Zero Radar
← feed
HighVulnerabilityupdated 30 Oct 2026, 10:50 UTC

WordPress has several security holes; update to 7.1.4 now

Attackers could sneak malicious code into WordPress sites, which may let them run code on the server, steal visitor data or take over parts of the site. Updating closes these gaps.

Fix availableOfficial, 3 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesWordPress 7.1.4; Debian security update per DSA-6596-1 · since 29 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker submits payloadMalicious markup stored via a block or login
  2. 2WordPress stores itVulnerable block or API saves unsafe content
  3. 3Visitor or admin loads pageBrowser runs the injected script
  4. 4Data exposed or changedSession or site data reachable by attacker
  5. ResultAttacker gains access to site data

What happened

Multiple vulnerabilities in WordPress (stored cross-site scripting in several blocks and the Interactivity API, a remote code execution weakness during the upgrade window, denial of service, information disclosure and privilege issues), fixed in WordPress 7.1.4.

Why it is dangerous: Site owners, administrators and visitors of WordPress sites are at risk, since attackers may inject scripts, read data they should not see, or in some cases run code on the server.

Are you affected?

You are affected if you run WordPress versions earlier than 7.1.4, including Debian-packaged WordPress installations covered by DSA-6596-1.

WordPress before 7.1.4 (Debian wordpress package per DSA-6596-1)

What to do

  1. Update WordPress to version 7.1.4 or later via the Dashboard's Updates page or WordPress.org
  2. On Debian systems, install the security update from DSA-6596-1 for the wordpress package
  3. Review user accounts and privileged users, since stored XSS can target administrators

Timeline

  1. 28 Oct 2026, 17:13 UTC
    Publicly disclosed
  2. 28 Oct 2026, 17:17 UTC
    Picked up by Zero Radar
  3. 29 Oct 2026, 00:00 UTC
    Reported by Debian Security · Debian Security
  4. 29 Oct 2026, 23:52 UTC
    WordPress reported on it · WordPress
  5. 30 Oct 2026, 10:50 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-933aef54 · ZR-38dd4dc3
Disclosed
28 Oct 2026, 17:13 UTC
On Zero Radar
28 Oct 2026, 17:17 UTC (4 min after disclosure)
Last change
30 Oct 2026, 10:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WordPress has several security holes; update to 7.1.4 now · Zero Radar