WordPress 7.1.3 Released With Patches for Seven Security Vulnerabilities
WordPress 7.1.3 addresses several high-risk vulnerabilities, including stored XSS and SQL injection flaws, and users are urged to update their installations immediately.
WordPress 7.1.3 is available now. This security update patches seven core vulnerabilities and four additional bugs.
High-risk fixes include a stored cross-site scripting flaw in pending comments that executes malicious code when an administrator opens the moderation screen. The release also resolves an export system SQL injection vulnerability where malicious input stays dormant until an export starts.
Additional fixes address a bug exposing private or unpublished comments to unauthorized visitors, an Imgur embed XSS issue, a denial-of-service vulnerability, and permission-related bugs. Anthropic, Trail of Bits, Patchstack, independent contributors, and the WordPress security team reported the vulnerabilities.
No known active exploits exist at this time. Even so, you should prioritize updating. Make sure backups are current and check older installations since the WordPress security team is backporting fixes to legacy versions.
Sites with automatic updates enabled might already be patched. You can check your version in the dashboard updates panel. Verify that your instances are running version 7.1.3.