firing the filter.
WordPress 7.1 extends wp_get_abilities() with an optional $args array that filters abilities by category, namespace, or metadata, plus callbacks for custom per-item filtering and result processing. Two new global filters — wp_get_abilities_item_include and wp_get_abilities_result — allow plugins to influence retrieval, and the REST API abilities controller now uses this shared pipeline. The change is backward compatible, with existing calls returning the full registry.
Block styles can now be defined for Tablet and Mobile viewports via Global Styles and per-instance style attributes. Themes can customize breakpoint widths with the new top-level settings.viewport value, and responsive editing can be disabled with the responsiveEditingEnabled editor setting (defaults to true).
WordPress 7.1 lets users style hover, focus, focus-visible, and active states on Button and Navigation Link blocks, with theme.json and block-instance support. An early custom state feature enables styling the current menu item, and sites can disable state editing via blockStatesEditingEnabled.
WordPress 7.1 RC1 is out and includes more than 145 updates since Beta 4, with new features including an Icons API for registering icons and collections, configurable speculative-loading defaults, email notifications for @mentions in Notes, and shareable revision links.
WordPress 7.1 adds a new public metadata flag for abilities that replaces the need to set show_in_rest and other channel-specific flags individually. Channel-specific settings still take precedence when finer control is needed.
The Navigation block no longer propagates font-size to child items, fixing a compounding bug that broke nested dropdown menus. Developers can now target specific block variations in transforms, and two block-sanity functions lose their experimental prefix.
WordPress 7.1 RC1 is scheduled for August 5. New dev notes detail design system theming, execution lifecycle filters for the Abilities API, filtering Site Editor screens, jQuery UI 1.14.2, JSON schema preparation, and iframed editor changes.
