---
scope: org
organization: wordpress
release_count: 38
last_release: 2026-10-09
generated: 2026-05-04
updated: 2026-10-17
canonical: https://releases.sh/wordpress/overview.md
---

WordPress 7.1.3 shipped seven security fixes; 7.2 lands December 8 with collaboration and security work.

**The 7.1 line took three security releases in three weeks.** 7.1.2 closed a path where page template resolution could load a chosen PHP file outside the active theme, escalating to RCE under matching server and theme conditions. 7.1.3 patches a stored XSS via pending comments on the Comments screen, one of seven security fixes in the release. 7.1.1 carried 11 security fixes and 36 bug fixes. All are immediate-update releases.

**WordPress 7.2 arrives December 8 with collaboration and security work.**

- Notes gains suggestions and emoji reactions for drafting together.
- A "sudo mode" gates sensitive actions behind re-authentication, and Application Passwords get a hardening pass.
- The Secrets API gives plugins a first-class place to store credentials instead of plaintext options rows, shipping with WP-CLI support.
- A Description List block and the long-awaited Table of Contents block join the library, and form elements become styleable in Global Styles.
- `NO_BACKSLASH_ESCAPES` is now turned off on the database connection, so hosts that enable it stop hitting escaped-query failures.

**Gutenberg 24.2 moves notes beside the content.**

- Notes float in a margin next to the post instead of forcing the Settings sidebar closed.
- Adding a category, tag, or post to a navigation menu takes a single search.
- Gallery sorts its images and tints them all with one duotone.
- Design tools from 24.1 now reach nearly every core block, with a new text-shadow control.

**Collaboration is moving back into Core, server-aware.** After RTC was cut from 7.0, the merge targets Core rather than browser-only copies that live until someone saves. Presence API 0.17.0 lets a site switch off individual pieces, and a new guide walks through the sync engines under evaluation, all runnable from an experimental plugin.

![The Posts screen showing which editors are in each post and lock notes naming who is editing.](https://make.wordpress.org/core/files/2026/10/03-posts-editors-column.png)

**Performance and sanitization groundwork shipped.** Prefetching is committed, script and style concatenation now defaults off outside development, and `load-scripts.php` and `load-styles.php` are slated for removal. `wp_kses()` was rebuilt on the HTML API.