-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 29 Oct 2026 20:21:19 +1100 Source: wordpress Architecture: source Version: 6.8.12+dfsg1-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: Craig Small <csmall@debian.org> Changed-By: Craig Small <csmall@debian.org> Closes: 1150336 1152426 Changes: wordpress (6.8.12+dfsg1-0+deb13u1) trixie-security; urgency=medium . * 6.8.12 backport of security release 7.1.4 Closes: #1152426 Stored XSS with specially crafted block markup. Privacy Data Removal Requests can be created in a way that leads to stored XSS. Multiple stored XSS issues in the Interactivity API. Stored DoS issue in the Interactivity API. Stored XSS in Customizer selective refresh. Stored XSS in the Categories block. Specially crafted User Logins can lead to a stored XSS. Unpublished customizer changesets can be discovered by unauthenticated users. Stored XSS in Playlist and image blocks. Stored XSS in core/comments-pagination-next and core/comments-pagination-previous blocks. Notes can be read by privileged users that lack access to edit the post the note is attached to. * Possibly not applicable but updated anyway: An update to the bundled root certificates due to the eMudhra revocation. A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window. . * 6.8.11 backport of security release 7.1.3 Unauthenticated disclosure of comments on private & unpublished posts CVE-2026-66666 Closes: #1150336 Checksums-Sha1: a7bdb05817912b82b57ce3276c1f4be9ed286bd9 2461 wordpress_6.8.12+dfsg1-0+deb13u1.dsc a4306da3adcc1050276c99d955adf0d723f68a0b 22347756 wordpress_6.8.12+dfsg1.orig.tar.xz 7a74840b574a0a013cc461f12246cc9980033c28 6914248 wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz 5ebdab8569a3891de31fed02cd5230bb4457d3e4 7782 wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo Checksums-Sha256: 81db105c61503bb32ebd364cd333586c17d39f4524a6832416e2fff6fefb09a3 2461 wordpress_6.8.12+dfsg1-0+deb13u1.dsc 97ec3281a9911e3746fc3720fc326ddb04f8ec14ad899f33ba86eb67aa221eae 22347756 wordpress_6.8.12+dfsg1.orig.tar.xz 9e7cf8a0abdfc2d15abef8874b6039e452bf7604d58be93230af9a17af4156d8 6914248 wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz 15e88cceaeb463eb7f591a1820d14649172bca2c807e7c8ea8d0597d9f9a8e57 7782 wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo Files: 85ced3df5d2ed7c9d276f8292d78a6ad 2461 web optional wordpress_6.8.12+dfsg1-0+deb13u1.dsc f77d4faff269f135be31e4e79c4c145d 22347756 web optional wordpress_6.8.12+dfsg1.orig.tar.xz d760ff10da8c661cd6996b8176d882d2 6914248 web optional wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz 5770e086dcefe551dd104386a8a68ba2 7782 web optional wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmrjHkAACgkQAiFmwP88 hOP3gg/+LH2SGNkSAYmWVHP/yzsLch6F5BtKjGIBDUYQKOJFdfI15UGZYbH/wJ4X pyzdvcXwTxIfjAFn4fde3npVfxDFoqTs7Jx0j782HMvg2reS//SYP1dGOLfXcnoV uHGSivRsNtFoY14wTn9XiwZeCouhH88KIDw3TkkAypSpO3ez43XovhT5DhemDM5P kUXdAF5dGPZZNHZAF7Zker9uxNns4+sHaBVOPFy199g3NljZiougKQ48GfDHKHOg ls64JN9/Zw1iSKx5kwlj5gLbhd84CwKI8ucqxQMDHWPInqW6r1XvCFPLV8B0pgNs Pa625G0MXoO0jkMdAJh7BLXu1DMss3ra/o1Ryfus/wdroIP6VT04WNi38qQ5R2WC MsVCBskEvOwUn2Ntg6MkKuYfzntEHHuG8cxIh05xGaVw9Ohlzs7t/tGXS//yzTvn wpMfnt3OhYZLVofwwl3NaTg4deqQRHFAE19xF6iupbsjX8Wd98t9l7T8jvqTrESR 8tXZqEeAby/NVfGGwJNXMMQ8R3yAM8SESa3aubkOvqP+KdxLlr28vG0TMo9ZhePv g3av4z/Xozw6az/OyPZ+TG0Jrx/L15bk9uI1a64I/DIANFAC/V3moP/WfmL2U+dz Rj56Ss16KcFagu1WcOsw1fmHsFZpm546NmzQmMqAsMDpvgOAam0= =4jC+ -----END PGP SIGNATURE-----
