npx @buildinternet/releases get wordpressWordPress 7.1.3 shipped seven security fixes; 7.2 lands December 8 with collaboration and security work.
The 7.1 line took three security releases in three weeks. 7.1.2 closed a path where page template resolution could load a chosen PHP file outside the active theme, escalating to RCE under matching server and theme conditions. 7.1.3 patches a stored XSS via pending comments on the Comments screen, one of seven security fixes in the release. 7.1.1 carried 11 security fixes and 36 bug fixes. All are immediate-update releases.
WordPress 7.2 arrives December 8 with collaboration and security work.
- Notes gains suggestions and emoji reactions for drafting together.
- A "sudo mode" gates sensitive actions behind re-authentication, and Application Passwords get a hardening pass.
- The Secrets API gives plugins a first-class place to store credentials instead of plaintext options rows, shipping with WP-CLI support.
- A Description List block and the long-awaited Table of Contents block join the library, and form elements become styleable in Global Styles.
NO_BACKSLASH_ESCAPESis now turned off on the database connection, so hosts that enable it stop hitting escaped-query failures.
Gutenberg 24.2 moves notes beside the content.
- Notes float in a margin next to the post instead of forcing the Settings sidebar closed.
- Adding a category, tag, or post to a navigation menu takes a single search.
- Gallery sorts its images and tints them all with one duotone.
- Design tools from 24.1 now reach nearly every core block, with a new text-shadow control.
Collaboration is moving back into Core, server-aware. After RTC was cut from 7.0, the merge targets Core rather than browser-only copies that live until someone saves. Presence API 0.17.0 lets a site switch off individual pieces, and a new guide walks through the sync engines under evaluation, all runnable from an experimental plugin.
Performance and sanitization groundwork shipped. Prefetching is committed, script and style concatenation now defaults off outside development, and load-scripts.php and load-styles.php are slated for removal. wp_kses() was rebuilt on the HTML API.
