WordPress team introduced WordPress 5.4.1 which is a short-cycle security and maintenance release. It features 17 bug fixes in addition to 7 security fixes. According to the announcement, all versions since WordPress 3.7 have also been updated. The next major release will be version 5.5.
Security issues
WordPress 5.4.1 can be downloaded from WordPress.org or users can visit dashboards and updates. Sites that support automatic background updates have already started the update process. Seven security issues affect WordPress 5.4 and earlier versions:
- Props to Muaz Bin Abdus Sattar and Jannes who both independently reported an issue where password reset tokens were not properly invalidated
- Props to ka1n4t for finding an issue where certain private posts can be viewed unauthenticated
- Props to Evan Ricafort for discovering an XSS issue in the Customizer
- Props to Ben Bidner from the WordPress Security Team who discovered an XSS issue in the search block
- Props to Nick Daugherty from WordPress VIP / WordPress Security Team who discovered an XSS issue in wp-object-cache
- Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who independently reported an XSS issue in file uploads.
- Props to Weston Ruter for fixing a stored XSS vulnerability in the WordPress customizer.
In addition to these fixes, an authenticated XSS issue in the block editor was discovered by Nguyen the Duc in WordPress 5.4 RC1 and RC2. It was fixed in 5.4 RC5.