Control: tag -1 pending Hello,
Bug #1148368 in wordpress reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/debian/wordpress/-/commit/9ed24329ff93dc02ff664a0e821f15845dfea84e ------------------------------------------------------------------------ 7.1.1 New upstream security release Closes: #1148368 Fixes: CVE-2026-93485 and Click2Shell Stored XSS in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval). CVE-2026-93485 API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences. Stored XSS in some themes that support custom headers. Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org. (Click2Shell) Site Administrator can network-activate an installed Network-only plugin. Authenticated Path Traversal in WP REST Templates Controller. XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css. Contributor+ Arbitrary Post Overwrite. Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title. Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+. Comments, including notes, can be reparented by any authenticated user. ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1148368
