WordPress released version 7.1.4 on October 28, 2026. It is a security release, and the WordPress team recommends updating your sites immediately. If your site runs on WordPress, this one is worth doing today rather than at the end of the month.
What changed
The release fixes multiple security issues, according to the official announcement. The ones most likely to matter to a small business site:
- A weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window.
- Several stored cross-site scripting (XSS) issues, including ones in the Interactivity API, the Categories block, the Playlist and image blocks, the comments pagination blocks, Customizer selective refresh, and crafted block markup.
- Specially crafted user logins and Privacy Data Removal Requests that can lead to stored XSS.
- A stored denial of service issue in the Interactivity API.
- Unpublished Customizer changesets that unauthenticated users can discover.
- Notes that privileged users can read even when they lack access to edit the post the note is attached to.
- An update to the bundled root certificates because of the eMudhra revocation.
The security fixes are also being backported to every branch still eligible for security fixes, currently back to 4.7. Those backports are in progress and will ship as they become ready. WordPress 7.2 Beta 3 also includes the fixes, and the next major release, 7.2, is currently planned for December 8.
What it means for your business
Stored XSS means an attacker can plant a script that runs in the browser of anyone who views the affected page or admin screen. On a business site that can mean hijacked admin sessions, injected spam links that hurt your search visibility, or visitors sent to a scam page. The upgrade-process flaw is the most serious item on the list because it involves running code on the server itself.
If you do nothing, your site stays exposed to flaws that are now publicly described. That is the usual pattern with security releases: the fixes are published, and attackers study them. Sites on older, unpatched versions are the easy targets.
Sites with automatic background updates may already be on 7.1.4 or will be soon. Sites that block auto-updates, are pinned to a version by a developer, or sit behind a host that manages updates on a schedule need a manual check.
What to do now
- Log in to your WordPress dashboard, go to Dashboard, then Updates, and check which version you are on.
- If you are not on 7.1.4, take a backup, then click Update Now.
- After updating, load your home page, a blog post, your contact form and any checkout or booking page to confirm they still work.
- Check that your plugins and themes are current too, since most WordPress compromises come through them.
- If your site is on a branch older than 7.1, ask your developer or host when the backported fix will reach you, and plan an upgrade to the current version.
- Review the admin user list and remove accounts that no longer need access.
The details
The full list of fixes, with credit to the researchers who reported them, is in the official WordPress announcement linked in the sources.
If you would rather not manage updates yourself, our web development team can take over maintenance, or you can run our free SEO audit to spot technical problems on your site.