Skip to content

Version 6.0.18

Choose a tag to compare

View all tags
@wordpress-packager wordpress-packager released this 28 Oct 22:55
6.0.18
eb3d108
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Sourced from WordPress.org Documentation.

Summary

Security updates

This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.
The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

  • An Editor+ stored cross-site scripting (XSS) issue in the personal data erasure requests screen reported by Anthropic
  • A Contributor+ stored cross-site scripting (XSS) issue via whitespace in block delimiters reported by Rafie Muhammad (Awesome Motive, Inc.)
  • An information disclosure issue exposing unpublished Customizer changes to unauthenticated visitors reported by Antonio Lorensius Silaban
  • A hardening fix for unescaped usernames on the multisite Network Users screens reported by Anthropic
  • A race condition during core updates that could lead to remote code execution reported by Umut Bayram
  • A Contributor+ stored cross-site scripting (XSS) issue in Customizer selective refresh reported by Rafie Muhammad (Awesome Motive, Inc.)
  • A Contributor+ stored cross-site scripting (XSS) issue in the labels of the Comments Pagination and Post Navigation Link blocks reported by Alex Concha of the WordPress Security Team
  • An update to the bundled root certificates due to the eMudhra revocation.
Assets 2
Loading