This security and maintenance release features 7 security fixes and 4 bug fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• A stored XSS on the Comments administration page, exploitable via pending comments, reported by Trail of Bits in collaboration with OpenAI.
• A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic
• A second-Order SQL injection in WordPress WXR export, reported by Anthropic
• A weakness allowing Author role users to sticky posts, reported by Anthropic
• Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack
• Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong
• Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team