If you run a WordPress site, update it to WordPress 7.1.4 now. The WordPress project released it on October 28 as a security release and recommends updating immediately. It fixes a weakness in the upgrade process that could lead to remote code execution, a long list of stored cross-site scripting (XSS) issues and two bugs that exposed content to the wrong people.
What does WordPress 7.1.4 fix?
The release notes list twelve security entries, some covering several issues, plus a certificate update. They fall into a few groups, and most of them touch features that ordinary business sites use every day, such as blocks, comments and the Customizer.
- Upgrade process: a weakness that could lead to remote code execution during the upgrade window.
- Stored XSS: issues in crafted block markup, privacy data removal requests, the Interactivity API, Customizer selective refresh, the Categories block, user logins, the Playlist and Image blocks, and the comments pagination blocks.
- Denial of service: a stored denial of service issue in the Interactivity API.
- Data exposure: unpublished Customizer changesets could be discovered by unauthenticated users, and notes could be read by privileged users without access to edit the post.
- Certificates: an update to the bundled root certificates after the eMudhra revocation.
How urgent is this update?
Treat it as urgent. WordPress labels 7.1.4 a security release and asks site owners to update immediately. A stored XSS flaw lets someone save script into a site that later runs in the browser of whoever views that content, which can include your administrators.
The issues were reported by independent researchers, the WordPress Security Team and companies including Awesome Motive and Anthropic. Once fixes like these are public, the details are available to anyone, so the gap between release and update is the period to keep short.
How do you update WordPress safely?
For most sites the update itself takes minutes. According to the release notes, sites that support automatic background updates start the update on their own. Everyone else can update from the dashboard by clicking Updates, then Update Now.
A few habits make the update safe rather than just fast.
- Back up first. Take a fresh backup of both the files and the database, and make sure you know how to restore it.
- Check the version afterwards. Confirm the dashboard reports 7.1.4, especially if you rely on automatic updates.
- Test what earns money. Submit your contact form, run a test order if you sell online and log in as an editor.
- Clear caches. Purge your caching plugin and CDN so visitors get the updated pages.
What if your site runs an older WordPress version?
The WordPress project backported these security fixes to every branch still eligible for security fixes, currently back to version 4.7. Those backports were still in progress at release and ship as each becomes ready.
That is a stopgap, not a plan. WordPress reminds site owners that only the most recent version is actively supported. If an old theme or plugin is keeping you on an older branch, put the upgrade on your roadmap now rather than relying on backports.
What should you plan before WordPress 7.2?
WordPress 7.1.4 is a short-cycle release. The next major version, WordPress 7.2, is currently planned for December 8, and 7.2 Beta 3 already includes the applicable fixes from this release.
Major releases are where themes and plugins are most likely to break. If your site depends on custom code, a page builder or several plugins, set up a staging copy in November, test 7.2 there, and fix problems before December rather than after.
| Your situation | What to do | Watch out for |
|---|---|---|
| Automatic updates are on | Confirm the dashboard shows 7.1.4 | Hosts or plugins that hold back core updates |
| You update by hand | Back up, then click Update Now | Forms, checkout and logins after the update |
| You are on an older branch | Apply the backport when it ships | Only the latest version is actively supported |
What should you do next?
Check the WordPress version on every site you run today, including landing pages and old campaign sites that are easy to forget. Back up, update to 7.1.4, test your forms, then book time in November to try WordPress 7.2 on a staging copy. If you are weighing this for your business, see how we approach CMS development and SEO and digital marketing, or book a meeting with our team.
Frequently asked questions
Will WordPress update itself to 7.1.4?
If your site supports automatic background updates, the update starts on its own. Otherwise, go to Updates in the WordPress dashboard and click Update Now. Either way, confirm the version afterwards.
Is WordPress 7.2 out yet?
Not yet. WordPress 7.2 is currently planned for December 8, and Beta 3 has been released with the fixes from 7.1.4.
Do older WordPress versions get these security fixes?
The fixes were backported to all branches still eligible for security fixes, currently back to 4.7, and ship as they become ready. Only the most recent version is actively supported.
Sources
- WordPress 7.1.4, WordPress, 2026-10-28
Researched from the sources above with AI assistance and checked by the Aranv team’s publishing standard.