WordPress Changelog

What's new in WordPress 6.5.2

Apr 10, 2024
  • A cross-site scripting (XSS) vulnerability affecting the Avatar block type; reported by John Blackbourn of the WordPress security team. Many thanks to Mat Rollings for assisting with the research.

New in WordPress 6.5 (Apr 10, 2024)

  • Get more from your revisions—including revisions for templates and template parts:
  • Work through creative projects with a more comprehensive picture of what’s been done—and what you can fall back on. Get details like time stamps, quick summaries, and a paginated list of all revisions. View revisions from the Style Book to see how changes impact every block. Revisions are also now available for templates and template parts.
  • Play with enhanced background and shadow tools:
  • Control the size, repeat, and focal point options for background images in Group blocks so you can explore subtle or splashy ways to add visual interest to layouts.
  • Set aspect ratios for Cover block images and easily add color overlays that automatically source color from your chosen image.
  • Add box shadow support to more block types and create layouts with visual depth, or throw a little personality into your design.
  • Discover new Data Views:
  • Every piece of your site comes with a library of information and data—now, you can find what you need quickly and organize it however you like. Data views for pages, templates, patterns, and template parts let you see data in a table or grid view, with the option to toggle fields and make bulk changes.
  • Smoother drag-and-drop:
  • Feel the difference when you move things around, with helpful visual cues like displaced items in List View or frictionless dragging to anywhere in your workspace—from beginning to end.
  • Improved link controls:
  • Create and manage links easily with a more intuitive link-building experience, like a streamlined UI and a shortcut for copying links.

New in WordPress 6.4.3 (Jan 31, 2024)

  • This security and maintenance release features 5 bug fixes on Core, 16 bug fixes for the Block Editor, and 2 security fixes.

New in WordPress 6.4.2 (Dec 6, 2023)

  • This minor release features 7 bug fixes in Core. The fixes include a bug fix for an issue causing stylesheet and theme directories to sometimes return incorrect results.
  • This release also features one security fix.

New in WordPress 6.4.1 (Nov 9, 2023)

  • This minor release features four bug fixes.

New in WordPress 6.4 (Nov 9, 2023)

  • Meet Twenty Twenty-Four:
  • Experience site editing at its finest with Twenty Twenty-Four. This new multi-faceted default theme has been thoughtfully crafted with three distinct use cases in mind, from writers and artists to entrepreneurs. Save time and effort with its extensive collection of over 35 templates and patterns—and unlock a world of creative possibilities with a few tweaks. Twenty Twenty-Four’s remarkable flexibility ensures an ideal fit for almost any type of site.
  • Let your writing flow:
  • New enhancements ensure your content creation journey is smooth. Find new keyboard shortcuts in List View, smarter list merging, and enhanced control over link settings. A cohesive toolbar experience for the Navigation, List, and Quote blocks lets you work efficiently with the tooling options you need.
  • The Command Palette just got better:
  • First introduced in WordPress 6.3, the Command Palette is a powerful tool to quickly find what you need, perform tasks efficiently, and speed up your building workflow. Enjoy a refreshed design and new commands to perform block-specific actions in this release.
  • Categorize and filter patterns:
  • Patterns are an excellent way to leverage the potential of blocks and simplify your site-building process. WordPress 6.4 allows you to organize them with custom categories. Plus, new advanced filtering in the Patterns section of the inserter makes finding all your patterns more intuitive.
  • Get creative with more design tools:
  • Build beautiful and functional layouts with an expanded set of design tools. Play with background images in Group blocks for unique designs and maintain image dimensions consistent with placeholder aspect ratios. Do you want to add buttons to your Navigation block? Now you can do it conveniently without a line of code.
  • Make your images stand out:
  • Enable lightbox functionality to let your site visitors enjoy full-screen, interactive images on click. Apply it globally or to specific images to customize the viewing experience.
  • Rename Group blocks:
  • Set custom names for Group blocks to organize and distinguish areas of your content easily. These names will be visible in List View.
  • Preview images in List View:
  • New previews for Gallery and Image blocks in List View let you visualize and locate where images on your content are at a glance.
  • Share patterns across sites:
  • Need to use your custom patterns on another site? Import and export them as JSON files from the Site Editor’s patterns view.
  • Introducing Block Hooks:
  • Block Hooks enables developers to automatically insert dynamic blocks at specific content locations, enriching the extensibility of block themes through plugins. While considered a developer tool, this feature is geared to respect your preferences and gives you complete control to add, dismiss, and customize auto-inserted blocks to your needs.
  • Performance wins:
  • This release includes more than 100 performance-related updates for a faster and more efficient experience. Notable enhancements focus on template loading performance for themes (including Twenty Twenty-Four), usage of the script loading strategies “defer” and “async” in core, blocks, and themes, and optimization of autoloaded options.
  • Accessibility highlights:
  • Every release is committed to making WordPress accessible to everyone. WordPress 6.4 brings several List View improvements and aria-label support for the Navigation block, among other highlights. The admin user interface includes enhancements to button placements, “Add New” menu items context, and Site Health spoken messages. Learn more about all the updates aimed at improving accessibility.
  • Other notes of interest:
  • PHP 8.1 or 8.2 are recommended for use with WordPress 6.4. Find in-depth details on PHP support in this post.
  • WordPress 6.4 disables attachment pages for new installations.

New in WordPress 6.3.2 (Oct 13, 2023)

  • Security updates included in this release:
  • Marc Montpas of Automattic for finding a potential disclosure of user email addresses.
  • Marc Montpas of Automattic for finding an RCE POP Chains vulnerability.
  • Rafie Muhammad and Edouard L of Patchstack along with a WordPress commissioned third-party audit for each independently identifying a XSS issue in the post link navigation block.
  • Jb Audras of the WordPress Security Team and Rafie Muhammad of Patchstack for each independently discovering an issue where comments on private posts could be leaked to other users.
  • John Blackbourn (WordPress Security Team), James Golovich, J.D Grimes, Numan Turle, WhiteCyberSec for each independently identifying a way for logged-in users to execute any shortcode.
  • mascara7784 and a third-party security audit for identifying a XSS vulnerability in the application password screen.
  • Jorge Costa of the WordPress Core Team for identifying XSS vulnerability in the footnotes block.
  • s5s and raouf_maklouf for independently identifying a cache poisoning DoS vulnerability.

New in WordPress 6.3.1 (Aug 30, 2023)

  • This minor release features 4 bug fixes in Core and 6 bug fixes for the block editor.

New in WordPress 6.3 (Aug 27, 2023)

  • Do everything in the Site Editor:
  • WordPress 6.3 brings your content, templates, and patterns together in the Site Editor for the first time. Add pages, browse style variations, create synced patterns, and enjoy fine-tuned control over navigation menus. Spend less time switching across different site areas—so you can focus on what matters most. Creation to completion, all in one place.
  • Preview Block themes:
  • Experience block themes before you switch and preview the Site Editor, with options to customize directly before committing to a new theme.
  • Create and sync patterns:
  • Arrange blocks and save them to the ‘My Patterns’ section for use throughout your site. You can even specify whether to sync your patterns (previously referred to as “Reusable blocks”) so that one change applies to all parts of your site. Or, utilize patterns as a starting point with the ability to customize each instance.
  • Work faster with the Command Palette:
  • Switch to a specific template or open your editor preferences with a new tool that helps you quickly access expanded functionality. With simple keyboard shortcuts (⌘+k on Mac or Ctrl+k on Windows), clicking the sidebar search icon in Site View, or clicking the Title Bar, get where you need to go and do what you need to do in seconds.
  • Sharpen your designs with new tools:
  • New design controls bring more versatility for fine-tuning, starting with the ability to customize your captions from the Styles interface without coding. You can manage your duotone filters in Styles for supported blocks and pick from the options provided by your theme or disable them entirely. The Cover block gets added settings for text color, layout controls, and border options, making this powerful block even more handy.
  • Track design changes with Style revisions:
  • With a new audit trail, you can now see how your site looked at a specific time. Visualize these revisions in a timeline and access a one-click option to restore prior styles.
  • Annotate with the Footnotes block:
  • Footnotes add convenient annotations throughout your content. Now you can add and link footnotes for any paragraph.
  • Show or hide content with the Details block:
  • Use the Details block to avoid spoiling a surprise, create an interactive Q&A section, or hide a long paragraph under a heading.
  • Performance gets a boost:
  • WordPress 6.3 has 170+ performance updates, including defer and async support for the Scripts API and fetchpriority support for images. These improvements, along with block template resolution, image lazy-loading, and the emoji loader, can dramatically improve your website’s perceived load time.
  • Accessibility remains a core focus:
  • Incorporating more than 50 accessibility improvements across the platform, WordPress 6.3 is more accessible than ever. Improved labeling, optimized tab and arrow-key navigation, revised heading hierarchy, and new controls in the admin image editor allow those using assistive technologies to navigate more easily.
  • Other highlights:
  • Set aspect ratio on images:
  • Specify your aspect ratios and ensure design integrity, especially when using images in patterns.
  • Build your site distraction-free:
  • Distraction-free designing is now available in the Site Editor.
  • Rediscover the Top Toolbar:
  • A revamped Top Toolbar offers parent selectors for nested blocks, options when selecting multiple blocks, and an interface embedded into the title bar with new functionality in mind.
  • List View improvements:
  • Drag and drop to every content layer and delete any block you would like in the updated List View.
  • Build templates with Patterns:
  • Create unique patterns to jumpstart template creation with a new modal enabling access to pattern selection.
  • Changes in PHP support:
  • Support for PHP 5 is discontinued. The new minimum supported version of PHP is 7.0.0.
  • Failed update safeguards:
  • WordPress will now auto-restore the previously installed version of plugins or themes if something goes wrong during a failed manual update.

New in WordPress 6.2.2 (May 21, 2023)

  • WordPress 6.2.2 is a rapid response release to address a regression in 6.2.1 and further patch a vulnerability addressed in 6.2.1.

New in WordPress 6.2.1 (May 17, 2023)

  • Security updates included in this release:
  • Block themes parsing shortcodes in user generated data; thanks to Liam Gladdy of WP Engine for reporting this issue
  • A CSRF issue updating attachment thumbnails; reported by John Blackbourn of the WordPress security team
  • A flaw allowing XSS via open embed auto discovery; reported independently by Jakub Żoczek of Securitum and during a third party security audit
  • Bypassing of KSES sanitization in block attributes for low privileged users; discovered during a third party security audit.
  • A path traversal issue via translation files; reported independently by Ramuel Gall and during a third party security audit.

New in WordPress 6.2 (Apr 24, 2023)

  • Manage menus in more ways with the Navigation block:
  • Add, remove, and reorder menu items faster—with a new sidebar experience that makes editing your site’s navigation easier.
  • Discover a smoother experience for the Block Inserter:
  • A refreshed design gives you easier access to the content you need. Use the Media tab to quickly drag and drop content from your existing Media Library. Find patterns faster with a split view that lets you navigate categories and see previews all at once.
  • Find the controls you want when you need them:
  • Your block settings sidebar is better organized with tabs for Settings and Styles. So the tools you need are easy to identify and access.
  • Build faster with headers and footers for block themes:
  • Discover a new collection of header and footer patterns. Use them with any block theme as a quick, high-quality starting point for your site’s templates.
  • Explore Openverse media right from the Editor:
  • Openverse’s library catalogs over 700 million+ free, openly licensed stock images and audio—and now it’s directly integrated into the WordPress experience through the Inserter.
  • Focus on writing with Distraction Free mode:
  • For those times you want to be alone with your ideas. You can now hide all your panels and controls, leaving you free to bring your content to life.
  • Meet the new Style Book:
  • Get a complete overview of how every block in your site’s library looks. All in one place, all at a glance, directly in the Site Editor.
  • Copy and paste styles:
  • Perfect the design on one type of block, then copy and paste those styles to other blocks to get just the look you want.
  • Custom CSS:
  • Power up your site any way you wish with design tools and custom CSS for another level of control over your site’s look and feel for maximum creativity and artistry in your designs.
  • Other highlights in 6.2:
  • Sticky positioning: Choose to keep top-level group blocks fixed to the top of a page as visitors scroll.
  • Importing widgets: Options to import your favorite widgets from Classic themes to Block themes.
  • Local fonts in themes: Default WordPress themes offer better privacy with Google Fonts now included.
  • Performance highlights:
  • “Dolphy” includes several impressive performance improvements. You’ll note overall faster load times for block themes of 14 to 18%, and for classic themes, speed increases of 2 to 5%. Server-side performance is also significantly boosted, with an increase of 17 to 23% for block themes and 3 to 5% for classic themes, 3 to 5%. The performance team is dedicated to these kinds of improvements. You can learn more about their work by following the Making WordPress blog using the #performance hashtag.

New in WordPress 6.1.1 (Nov 16, 2022)

  • This minor release features 29 bug fixes in Core and 21 bug fixes for the block editor. WordPress 6.1.1 is a short-cycle maintenance release. You can review a summary of the key updates in this release by reading the RC1 announcement.

New in WordPress 6.1 (Nov 16, 2022)

  • Twenty Twenty-Three:
  • A fresh default theme with 10 distinct style variations:
  • After introducing foundational elements for block themes and style variations in releases 5.9 and 6.0, WordPress site builders welcome a new default theme, Twenty Twenty-Three, that is powered by 10 different styles and tagged as “Accessibility Ready.” These intentionally unique styles ensure users can apply a different look and feel to their site with a single click—all within a single theme.
  • New templates for an improved creator experience:
  • New and more refined templates now give site builders more control over the creation of their sites. In this suite of new templates, find a custom template for posts & pages in the Site Editor. Create and edit template parts like headers and footers more quickly with a new search-and-replace tool and easily view your new site.
  • Design tools for more consistency and control:
  • Thoughtful upgrades to the controls for design elements and blocks make laying out and building your new site a more consistent, complete, and intuitive experience.
  • Manage menus with ease:
  • New fallback options in the navigation block mean you can edit the menu that’s open; no searching needed. Plus, the controls for choosing and working on menus have their own place in the block settings. The mobile menu system also gets an upgrade with new features, including different icon options, to make the menu yours.
  • Cleaner layouts and document settings visualization:
  • View and manage post and page settings with a better-organized display improving the use of features like template picker and scheduler.
  • One-click lock setting for all inner blocks:
  • When locking blocks, a new toggle lets you apply your lock settings to all the blocks in a containing block like the group, cover, and column blocks.
  • Improved block placeholders:
  • Various blocks have improved placeholders that reflect customization options to help you design your site and its content. For example, the Image block placeholder displays custom borders and duotone filters even before selecting an image.
  • Compose richer lists and quotes with inner blocks:
  • The List and Quote blocks now support inner blocks, allowing for more flexible and rich compositions like adding headings inside your Quote blocks.
  • More responsive text with fluid typography:
  • For developers working with block themes and/or theme.json, fluid typography lets you define font sizes that adapt for easy reading in any screen size.
  • Add starter patterns to any post type:
  • In WordPress 6.0, site builders could add suggested patterns so that when creating a new page, you did not have to start blank. In 6.1, site builders can continue to opt-in to this feature for not only pages but for any post type.
  • Find block themes faster:
  • The Themes Directory has a filter for block themes, and a pattern preview gives a better sense of what the theme might look like while exploring different themes and patterns.
  • Keep your Site Editor settings for later:
  • Site Editor settings are now persistent for each user. This means your settings will now be consistent across browsers and devices.
  • A streamlined style system:
  • The CSS rules for margin, padding, typography, colors, and borders within the styles engine are now all in one place, reducing time spent on layout-specific tasks and helps to generate semantic class names.
  • Updated interface options and features:
  • Updates include styling elements like buttons, citations, and links globally; controlling hover, active, and focus states for links using theme.json (not available to control in the interface yet); and customizing outline support for blocks and elements, among other features.
  • Continued evolution of layout options:
  • The default content dimensions provided by themes can now be overridden in the Styles Sidebar, giving site builders better control over full-width content. Developers have fine-grained control over these controls.
  • Block Template parts in classic themes:
  • Block template parts can now be defined in classic themes by adding the appropriate HTML files `parts` directory at the root of the theme.
  • Expanded support for Query Loop blocks:
  • New filters let Query Block variations support custom queries for more powerful variations and advanced hierarchical post types filtering options.
  • Filters for all your styles:
  • Leverage filters in the Styles sidebar to control settings at all four levels of your site—core, theme, user, or block, from less to more specific.
  • Spacing presets for faster, consistent design:
  • Save time and avoid hard-coding values into a theme with preset margin and padding values for multiple blocks.
  • Content-only editing support for container blocks:
  • Thanks to content-only editing settings, layouts can be locked within container blocks. In a content-only block, its children are invisible to the List View and entirely uneditable. So you control the layout while your writers can focus on the content. Combine it with block-locking options for even more advanced control over your blocks.
  • Other notes of interest:
  • 6.1 includes a new time-to-read feature showing content authors the approximate time-to-read values for pages, posts, and custom post types.
  • The site tagline is empty by default in new sites but can be modified in General Settings.
  • A new modal design offers a background blur effect, making it easier to focus on the task at hand.
  • Enhancing WordPress 6.1 Accessibility:
  • Accessibility is an integral part of the WordPress mission of fostering an inclusive community and supporting users of all types around the world. With this in mind, WordPress 6.1 includes nearly 60 updates specifically focused on enhancing the accessibility of the platform. Read these updates to learn more about the continual initiatives aimed at improving accessibility.
  • Improved Performance in WordPress 6.1:
  • WordPress 6.1 resolves more than 25 tickets dedicated to enhancing performance with improvements for every type of site. A full breakdown can be found in the Performance Field Guide.

New in WordPress 6.0.3 (Oct 18, 2022)

  • Security updates:
  • Stored XSS via wp-mail.php (post by email) – Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT
  • Open redirect in `wp_nonce_ays` – devrayn
  • Sender’s email address is exposed in wp-mail.php – Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT
  • Media Library – Reflected XSS via SQLi – Ben Bidner from the WordPress security team and Marc Montpas from Automattic independently discovered this issue
  • CSRF in wp-trackback.php – Simon Scannell
  • Stored XSS via the Customizer – Alex Concha from the WordPress security team
  • Revert shared user instances introduced in 50790 – Alex Concha and Ben Bidner from the WordPress security team
  • Stored XSS in WordPress Core via Comment Editing – Third-party security audit and Alex Concha from the WordPress security team
  • Data exposure via the REST Terms/Tags Endpoint – Than Taintor
  • Content from multipart emails leaked – Thomas Kräftner
  • SQL Injection due to improper sanitization in `WP_Date_Query` – Michael Mazzolini
  • RSS Widget: Stored XSS issue – Third-party security audit
  • Stored XSS in the search block – Alex Concha of the WP Security team
  • Feature Image Block: XSS issue – Third-party security audit
  • RSS Block: Stored XSS issue – Third-party security audit
  • Fix widget block XSS – Third-party security audit

New in WordPress 6.0.2 (Aug 31, 2022)

  • This security and maintenance release features 12 bug fixes on Core, 5 bug fixes for the Block Editor, and 3 security fixes.
  • Security updates included in this release:
  • FVD for finding a possible SQL injection within the Link API.
  • Khalilov Moe for finding an XSS vulnerability on the Plugins screen.
  • John Blackbourn of the WordPress security team, for finding an output escaping issue within the_meta().

New in WordPress 6.0.1 (Jul 13, 2022)

  • This maintenance release features 13 bug fixes in Core and 18 bug fixes for the Block Editor. WordPress 6.0.1 is a short-cycle maintenance release.

New in WordPress 6.0 (Jun 27, 2022)

  • Enhanced Writing Experience:
  • Writing improvements abound, whether you’re writing a brand new post or adding elements to an existing page. Explore more ways to streamline your content creation process, including:
  • Select text across multiple blocks for easier copying and pasting.
  • Type two open brackets `[[` to quickly access a list of recent posts and pages.
  • Keep existing styles when you transform some blocks from one kind to another—from a Paragraph block to a Code block, for instance.
  • Create customized buttons and any new buttons you make will retain the style customizations automatically.
  • Make tag clouds and social icons even more appealing with updated settings and controls, and a new outline style for the tag cloud.
  • Style Switching:
  • Block themes now include the option to contain multiple style variations. This expands the new Style system even further and enables shortcuts to switch the look and feel of your site all within a single theme. In block themes that support this feature, you can change both the available settings, like the font-weight, and the style options, like the default color palette. Change the look and feel of your site with just a few clicks.
  • More Template Choices:
  • WordPress 6.0 includes five new template options for block themes: author, date, categories, tag, and taxonomy. These additional templates provide greater flexibility for content creators. Tailor each with the tools you already know or with the following new options in this release:
  • Featured images can be used in the cover block.
  • New featured image sizing controls make it easier to get the results you want.
  • While editing a template, at the root, or between blocks, the quick inserter shows you patterns and template parts to help you work faster and discover new layout options.
  • The query block supports filtering on multiple authors, support for custom taxonomies, and support for customizing what is shown when there are no results.
  • Integrated Patterns:
  • Patterns will now appear when you need them in even more places, like in the quick inserter or when creating a new header or footer. If you’re a block theme author, you can even register patterns from the Pattern Directory using `theme.json`, enabling you to prioritize specific patterns that are most helpful to your theme’s users.
  • Additional Design Tools:
  • Design tools grow more powerful and intuitive with each release. Some highlights for 6.0 include:
  • A new color panel design saves space, but still shows your options at a glance.
  • New border controls offer a simpler way to set your border exactly as you like it.
  • Transparency levels for your colors allow for even more creative color options.
  • Control gaps, margins, typography, and more on a collection of blocks, all at once, in the Group block.
  • Switch between stack, row, and group variations to position groups of blocks with more layout flexibility.
  • Use the gap support functionality in the Gallery block to create different looks – from adding spacing between all images, to removing spacing altogether.
  • Better List View:
  • New keyboard shortcuts enable you to select multiple blocks from the list view, modify them in bulk, and drag and drop them within the list. List View can be opened and closed easily; it comes collapsed by default and it automatically expands to the current selection whenever you select a block.
  • Block Locking Controls:
  • Now you can lock your blocks. Choose to disable the option to move a block, remove a block, or both. This simplifies project handover, allowing your clients to unleash their creativity without worrying about accidentally breaking their site in the process.
  • Improved Performance in WordPress 6.0:
  • This release includes several updates focused on improving the performance of WordPress. These enhancements cover a range of performance areas including improving the page and post-load speed, reducing the execution time of various query types, caching, navigation menus, and much more. The performance team working group is an important focus area of the core development team. For more information on this group’s work, please follow their work on Making WordPress with the #performance hashtag.
  • Enhancing WordPress 6.0 Accessibility:
  • Accessibility is an integral part of the WordPress mission of fostering an inclusive community and supporting users of all types around the world. With this in mind, WordPress 6.0 includes more than 50 updates specifically focused on enhancing the accessibility of the platform. You can read about these updates and learn more about the accessibility initiatives that are ongoing.

New in WordPress 5.9.3 (Apr 6, 2022)

  • This maintenance release features 9 bug fixes in Core and 10 bug fixes in the block editor.

New in WordPress 5.9.2 (Mar 14, 2022)

  • This security and maintenance release features 1 bug fix in addition to 3 security fixes. Because this is a security release, it is recommended that you update your sites immediately.

New in WordPress 5.9.1 (Feb 23, 2022)

  • This maintenance release features 82 bug fixes in both Core and the block editor.

New in WordPress 5.9 (Feb 23, 2022)

  • Full site editing is here:
  • It puts you in control of your whole site, right in the WordPress Admin.
  • Say hello to Twenty Twenty-Two:
  • And say hello to the first default block theme in the history of WordPress. This is more than just a new default theme. It’s a brand-new way to work with WordPress themes.
  • Block themes put a wide array of visual choices directly in your hands, from color schemes and font combinations to page templates and image filters, all from the Site Editor. So in one place, you can give Twenty Twenty-Two the same look and feel as your organization’s other materials—or take your site’s look in another direction.
  • You already have the Twenty Twenty-Two theme—it came installed with WordPress 5.9. You will find it with your other installed themes.
  • Your personal paintbox awaits:
  • Twenty Twenty-Two is not the only theme built for full site editing. More block themes are in the Themes directory, and the number will grow.
  • When you use any of those new themes, you no longer need the Customizer. Instead, you have all the power of the Styles interface inside the Site Editor. Just as in Twenty Twenty-Two, you build your site’s look and feel there, with the tools you need for the job in a fluid interface that practically comes alive in your hands.
  • The Navigation block:
  • Blocks come to site navigation, the heart of user experience.
  • The new Navigation block gives you the power to choose: an always-on responsive menu or one that adapts to your user’s screen size. And your choices are remembered! In 5.9, the block saves menus as custom post types, which get saved to the database.
  • More improvements and updates:
  • Do you love to blog? New tweaks to the publishing flow help you say more, faster.
  • Better block controls:
  • WordPress 5.9 features new typography tools, flexible layout controls, and finer control of details like spacing, borders, and more—to help you get not just the look, but the polish that says you care about details.
  • The power of patterns:
  • The WordPress Pattern Directory is the home of a wide range of block patterns built to save you time and add to your site’s functionality. And you can edit them as you see fit. Need something different in the header or footer for your theme? Swap it out with a new one in a few clicks.
  • With a nearly full-screen view that draws you in to see fine details, the Pattern Explorer makes it easy to compare patterns and choose the one your users need.
  • A revamped List View:
  • In 5.9, the List View lets you drag and drop your content exactly where you want it. Managing complex documents is easier, too: simple controls let you expand and collapse sections as you build your site—and add HTML anchors to your blocks to help users get around the page.
  • A better Gallery block:
  • Treat every image in a Gallery Block the same way you would treat it in the Image Block.
  • Style every image in your gallery differently, or make them all the same, except for one or two. Or change the layout with drag-and-drop.

New in WordPress 5.8.3 (Jan 7, 2022)

  • Security Updates:
  • Four security issues affect WordPress versions between 3.7 and 5.8. If you haven’t yet updated to 5.8, all WordPress versions since 3.7 have also been updated to fix the following security issue (except where noted otherwise):
  • Props to Karim El Ouerghemmi and Simon Scannell of SonarSource for disclosing an issue with stored XSS through post slugs.
  • Props to Simon Scannell of SonarSource for reporting an issue with Object injection in some multisite installations.
  • Props to ngocnb and khuyenn from GiaoHangTietKiem JSC for working with Trend Micro Zero Day Initiative on reporting a SQL injection vulnerability in WP_Query.
  • Props to Ben Bidner from the WordPress security team for reporting a SQL injection vulnerability in WP_Meta_Query (only relevant to versions 4.1-5.8).

New in WordPress 5.8.2 (Nov 16, 2021)

  • This security and maintenance release features 2 bug fixes in addition to 1 security fix. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 5.2 have also been updated.

New in WordPress 5.8.1 (Sep 9, 2021)

  • This security and maintenance release features 60 bug fixes in addition to 3 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 5.4 have also been updated.

New in WordPress 5.8 (Aug 9, 2021)

  • ntroducing 5.8 “Tatum”, our latest and greatest release now available for download or update in your dashboard. Named in honor of Art Tatum, the legendary Jazz pianist. His formidable technique and willingness to push boundaries inspired musicians and changed what people thought could be done.
  • So fire up your music service of choice and enjoy Tatum’s famous recordings of ‘Tea for Two’, ‘Tiger Rag’, ‘Begin the Beguine’, and ‘Night and Day’ as you read about what the latest WordPress version brings to you.
  • Three Essential Powerhouses:
  • Manage Widgets with Blocks
  • After months of hard work, the power of blocks has come to both the Block Widgets Editor and the Customizer. Now you can add blocks both in widget areas across your site and with live preview through the Customizer. This opens up new possibilities to create content: from no-code mini layouts to the vast library of core and third-party blocks. For our developers, you can find more details in the Widgets dev note.
  • Display Posts with New Blocks and Patterns:
  • The Query Loop Block makes it possible to display posts based on specified parameters; like a PHP loop without the code. Easily display posts from a specific category, to do things like create a portfolio or a page full of your favorite recipes. Think of it as a more complex and powerful Latest Posts Block! Plus, pattern suggestions make it easier than ever to create a list of posts with the design you want.
  • Edit the Templates Around Posts:
  • You can use the familiar block editor to edit templates that hold your content—simply activate a block theme or a theme that has opted in for this feature. Switch from editing your posts to editing your pages and back again, all while using a familiar block editor. There are more than 20 new blocks available within compatible themes. Read more about this feature and how to experiment with it in the release notes.
  • Three Workflow Helpers:
  • Overview of the Page Structure:
  • Sometimes you need a simple landing page, but sometimes you need something a little more robust. As blocks increase, patterns emerge, and content creation gets easier, new solutions are needed to make complex content easy to navigate. List View is the best way to jump between layers of content and nested blocks. Since the List View gives you an overview of all the blocks in your content, you can now navigate quickly to the precise block you need. Ready to focus completely on your content? Toggle it on or off to suit your workflow.
  • Suggested Patterns for Blocks:
  • Starting in this release the Pattern Transformations tool will suggest block patterns based on the block you are using. Right now, you can give it a try in the Query Block and Social Icon Block. As more patterns are added, you will be able to get inspiration for how to style your site without ever leaving the editor!
  • Style and Colorize Images:
  • Colorize your image and cover blocks with duotone filters! Duotone can add a pop of color to your designs and style your images (or videos in the cover block) to integrate well with your themes. You can think of the duotone effect as a black and white filter, but instead of the shadows being black and the highlights being white, you pick your own colors for the shadows and highlights. There’s more to learn about how it works in the documentation.
  • For Developers to Explore:
  • Theme.json:
  • Introducing the Global Styles and Global Settings APIs: control the editor settings, available customization tools, and style blocks using a theme.json file in the active theme. This configuration file enables or disables features and sets default styles for both a website and blocks. If you build themes, you can experiment with this early iteration of a useful new feature. For more about what is currently available and how it works, check out this dev note.
  • Dropping support for IE11:
  • Support for Internet Explorer 11 has been dropped as of this release. This means you may have issues managing your site that will not be fixed in the future. If you are currently using IE11, it is strongly recommended that you switch to a more modern browser.
  • Adding support for WebP:
  • WebP is a modern image format that provides improved lossless and lossy compression for images on the web. WebP images are around 30% smaller on average than their JPEG or PNG equivalents, resulting in sites that are faster and use less bandwidth.
  • Adding Additional Block Supports:
  • Expanding on previously implemented block supports in WordPress 5.6 and 5.7, WordPress 5.8 introduces several new block support flags and new options to customize your registered blocks. More information is available in the block supports dev note.
  • Check the Field Guide for more!
  • Check out the latest version of the WordPress Field Guide. It highlights developer notes for each change you may want to be aware of: WordPress 5.8 Field Guide.

New in WordPress 5.7.2 (May 13, 2021)

  • Security Updates:
  • One security issue affecting WordPress versions between 3.7 and 5.7. If you haven’t yet updated to 5.7, all WordPress versions since 3.7 have also been updated to fix the following security issue:
  • Object injection in PHPMailer, CVE-2020-36326 and CVE-2018-19296.

New in WordPress 5.7.1 (Apr 16, 2021)

  • This security and maintenance release features 26 bug fixes in addition to two security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 4.7 have also been updated.
  • WordPress 5.7.1 is a short-cycle security and maintenance release. The next major release will be version 5.8.
  • You can download WordPress 5.7.1 by downloading from WordPress.org, or visit your Dashboard → Updates and click Update Now.
  • If you have sites that support automatic background updates, they’ve already started the update process.
  • Security Updates:
  • Two security issues affect WordPress versions between 4.7 and 5.7. If you haven’t yet updated to 5.7, all WordPress versions since 4.7 have also been updated to fix the following security issues:
  • Thank you SonarSource for reporting an XXE vulnerability within the media library affecting PHP 8.
  • Thanks Mikael Korpela for reporting a data exposure vulnerability within the REST API.

New in WordPress 5.7 (Apr 16, 2021)

  • Meet “Esperanza”, the first WordPress release of 2021. “Esperanza” is named in honor of Esperanza Spalding, a modern musical prodigy. Her path as a musician is varied and inspiring—learn more about her and give her music a listen!
  • With this new version, WordPress brings you fresh colors. The editor helps you work in a few places you couldn’t before without getting into code or hiring a pro. The controls you use most are right where you need them. Layout changes that should be simple, are even simpler to make.
  • Now the new editor is easier to use
  • Font-size adjustment in more places: now, font-size controls are right where you need them in the List and Code blocks. No more trekking to another screen to make that single change!
  • Reusable blocks: several enhancements make reusable blocks more stable and easier to use. And now they save automatically with the post when you click the Update button.
  • Inserter drag-and-drop: drag blocks and block patterns from the inserter right into your post.
  • You can do more without writing custom code:
  • Full-height alignment: have you ever wanted to make a block, like the Cover block, fill the whole window? Now you can.
  • Buttons block: now you can choose a vertical or a horizontal layout. And you can set the width of a button to a preset percentage.
  • Social Icons block: now you can change the size of the icons.
  • A simpler default color palette:
  • This new streamlined color palette collapses all the colors that used to be in the WordPress source code down to seven core colors and a range of 56 shades that meet the WCAG 2.0 AA recommended contrast ratio against white or black.
  • Find the new palette in the default WordPress Dashboard color scheme, and use it when you’re building themes, plugins, or any other components. For all the details, check out the Color Palette dev note.
  • From HTTP to HTTPS in a single click:
  • Starting now, switching a site from HTTP to HTTPS is a one-click move. WordPress will automatically update database URLs when you make the switch. No more hunting and guessing!
  • New Robots API:
  • The new Robots API lets you include the filter directives in the robots meta tag, and the API includes the max-image-preview: large directive by default. That means search engines can show bigger image previews, which can boost your traffic (unless the site is marked not-public).
  • Lazy-load your iFrames:
  • Now it’s simple to let iframes lazy-load. By default, WordPress will add a loading="lazy" attribute to iframe tags when both width and height are specified.
  • Ongoing cleanup after update to jQuery 3.5.1:
  • For years jQuery helped make things move on the screen in ways the basic tools couldn’t—but that keeps changing, and so does jQuery.
  • In 5.7, jQuery gets more focused and less intrusive, with fewer messages in the console.

New in WordPress 5.6.2 (Feb 23, 2021)

  • This maintenance release includes 5 bug fixes.

New in WordPress 5.6.1 (Feb 4, 2021)

  • This maintenance release features 20 bug fixes as well as 7 issues fixed for the block editor. These bugs affect WordPress version 5.6, so you’ll want to upgrade.

New in WordPress 5.5.3 (Nov 1, 2020)

  • This maintenance release fixes an issue introduced in WordPress 5.5.2 which makes it impossible to install WordPress on a brand new website that does not have a database connection configured. This release does not affect sites where a database connection is already configured, for example, via one-click installers or an existing wp-config.php file.

New in WordPress 5.5.2 (Oct 30, 2020)

  • WordPress 5.5.2 is now available:
  • This security and maintenance release features 14 bug fixes in addition to 10 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.
  • WordPress 5.5.2 is a short-cycle security and maintenance release. The next major release will be version 5.6.
  • You can download WordPress 5.5.2 by downloading from WordPress.org, or visit your Dashboard → Updates and click Update Now.
  • If you have sites that support automatic background updates, they’ve already started the update process.
  • Security Updates:
  • Ten security issues affect WordPress versions 5.5.1 and earlier. If you haven’t yet updated to 5.5, all WordPress versions since 3.7 have also been updated to fix the following security issues:
  • Props to Alex Concha of the WordPress Security Team for their work in hardening deserialization requests.
  • Props to David Binovec on a fix to disable spam embeds from disabled sites on a multisite network.
  • Thanks to Marc Montas from Sucuri for reporting an issue that could lead to XSS from global variables.
  • Thanks to Justin Tran who reported an issue surrounding privilege escalation in XML-RPC. He also found and disclosed an issue around privilege escalation around post commenting via XML-RPC.
  • Props to Omar Ganiev who reported a method where a DoS attack could lead to RCE.
  • Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs.
  • Thanks to Slavco for reporting, and confirmation from Karim El Ouerghemmi, a method to bypass protected meta that could lead to arbitrary file deletion.
  • Thanks to Erwan LR from WPScan who responsibly disclosed a method that could lead to CSRF.
  • And a special thanks to @zieladam who was integral in many of the releases and patches during this release.

New in WordPress 5.5.1 (Sep 2, 2020)

  • This maintenance release features 34 bug fixes, 5 enhancements, and 5 bug fixes for the block editor.

New in WordPress 5.5 (Sep 2, 2020)

  • Speed:
  • Posts and pages feel faster, thanks to lazy-loaded images.
  • Images give your story a lot of impact, but they can sometimes make your site seem slow.
  • In WordPress 5.5, images wait to load until they’re just about to scroll into view. The technical term is ‘lazy loading.’
  • On mobile, lazy loading can also keep browsers from loading files meant for other devices. That can save your readers money on data — and help preserve battery life.
  • Search:
  • Say hello to your new sitemap.
  • WordPress sites work well with search engines.
  • Now, by default, WordPress 5.5 includes an XML sitemap that helps search engines discover your most important pages from the very minute you go live.
  • So more people will find your site sooner, giving you more time to engage, retain and convert them to subscribers, customers or whatever fits your definition of success.
  • Accessibility:
  • Every release adds improvements to the accessible publishing experience, and that remains true for WordPress 5.5.
  • Now you can copy links in media screens and modal dialogs with a button, instead of trying to highlight a line of text.
  • You can also move meta boxes with the keyboard, and edit images in WordPress with your assistive device, as it can read you the instructions in the image editor.

New in WordPress 5.4.2 (Jun 11, 2020)

  • This security and maintenance release features 23 fixes and enhancements. Plus, it adds a number of security fixes—see the list below.
  • These bugs affect WordPress versions 5.4.1 and earlier; version 5.4.2 fixes them, so you’ll want to upgrade.
  • If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the bugs for you.
  • Security Updates:
  • WordPress versions 5.4 and earlier are affected by the following bugs, which are fixed in version 5.4.2. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues:
  • Props to Sam Thomas (jazzy2fives) for finding an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor.
  • Props to Luigi – (gubello.me) for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files.
  • Props to Ben Bidner of the WordPress Security Team for finding an open redirect issue in wp_validate_redirect().
  • Props to Nrimo Ing Pandum for finding an authenticated XSS issue via theme uploads.
  • Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation.
  • Props to Carolina Nymark for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.

New in WordPress 5.4.1 (Apr 30, 2020)

  • This security and maintenance release features 17 bug fixes in addition to 7 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.
  • WordPress 5.4.1 is a short-cycle security and maintenance release. The next major release will be version 5.5.
  • You can download WordPress 5.4.1 by downloading from WordPress.org, or visit your Dashboard → Updates and click Update Now.
  • If you have sites that support automatic background updates, they’ve already started the update process.
  • Security Updates:
  • Seven security issues affect WordPress versions 5.4 and earlier. If you haven’t yet updated to 5.4, all WordPress versions since 3.7 have also been updated to fix the following security issues:
  • Props to Muaz Bin Abdus Sattar and Jannes who both independently reported an issue where password reset tokens were not properly invalidated
  • Props to ka1n4t for finding an issue where certain private posts can be viewed unauthenticated
  • Props to Evan Ricafort for discovering an XSS issue in the Customizer
  • Props to Ben Bidner from the WordPress Security Team who discovered an XSS issue in the search block
  • Props to Nick Daugherty from WordPress VIP / WordPress Security Team who discovered an XSS issue in wp-object-cache
  • Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who independently reported an XSS issue in file uploads.
  • Props to Weston Ruter for fixing a stored XSS vulnerability in the WordPress customizer.
  • Additionally, an authenticated XSS issue in the block editor was discovered by Nguyen the Duc in WordPress 5.4 RC1 and RC2. It was fixed in 5.4 RC5. We wanted to be sure to give credit and thank them for all of their work in making WordPress more secure.

New in WordPress 5.4 (Apr 3, 2020)

  • Every major release adds more to the block editor:
  • More ways to make posts and pages come alive with your best images. More ways to bring your visitors in, and keep them engaged, with the richness of embedded media from the web’s top services.
  • More ways to make your vision real, and put blocks in the perfect place—even if a particular kind of block is new to you. More efficient processes.
  • And more speed everywhere, so as you build sections or galleries, or just type in a line of prose, you can feel how much faster your work flows.
  • Two new blocks. And better blocks overall:
  • Two brand-new blocks: Social Icons and Buttons make adding interactive features fast and easy.
  • New ways with color: Gradients in the Buttons and Cover block, toolbar access to color options in Rich Text blocks, and for the first time, color options in the Group and Columns blocks.
  • Guess a whole lot less! Version 5.4 streamlines the whole process for placing and replacing multimedia in every block. Now it works the same way in almost every block!
  • And if you’ve ever thought your image in the Media+Text block should link to something else—perhaps a picture of a brochure should download that brochure as a document? Well, now it can.
  • WordPress.org
  • Search WordPress.org for:
  • Showcase
  • Themes
  • Plugins
  • Mobile
  • Support
  • Documentation
  • Forums
  • Get Involved
  • Five for the Future
  • About
  • Blog
  • Hosting
  • Get WordPress
  • WordPress 5.4 “Adderley”
  • Posted March 31, 2020 by Matt Mullenweg. Filed under Releases.
  • Here it is! Named “Adderley” in honor of Nat Adderley, the latest and greatest version of WordPress is available for download or update in your dashboard.
  • Say hello to more and better.
  • More ways to make your pages come alive. With easier ways to get it all done and looking better than ever—and boosts in speed you can feel.
  • Welcome to WordPress 5.4
  • Every major release adds more to the block editor.
  • More ways to make posts and pages come alive with your best images. More ways to bring your visitors in, and keep them engaged, with the richness of embedded media from the web’s top services.
  • More ways to make your vision real, and put blocks in the perfect place—even if a particular kind of block is new to you. More efficient processes.
  • And more speed everywhere, so as you build sections or galleries, or just type in a line of prose, you can feel how much faster your work flows.
  • Two new blocks. And better blocks overall.
  • Two brand-new blocks: Social Icons and Buttons make adding interactive features fast and easy.
  • New ways with color: Gradients in the Buttons and Cover block, toolbar access to color options in Rich Text blocks, and for the first time, color options in the Group and Columns blocks.
  • Guess a whole lot less! Version 5.4 streamlines the whole process for placing and replacing multimedia in every block. Now it works the same way in almost every block!
  • And if you’ve ever thought your image in the Media+Text block should link to something else—perhaps a picture of a brochure should download that brochure as a document? Well, now it can.
  • Cleaner UI, clearer navigation—and easier tabbing:
  • Clearer block navigation with block breadcrumbs. And easier selection once you get there.
  • For when you need to navigate with the keyboard, better tabbing and focus. Plus, you can tab over to the sidebar of nearly any block.
  • Speed! 14% faster loading of the editor, 51% faster time-to-type!
  • Tips are gone. In their place, a Welcome Guide window you can bring up when you need it—and only when you need it—again and again.
  • Know at a glance whether you’re in a block’s Edit or Navigation mode. Or, if you have restricted vision, your screen reader will tell you which mode you’re in.
  • Your fundamental right: privacy:
  • 5.4 helps with a variety of privacy issues around the world. So when users and stakeholders ask about regulatory compliance, or how your team handles user data, the answers should be a lot easier to get right.
  • Take a look:
  • Now personal data exports include users session information and users location data from the community events widget. Plus, a table of contents!
  • See progress as you process export and erasure requests through the privacy tools.
  • Plus, little enhancements throughout give the privacy tools a little cleaner look. Your eyes will thank you!
  • Just for developers:
  • Add custom fields to menu items—natively:
  • Two new actions let you add custom fields to menu items—without a plugin and without writing custom walkers.
  • On the Menus admin screen, wp_nav_menu_item_custom_fields fires just before the move buttons of a nav menu item in the menu editor.
  • In the Customizer, wp_nav_menu_item_custom_fields_customize_template fires at the end of the menu-items form-fields template.
  • Check your code and see where these new actions can replace your custom code, and if you’re concerned about duplication, add a check for the WordPress version.
  • Blocks! Simpler styling, new APIs and embeds:
  • Radically simpler block styling. Negative margins and default padding are gone! Now you can style blocks the way you need them. And, a refactor got rid of four redundant wrapper divs.
  • If you build plugins, now you can register collections of your blocks by namespace across categories—a great way to get more brand visibility.
  • Let users do more with two new APIs: block variations and gradients.
  • In embeds, now the block editor supports TikTok—and CollegeHumor is gone.

New in WordPress 5.3.2 (Dec 19, 2019)

  • Main issues addressed in 5.3.2:
  • Date/Time: Ensure that get_feed_build_date() correctly handles a modified post object with invalid date.
  • Uploads: Fix file name collision in wp_unique_filename() when uploading a file with upper case extension on non case-sensitive file systems.
  • Media: Fix PHP warnings in wp_unique_filename() when the destination directory is unreadable.
  • Administration: Fix the colors in all color schemes for buttons with the .active class.
  • Posts, Post Types: In wp_insert_post(), when checking the post date to set future or publish status, use a proper delta comparison.

New in WordPress 5.3.1 (Dec 13, 2019)

  • This security and maintenance release features 46 fixes and enhancements. Plus, it adds a number of security fixes—see the list below.
  • WordPress 5.3.1 is a short-cycle maintenance release. The next major release will be version 5.4.
  • You can download WordPress 5.3.1 by clicking the button at the top of this page, or visit your Dashboard → Updates and click Update Now.
  • If you have sites that support automatic background updates, they’ve already started the update process.
  • Security updates:
  • Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.
  • Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
  • Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links.
  • Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.
  • Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.
  • Maintenance updates:
  • Here are a few of the highlights:
  • Administration: improvements to admin form controls height and alignment standardization (see related dev note), dashboard widget links accessibility and alternate color scheme readability issues (see related dev note).
  • Block editor: fix Edge scrolling issues and intermittent JavaScript issues.
  • Bundled themes: add customizer option to show/hide author bio, replace JS based smooth scroll with CSS (see related dev note) and fix Instagram embed CSS.
  • Date/time: improve non-GMT dates calculation, fix date format output in specific languages and make get_permalink() more resilient against PHP timezone changes.
  • Embeds: remove CollegeHumor oEmbed provider as the service doesn’t exist anymore.
  • External libraries: update sodium_compat.
  • Site health: allow the remind interval for the admin email verification to be filtered.
  • Uploads: avoid thumbnails overwriting other uploads when filename matches, and exclude PNG images from scaling after upload.
  • Users: ensure administration email verification uses the user’s locale instead of the site locale.

New in WordPress 5.3 (Nov 14, 2019)

  • 5.3 expands and refines the block editor with more intuitive interactions and improved accessibility. New features in the editor increase design freedoms, provide additional layout options and style variations to allow designers more control over the look of a site.
  • This release also introduces the Twenty Twenty theme giving the user more design flexibility and integration with the block editor. Creating beautiful web pages and advanced layouts has never been easier.
  • Block Editor Improvements:
  • This enhancement-focused update introduces over 150 new features and usability improvements, including improved large image support for uploading non-optimized, high-resolution pictures taken from your smartphone or other high-quality cameras. Combined with larger default image sizes, pictures always look their best.
  • Accessibility improvements include the integration of block editor styles in the admin interface. These improved styles fix many accessibility issues: color contrast on form fields and buttons, consistency between editor and admin interfaces, new snackbar notices, standardizing to the default WordPress color scheme, and the introduction of Motion to make interacting with your blocks feel swift and natural.
  • For people who use a keyboard to navigate the dashboard, the block editor now has a Navigation mode. This lets you jump from block to block without tabbing through every part of the block controls.
  • Expanded Design Flexibility:
  • WordPress 5.3 adds even more robust tools for creating amazing designs:
  • The new Group block lets you easily divide your page into colorful sections.
  • The Columns block now supports fixed column widths.
  • The new predefined layouts make it a cinch to arrange content into advanced designs.
  • Heading blocks now offer controls for text and background color.
  • Additional style options allow you to set your preferred style for any block that supports this feature.
  • Introducing Twenty Twenty:
  • As the block editor celebrates its first birthday, we are proud that Twenty Twenty is designed with flexibility at its core. Show off your services or products with a combination of columns, groups, and media blocks. Set your content to wide or full alignment for dynamic and engaging layouts. Or let your thoughts be the star with a centered content column!
  • As befits a theme called Twenty Twenty, clarity and readability is also a big focus. The theme includes the typeface Inter, designed by Rasmus Andersson. Inter comes in a Variable Font version, a first for default themes, which keeps load times short by containing all weights and styles of Inter in just two font files.
  • Improvements for Everyone:
  • Automatic Image Rotation:
  • Your images will be correctly rotated upon upload according to the embedded orientation data. This feature was first proposed nine years ago and made possible through the perseverance of many dedicated contributors.
  • Improved Site Health Checks:
  • The improvements introduced in 5.3 make it even easier to identify issues. Expanded recommendations highlight areas that may need troubleshooting on your site from the Health Check screen.
  • Admin Email Verification:
  • You’ll now be periodically asked to confirm that your admin email address is up to date when you log in as an administrator. This reduces the chance of getting locked out of your site if you change your email address.
  • WordPress.org
  • Search WordPress.org for:
  • Showcase
  • Themes
  • Plugins
  • Mobile
  • Support
  • Documentation
  • Forums
  • Get Involved
  • Five for the Future
  • About
  • Blog
  • Hosting
  • Get WordPress
  • WordPress 5.3 “Kirk”
  • Posted November 12, 2019 by Matt Mullenweg. Filed under Releases.
  • Album cover for WordPress 5.3 Kirk, showcasing a duotone red/cream Rahsaan Roland Kirk playing the saxophone on a red background.
  • Introducing our most refined user experience with the improved block editor in WordPress 5.3! Named “Kirk” in honour of jazz multi-instrumentalist Rahsaan Roland Kirk, the latest and greatest version of WordPress is available for download or update in your dashboard.
  • 5.3 expands and refines the block editor with more intuitive interactions and improved accessibility. New features in the editor increase design freedoms, provide additional layout options and style variations to allow designers more control over the look of a site.
  • This release also introduces the Twenty Twenty theme giving the user more design flexibility and integration with the block editor. Creating beautiful web pages and advanced layouts has never been easier.
  • Block Editor Improvements
  • This enhancement-focused update introduces over 150 new features and usability improvements, including improved large image support for uploading non-optimized, high-resolution pictures taken from your smartphone or other high-quality cameras. Combined with larger default image sizes, pictures always look their best.
  • Accessibility improvements include the integration of block editor styles in the admin interface. These improved styles fix many accessibility issues: color contrast on form fields and buttons, consistency between editor and admin interfaces, new snackbar notices, standardizing to the default WordPress color scheme, and the introduction of Motion to make interacting with your blocks feel swift and natural.
  • For people who use a keyboard to navigate the dashboard, the block editor now has a Navigation mode. This lets you jump from block to block without tabbing through every part of the block controls.
  • Expanded Design Flexibility
  • WordPress 5.3 adds even more robust tools for creating amazing designs.
  • The new Group block lets you easily divide your page into colorful sections.
  • The Columns block now supports fixed column widths.
  • The new predefined layouts make it a cinch to arrange content into advanced designs.
  • Heading blocks now offer controls for text and background color.
  • Additional style options allow you to set your preferred style for any block that supports this feature.
  • Introducing Twenty Twenty
  • A desktop preview of the Twenty Twenty theme, showing both the front-end and the editor view.
  • A mobile image of the Twenty Twenty theme, over a decorative backgorund of brown-grey bars.
  • As the block editor celebrates its first birthday, we are proud that Twenty Twenty is designed with flexibility at its core. Show off your services or products with a combination of columns, groups, and media blocks. Set your content to wide or full alignment for dynamic and engaging layouts. Or let your thoughts be the star with a centered content column!
  • As befits a theme called Twenty Twenty, clarity and readability is also a big focus. The theme includes the typeface Inter, designed by Rasmus Andersson. Inter comes in a Variable Font version, a first for default themes, which keeps load times short by containing all weights and styles of Inter in just two font files.
  • Improvements for Everyone
  • An icon showing an arrow rotating a square.
  • Automatic Image Rotation
  • Your images will be correctly rotated upon upload according to the embedded orientation data. This feature was first proposed nine years ago and made possible through the perseverance of many dedicated contributors.
  • A plus in a square, indicating health.
  • Improved Site Health Checks
  • The improvements introduced in 5.3 make it even easier to identify issues. Expanded recommendations highlight areas that may need troubleshooting on your site from the Health Check screen.
  • A email icon.
  • Admin Email Verification
  • You’ll now be periodically asked to confirm that your admin email address is up to date when you log in as an administrator. This reduces the chance of getting locked out of your site if you change your email address.
  • For Developers:
  • Date/Time Component Fixes:
  • Developers can now work with dates and timezones in a more reliable way. Date and time functionality has received a number of new API functions for unified timezone retrieval and PHP interoperability, as well as many bug fixes.
  • PHP 7.4 Compatibility:
  • WordPress 5.3 aims to fully support PHP 7.4. This release contains multiple changes to remove deprecated functionality and ensure compatibility. WordPress continues to encourage all users to run the latest and greatest versions of PHP.

New in WordPress 5.2.4 (Oct 15, 2019)

  • WordPress 5.2.4 is now available! This security release fixes 6 security issues.
  • WordPress versions 5.2.3 and earlier are affected by these bugs, which are fixed in version 5.2.4. Updated versions of WordPress 5.1 and earlier are also available for any users who have not yet updated to 5.2.
  • Security Updates:
  • Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting) could be added via the Customizer.
  • Props to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.
  • Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript into style tags.
  • Props to David Newman for highlighting a method to poison the cache of JSON GET requests via the Vary: Origin header.
  • Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs are validated.
  • Props to Ben Bidner of the WordPress Security Team who discovered issues related to referrer validation in the admin.

New in WordPress 5.2.3 (Sep 5, 2019)

  • This security and maintenance release features 29 fixes and enhancements. Plus, it adds a number of security fixes—see the list below.
  • These bugs affect WordPress versions 5.2.2 and earlier; version 5.2.3 fixes them, so you’ll want to upgrade.
  • If you haven’t yet updated to 5.2, there are also updated versions of 5.0 and earlier that fix the bugs for you.
  • Security Updates:
  • Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments.
  • Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.
  • Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.
  • Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting (XSS) in shortcode previews.
  • Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard.
  • Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.
  • In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.

New in WordPress 5.2.2 (Jun 19, 2019)

  • This maintenance release fixes 13 bugs and adds a little bit of polish to the Site Health feature that made its debut in 5.2.

New in WordPress 5.2.1 (May 22, 2019)

  • This maintenance release fixes 33 bugs, including improvements to the block editor, accessibility, internationalization, and the Site Health feature introduced in 5.2.

New in WordPress 5.2 (May 8, 2019)

  • Version 5.2 of WordPress, named “Jaco” in honor of renowned and revolutionary jazz bassist Jaco Pastorius, is available for download or update in your WordPress dashboard. New features in this update make it easier than ever to fix your site if something goes wrong.
  • There are even more robust tools for identifying and fixing configuration issues and fatal errors. Whether you are a developer helping clients or you manage your site solo, these tools can help get you the right information when you need it.
  • Site Health Check:
  • Building on the Site Health features introduced in 5.1, this release adds two new pages to help debug common configuration issues. It also adds space where developers can include debugging information for site maintainers.
  • PHP Error Protection:
  • This administrator-focused update will let you safely fix or manage fatal errors without requiring developer time. It features better handling of the so-called “white screen of death,” and a way to enter recovery mode, which pauses error-causing plugins or themes.
  • Improvements for Everyone:
  • Accessibility Updates:
  • A number of changes work together to improve contextual awareness and keyboard navigation flow for those using screen readers and other assistive technologies.
  • New Dashboard Icons:
  • Thirteen new icons including Instagram, a suite of icons for BuddyPress, and rotated Earth icons for global inclusion. Find them in the Dashboard and have some fun!
  • Plugin Compatibility Checks:
  • WordPress will now automatically determine if your site’s version of PHP is compatible with installed plugins. If the plugin requires a higher version of PHP than your site currently uses, WordPress will not allow you to activate it, preventing potential compatibility errors.
  • Developer Happiness:
  • PHP Version Bump:
  • The minimum supported PHP version is now 5.6.20. As of WordPress 5.2*, themes and plugins can safely take advantage of namespaces, anonymous functions, and more!
  • Privacy Updates:
  • A new theme page template, a conditional function, and two CSS classes make designing and customizing the Privacy Policy page easier.
  • New Body Hook:
  • 5.2 introduces a wp_body_open hook, which lets themes support injecting code right at the beginning of the element.
  • Building JavaScript:
  • With the addition of webpack and Babel configurations in the wordpress/scripts package, developers won’t have to worry about setting up complex build tools to write modern JavaScript.

New in WordPress 5.1.1 (Mar 13, 2019)

  • This security and maintenance release introduces 10 fixes and enhancements, including changes designed to help hosts prepare users for the minimum PHP version bump coming in 5.2.
  • This release also includes a pair of security fixes that handle how comments are filtered and then stored in the database. With a maliciously crafted comment, a WordPress post was vulnerable to cross-site scripting.
  • WordPress versions 5.1 and earlier are affected by these bugs, which are fixed in version 5.1.1. Updated versions of WordPress 5.0 and earlier are also available for any users who have not yet updated to 5.1.
  • Props to Simon Scannell of RIPS Technologies who discovered this flaw independent of some work that was being done by members of the core security team. Thank you to all of the reporters for privately disclosing the vulnerabilities, which gave us time to fix them before WordPress sites could be attacked.
  • Other highlights of this release include:
  • Hosts can now offer a button for their users to update PHP.
  • The recommended PHP version used by the “Update PHP” notice can now be filtered.
  • Several minor bug fixes.

New in WordPress 5.1 (Feb 22, 2019)

  • Site Health:
  • With security and speed in mind, this release introduces WordPress’s first Site Health features. WordPress will start showing notices to administrators of sites that run long-outdated versions of PHP, which is the programming language that powers WordPress.
  • When you install new plugins, WordPress’s Site Health features will check them against the version of PHP you’re running. If the plugin requires a version that won’t work with your site, WordPress will keep you from installing that plugin.
  • Editor Performance:
  • Introduced in WordPress 5.0, the new block editor continues to improve. Most significantly, WordPress 5.1 includes solid performance improvements within the editor. The editor should feel a little quicker to start, and typing should feel smoother.
  • Expect more performance improvements in the next couple of releases.
  • Developer Happiness:
  • Multisite Metadata:
  • 5.1 introduces a new database table to store metadata associated with sites and allows for the storage of arbitrary site data relevant in a multisite / network context.
  • Cron API:
  • The Cron API has been updated with new functions to assist with returning data and includes new filters for modifying cron storage. Other changes in behavior affect cron spawning on servers running FastCGI and PHP-FPM versions 7.0.16 and above.
  • New JS Build Processes:
  • WordPress 5.1 features a new JavaScript build option, following the large reorganisation of code that started in the 5.0 release.
  • Other Developer Goodness:
  • Miscellaneous improvements include:
  • Updates to values for the WP_DEBUG_LOG constant
  • New test config file constant in the test suite, new plugin action hooks
  • Short-circuit filters for wp_unique_post_slug(), WP_User_Query, and count_users()
  • A new human_readable_duration function
  • Improved taxonomy metabox sanitization
  • Limited LIKE support for meta keys when using WP_Meta_Query
  • A new “doing it wrong” notice when registering REST API endpoints

New in WordPress 5.0.3 (Jan 10, 2019)

  • 15 block editor related bug fixes and improvements have been added to bundled themes. Make sure to update these for an improved block editing experience.
  • 2 block editor related internationalization (I18N) bugs have been fixed
  • Users with JavaScript disabled now see a notice when attempting to use the block editor.
  • A few PHP errors in the Customizer have been fixed.
  • Some issues uploading common file types, like CSVs, have been fixed.

New in WordPress 5.0.2 (Dec 20, 2018)

  • 5.0.2 is a maintenance release that addresses 73 bugs. The primary focus of this release was performance improvements in the block editor: the cumulated performance gains make it 330% faster for a post with 200 blocks.
  • Here are a few of the additional highlights:
  • 45 total Block Editor improvements are included (14 performance enhancements & 31 bug fixes).
  • 17 Block Editor related bugs have been fixed across all of the bundled themes.
  • Some internationalization (i18n) issues related to script loading have also been fixed.

New in WordPress 5.0.1 (Dec 13, 2018)

  • WordPress 5.0.1 is now available. This is a security release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately.
  • Plugin authors are encouraged to read the 5.0.1 developer notes for information on backwards-compatibility.
  • WordPress versions 5.0 and earlier are affected by the following bugs, which are fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are also available, for users who have not yet updated to 5.0:
  • Karim El Ouerghemmi discovered that authors could alter meta data to delete files that they weren’t authorized to.
  • Simon Scannell of RIPS Technologies discovered that authors could create posts of unauthorized post types with specially crafted input.
  • Sam Thomas discovered that contributors could craft meta data in a way that resulted in PHP object injection.
  • Tim Coen discovered that contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting vulnerability.
  • Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances. WordPress itself was not affected, but plugins could be in some situations.
  • Team Yoast discovered that the user activation screen could be indexed by search engines in some uncommon configurations, leading to exposure of email addresses, and in some rare cases, default generated passwords.
  • Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload specifically crafted files that bypass MIME verification, leading to a cross-site scripting vulnerability.

New in WordPress 5.0 (Dec 13, 2018)

  • We’ve made some big upgrades to the editor. Our new block-based editor is the first step toward an exciting new future with a streamlined editing experience across your site. You’ll have more flexibility with how content is displayed, whether you are building your first site, revamping your blog, or write code for a living.
  • Building with Blocks:
  • The new block-based editor won’t change the way any of your content looks to your visitors. What it will do is let you insert any type of multimedia in a snap and rearrange to your heart’s content. Each piece of content will be in its own block; a distinct wrapper for easy maneuvering. If you’re more of an HTML and CSS sort of person, then the blocks won’t stand in your way. WordPress is here to simplify the process, not the outcome.
  • We have tons of blocks available by default, and more get added by the community every day. Here are a few of the blocks to help you get started:
  • Paragraph
  • Heading
  • Preformatted
  • Quote
  • Image
  • Gallery
  • Cover
  • Video
  • Audio
  • Columns
  • File
  • Code
  • List
  • Button
  • Embeds
  • More
  • Freedom to Build, Freedom to Write:
  • This new editing experience provides a more consistent treatment of design as well as content. If you’re building client sites, you can create reusable blocks. This lets your clients add new content anytime, while still maintaining a consistent look and feel.
  • A Stunning New Default Theme:
  • Introducing Twenty Nineteen, a new default theme that shows off the power of the new editor.
  • Designed for the block editor:
  • Twenty Nineteen features custom styles for the blocks available by default in 5.0. It makes extensive use of editor styles throughout the theme. That way, what you create in your content editor is what you see on the front of your site.
  • Simple, type-driven layout:
  • Featuring ample whitespace, and modern sans-serif headlines paired with classic serif body text, Twenty Nineteen is built to be beautiful on the go. It uses system fonts to increase loading speed. No more long waits on slow networks!
  • Versatile design for all sites:
  • Twenty Nineteen is designed to work for a wide variety of use cases. Whether you’re running a photo blog, launching a new business, or supporting a non-profit, Twenty Nineteen is flexible enough to fit your needs.

New in WordPress 4.9.8 (Aug 3, 2018)

  • “Try Gutenberg” callout:
  • Most users will now be presented with a notice in their WordPress dashboard. This “Try Gutenberg” is an opportunity for users to use the Gutenberg block editor before it is released in WordPress 5.0.
  • Privacy fixes/enhancements:
  • The type of request being confirmed is now included in the subject line for all privacy confirmation emails.
  • Improved consistency with site name being used for privacy emails in multisite.
  • Pagination for Privacy request admin screens can now be adjusted.
  • Increased the test coverage for several core privacy functions.
  • Administration:
  • #44611 – try Gutenberg header wraps over text below on narrow screens
  • #44627 – minor tweaks to Try Gutenberg callout formatting
  • Bundled Theme:
  • #44109 – TwentySeventeen backend editor: level 2 bulleted lists nested under numbered lists show numbers instead of bullets
  • #44646 – Bundled Themes: Bump version number and update changelog in Twenty Seventeen for 4.9.8 release
  • Comments:
  • #44126 – Adding fields to comments_form args prevents checkbox displaying
  • #44141 – Privacy: Don’t replace comment author URL and email with anything
  • #44342 – Commenter cookie consent message should not be displayed if the cookie action isn’t hooked
  • Customize:
  • #44627 – minor tweaks to Try Gutenberg callout formatting
  • Editor:
  • #41316 – Introduce “Try Gutenberg” callout
  • #44341 – Replace _deprecated_function( ‘add_filter’ ) with apply_filters_deprecated()
  • #44680 – Restrict the Try Gutenberg callout audience
  • Emoji:
  • #44339 – minor tweaks to Try Gutenberg callout formatting
  • Filesystem API:
  • #43054 – wp_is_stream fails with stream definition containing nonascii chars
  • I18N:
  • #44139 – i18n: “About” disambiguation
  • #44574 – Saratov and other cities missing from translations
  • Login and Registration:
  • #44052 – Missing parameter type for `login_header()`
  • Media:
  • #44532 – Extreme memory leak related to wp_is_stream in wp-includes/functions.php in WordPress 4.9.7
  • #43751 – REST API: Attachments controller should respect “Max upload file size” and “Site upload space” in multisite
  • Options, Meta APIs:
  • #38323 – Reconsider $object_subtype handling in `register_meta()`
  • Posts, Post Types:
  • #36085 – Add action hook to get_inline_data()
  • Privacy:
  • #44006 – Privacy Policy page should have suffix like other special pages
  • #44025 – Privacy: Pagination screen options for the requests list tables
  • #44099 – Add Request Type into Admin Email Subject for GDPR
  • #44100 – GDPR Privacy Page setting allows for Draft Pages
  • #44130 – Mixed Case of Privacy Policy on Privacy Settings page
  • #44131 – If draft page selected for Privacy Policy page should verbiage change from view to preview
  • #44181 – The input field id username_or_email_to_export should be something else on remove_personal_data page
  • #44192 – Title of Privacy Policy Page not used on login page
  • #44195 – “Silence is golden” index.html generates output
  • #44265 – Add filter for email subject for erasure complete notification
  • #44353 – Replace `site_url( ‘wp-login.php’ )` in `wp_send_user_request()`
  • #44373 – Add a privacy setting to disable comment cookie consent
  • #44379 – GDPR filters should provide either $request or $request_id
  • #44382 – Filter the subject within _wp_privacy_send_request_confirmation_notification
  • #44396 – Inconsistent use of blogname and sitename in Privacy emails
  • #44612 – Grammar – Missing ‘a’ in ‘select new Privacy Policy page’
  • #43967 – Admin emails after email confirmation don’t work for data privacy requests
  • #44590 – Remove “// WPCS:” comments
  • REST API:
  • #40861 – REST API saves attachments with absolute path for `_wp_attached_file` on Windows platforms
  • #43874 – REST API: Only render fields specific to request when _fields= is used
  • #44321 – REST API: Expose revision count and last revision ID on Post response
  • Role/Capability:
  • #44287 – REST API: Declare user capability to perform actions using JSON Hyper Schema `targetSchema`
  • Taxonomy:
  • #42691 – WP_Term_Query get_terms generates invalid sql queries
  • #44096 – REST API: Taxonomy and term endpoints should use correct permission checks
  • TinyMCE:
  • #44134 – Update to TinyMCE 4.7.13
  • #44330 – TinyMCE: do not force-load external TinyMCE plugins

New in WordPress 4.9.8 RC 3 (Aug 1, 2018)

  • ENHANCEMENTS:
  • Editor:
  • #44680 – Restrict the Try Gutenberg callout audience

New in WordPress 4.9.8 RC 1 (Jul 25, 2018)

  • BLESSED TASKS:
  • A full list of blessed tasks in 4.9.8 Release Candidate 1 can be found on Trac.
  • Editor:
  • #41316 – Introduce “Try Gutenberg” callout:
  • Emoji:
  • #44339 – Emoji: Update Twemoji to 11.0:
  • TinyMCE:
  • #44134 – Update to TinyMCE 4.7.13
  • See the TinyMCE changelog. WP 4.9.6 included TinyMCE 4.7.11, WP 4.9.8 beta 1 updated to TinyMCE 4.8.0.:
  • BUG FIXES:
  • Administration:
  • #44611 – try Gutenberg header wraps over text below on narrow screens:
  • Bundled Theme:
  • #44109 – TwentySeventeen backend editor: level 2 bulleted lists nested under numbered lists show numbers instead of bullets:
  • Comments:
  • #44141 – Privacy: Don’t replace comment author URL and email with anything
  • #44342 – Commenter cookie consent message should not be displayed if the cookie action isn’t hooked
  • #44126 – Adding fields to comments_form args prevents checkbox displaying:
  • Customize:
  • #44104 – Customize: Attempt to count uncountable value:
  • Editor:
  • #44341 – Replace _deprecated_function( ‘add_filter’ ) with apply_filters_deprecated():
  • Filesystem API:
  • #43054 – wp_is_stream fails with stream definition containing nonascii chars:
  • I18N:
  • #44139 – i18n: “About” disambiguation
  • #44574 – Saratov and other cities missing from translations:
  • Login and Registration:
  • #44052 – Missing parameter type for `login_header()`:
  • Media:
  • #43751 – REST API: Attachments controller should respect “Max upload file size” and “Site upload space” in multisite
  • #44532 – Extreme memory leak related to wp_is_stream in wp-includes/functions.php in WordPress 4.9.7:
  • Privacy:
  • #44099 – Add Request Type into Admin Email Subject for GDPR
  • #44130 – Mixed Case of Privacy Policy on Privacy Settings page
  • #44192 – Title of Privacy Policy Page not used on login page
  • #44195 – “Silence is golden” index.html generates output
  • #44265 – Add filter for email subject for erasure complete notification
  • #44353 – Replace `site_url( ‘wp-login.php’ )` in `wp_send_user_request()`
  • #44379 – GDPR filters should provide either $request or $request_id
  • #44382 – Filter the subject within _wp_privacy_send_request_confirmation_notification
  • #44396 – Inconsistent use of blogname and sitename in Privacy emails
  • #44590 – Remove “// WPCS:” comments:
  • Rest API:
  • #40861 – REST API saves attachments with absolute path for `_wp_attached_file` on Windows platforms
  • #43874 – REST API: Only render fields specific to request when _fields= is used:
  • Taxonomy:
  • #42691 – WP_Term_Query get_terms generates invalid sql queries
  • #44096 – REST API: Taxonomy and term endpoints should use correct permission checks:
  • TinyMCE:
  • #44330 – TinyMCE: do not force-load external TinyMCE plugins:
  • ENHANCEMENTS:
  • Options, Meta APIs:
  • #38323 – Reconsider $object_subtype handling in `register_meta()`:
  • Posts, Post Types:
  • #36085 – Add action hook to get_inline_data():
  • Privacy:
  • #43967 – Admin emails after email confirmation don’t work for data privacy requests
  • #44006 – Privacy Policy page should have suffix like other special pages
  • #44025 – Privacy: Pagination screen options for the requests list tables
  • #44100 – GDPR Privacy Page setting allows for Draft Pages
  • #44131 – If draft page selected for Privacy Policy page should verbiage change from view to preview
  • #44181 – The input field id username_or_email_to_export should be something else on remove_personal_data page
  • #44373 – Add a privacy setting to disable comment cookie consent
  • #44612 – Grammar – Missing ‘a’ in ‘select new Privacy Policy page’:
  • REST API:
  • #44321 – REST API: Expose revision count and last revision ID on Post response:
  • Role/Capability:
  • #44287 – REST API: Declare user capability to perform actions using JSON Hyper Schema `targetSchema`

New in WordPress 4.9.8 Beta 2 (Jul 20, 2018)

  • BUG FIXES:
  • I18N:
  • #44574 – Saratov and other cities missing from translations
  • Privacy:
  • #44192 – Title of Privacy Policy Page not used on login page
  • #44130 – Mixed Case of Privacy Policy on Privacy Settings page
  • ENHANCEMENTS:
  • Options, Meta APIs:
  • #38323 – Reconsider $object_subtype handling in `register_meta()`
  • Privacy:
  • #43967 – Admin emails after email confirmation don’t work for data privacy requests
  • #44612 – Grammar – Missing ‘a’ in ‘select new Privacy Policy page’

New in WordPress 4.9.7 (Jul 6, 2018)

  • WordPress versions 4.9.6 and earlier are affected by a media issue that could potentially allow a user with certain capabilities to attempt to delete files outside the uploads directory. Thank you to Slavco for reporting the original issue and Matt Barry for reporting related issues.
  • Seventeen other bugs were fixed in WordPress 4.9.7. Particularly of note were:
  • Taxonomy: Improve cache handling for term queries.
  • Posts, Post Types: Clear post password cookie when logging out.
  • Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.
  • Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.
  • Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.

New in WordPress 4.9.6 RC 1 (May 11, 2018)

  • Customize:
  • #43945 – Missing closing button tag in ‘Live Preview’ button
  • General:
  • #43934 – Missing doc for the user_request_key_expiration filter
  • #43951 – Typos in `WP_Privacy_Policy_Content::get_default_content()`
  • #44016 – user_request_action_email_content filter hook documentation inaccurate
  • #43583 – Account for SimpleXMLElement and `ResourceBundle` in is_countable()
  • Privacy:
  • #43964 – “Email Data” button text – Make it more clear that an export link is sent, not the whole data
  • #43920 – Use the terms erase / erasure instead of remove / removal for personal data
  • #43905 – Personal data export link does not work
  • #43913 – On sending the personal data export email, the request should be marked COMPLETED
  • #43922 – Data removal/erasure requests don’t get marked as “Completed” after erasure happens
  • #44015 – Add `id` attribute to each row of privacy post list tables
  • #43852 – Fix spacing on responsive for Use This Page button in Privacy Tools
  • #43966 – Prioritize the User group in Personal Data Exports to right below the About group
  • #43968 – Add Request Type into Confirmation Email Subject for GDPR
  • #44023 – Remove help tab from settings privacy until we have something helpful to say
  • #43908 – Export keeps generating new .zip files on Windows installations
  • #43970 – Add request type to the confirmation confirmation page – GDPR
  • #43973 – Email user once removal request completed – GDPR
  • #44040 – Potential PHP notice in wp_ajax_wp_privacy_erase_personal_data()
  • #43954 – Showing the privacy policy admin notice on all screens is intrusive
  • #43933 – Make the Privacy Policy page intro text shorter and more friendly
  • #43909 – Improve styling on personal data tables
  • #43967 – Admin emails after email confirmation don’t work for GDPR requests
  • #43961 – Privacy Policy popup covers collapsed admin menu
  • #43929 – Privacy pages: buttons should be buttons and other coding standards
  • #44031 – Add personal data export request ID to the wp_privacy_personal_data_export_file_created hook
  • #43980 – Consider outputting the suggested privacy policy content to a new page instead of a postbox
  • #44023 – Remove help tab from settings privacy until we have something helpful to say
  • TinyMCE:
  • #43984 – Customize: JavaScript error when opening Text widget
  • #43969 – Custom themes will not work in TinyMCE 4.7

New in WordPress 4.9.5 (Apr 4, 2018)

  • The following fixes have been implemented in this release:
  • Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. (#42963)
  • External Libraries: Remove unnecessary / obsoleted MediaElement.js files. (#42720)

New in WordPress 4.9.4 (Feb 6, 2018)

  • Fixes a severe bug in 4.9.3, which will cause sites that support automatic background updates to fail to update automatically, and will require action from you (or your host) for it to be updated to 4.9.4.
  • Four years ago with WordPress 3.7 “Basie”, we added the ability for WordPress to self-update, keeping your website secure and bug-free, even when you weren’t available to do it yourself. For four years it’s helped keep millions of installs updated with very few issues over that time. Unfortunately yesterdays 4.9.3 release contained a severe bug which was only discovered after release. The bug will cause WordPress to encounter an error when it attempts to update itself to WordPress 4.9.4, and will require an update to be performed through the WordPress dashboard or hosts update tools.
  • WordPress managed hosting companies who install updates automatically for their customers can install the update as normal, and we’ll be working with other hosts to ensure that as many customers of theirs who can be automatically updated to WordPress 4.9.4 can be.

New in WordPress 4.9.3 (Feb 6, 2018)

  • Fixes 34 bugs in 4.9, including fixes for Customizer changesets, widgets, visual editor, and PHP 7.2 compatibility.
  • For a full list of changes, consult the changelog at:
  • https://core.trac.wordpress.org/log/branches/4.9?rev=42630&stop_rev=42521

New in WordPress 4.9.2 (Jan 17, 2018)

  • An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress.
  • MediaElement has released a new version that contains a fix for the bug, and a WordPress plugin containing the fixed files is available in the plugin repository.
  • 21 other bugs were fixed in WordPress 4.9.2. Particularly of note were:
  • JavaScript errors that prevented saving posts in Firefox have been fixed.
  • The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.
  • Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.
  • Bundled Theme:
  • #42820 - Twenty Seventeen -watch that language
  • Customize:
  • #42492 - Selecting menu location changes line height
  • #42871 - Features box textstrings in Feature Filter area need new linebreak
  • Database:
  • #42812 - Use MySQLi when available by default
  • Editor:
  • #42664 - Editor link autocomplete suggestions: no fallback title displayed for posts with no title
  • #43012 - Cannot Update Post in Firefox Due to Editor and TinyMCE JavaScript TypeErrors
  • External Libraries:
  • #42439 - Update random_compat external library for PHP 7 linting failure
  • Formatting:
  • #42578 - PHP functions inside tags creates new tag, breaking the parent tag into two.
  • Media:
  • #42225 - Whitelist Flac Files
  • #42447 - Mark test_remove_orientation_data_on_rotate as skipped when exif_read_data isn't available
  • #42480 - Consistent suppression of `getimagesize()` errors
  • #42720 - Remove unnecessary MediaElement.js files
  • Plugins:
  • #43082 - Add plugins search results: the plugin details modal opens in the thickbox modal
  • REST API:
  • #42828 - Hard-coded 403 status in REST response should use `rest_authorization_required_code()`
  • Taxonomy:
  • #42771 - WP_Term::get_instance() regression for non-category terms queried with 'category' taxonomy
  • #42605 - category_description() does not work properly since 4.9
  • #42717 - get_category_link() accepting object but not id
  • TinyMCE:
  • #42416 - Code assumes iframe mode, exception in inline mode
  • Upgrade/Install:
  • #42963 - Improve deletion of $_old_files during upgrades
  • Widgets:
  • #42603 - Widgets Warning after activating theme and on dashboard widgets page
  • #42719 - Always attempt to restore widgets' previous assignment
  • #42867 - HTML Widget: toggleClass() should be passed true/false as second param

New in WordPress 4.9.1 (Nov 30, 2017)

  • Fixes:
  • Use a properly generated hash for the newbloguser key instead of a determinate substring.
  • Add escaping to the language attributes used on html elements.
  • Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
  • Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.
  • Issues relating to the caching of theme template files.
  • A MediaElement JavaScript error preventing users of certain languages from being able to upload media files.
  • The inability to edit theme and plugin files on Windows based servers.

New in WordPress 4.9 (Nov 17, 2017)

  • CUSTOMIZER WORKFLOW IMPROVED
  • Draft and Schedule Site Design Customizations:
  • Yes, you read that right. Just like you can draft and revise posts and schedule them to go live on the date and time you choose, you can now tinker with your site’s design and schedule those design changes to go live as you please.
  • Collaborate with Design Preview Links:
  • Need to get some feedback on proposed site design changes? WordPress 4.9 gives you a preview link you can send to colleagues and customers so that you can collect and integrate feedback before you schedule the changes to go live. Can we say collaboration++?
  • Design Locking Guards Your Changes:
  • Ever encounter a scenario where two designers walk into a project and designer A overrides designer B’s beautiful changes? WordPress 4.9’s design lock feature (similar to post locking) secures your draft design so that no one can make changes to it or erase all your hard work.
  • A Prompt to Protect Your Work:
  • Were you lured away from your desk before you saved your new draft design? Fear not, when you return, WordPress 4.9 will politely ask whether or not you’d like to save your unsaved changes.
  • CODING ENHANCEMENTS:
  • Syntax Highlighting and Error Checking? Yes, Please:
  • You’ve got a display problem but can’t quite figure out exactly what went wrong in the CSS you lovingly wrote. With syntax highlighting and error checking for CSS editing and the Custom HTML widget introduced in WordPress 4.8.1, you’ll pinpoint coding errors quickly. Practically guaranteed to help you scan code more easily, and suss out & fix code errors quickly.
  • Sandbox for Safety:
  • The dreaded white screen. You’ll avoid it when working on themes and plugin code because WordPress 4.9 will warn you about saving an error. You’ll sleep better at night.
  • Warning: Potential Danger Ahead:
  • When you edit themes and plugins directly, WordPress 4.9 will politely warn you that this is a dangerous practice and will recommend that you draft and test changes before updating your file. Take the safe route: You’ll thank you. Your team and customers will thank you.
  • EVEN MORE WIDGET UPDATES:
  • The New Gallery Widget:
  • An incremental improvement to the media changes hatched in WordPress 4.8, you can now add a gallery via this new widget. Yes!
  • Press a Button, Add Media:
  • Want to add media to your text widget? Embed images, video, and audio directly into the widget along with your text, with our simple but useful Add Media button. Woo!
  • SITE BUILDING IMPROVEMENTS:
  • More Reliable Theme Switching:
  • When you switch themes, widgets sometimes think they can just move location. Improvements in WordPress 4.9 offer more persistent menu and widget placement when you decide it’s time for a new theme.
  • Find and Preview the Perfect Theme:
  • Looking for a new theme for your site? Now, from within the Customizer, you can search, browse, and preview over 2600 themes before deploying changes to your site. What’s more, you can speed your search with filters for subject, features, and layout.
  • Better Menu Instructions = Less Confusion:
  • Were you confused by the steps to create a new menu? Perhaps no longer! We’ve ironed out the UX for a smoother menu creation process. Newly updated copy will guide you.
  • Lend a Hand with Gutenberg:
  • WordPress is working on a new way to create and control your content and we’d love to have your help. Interested in being an early tester or getting involved with the Gutenberg project? Contribute on GitHub.
  • DEVELOPER HAPPINESS:
  • Customizer JS API Improvements:
  • We’ve made numerous improvements to the Customizer JS API in WordPress 4.9, eliminating many pain points. (Hello, default parameters for constructs! Goodbye repeated ID for constructs!) There are also new base control templates, a date/time control, and section/panel/global notifications to name a few. Check out the full list.
  • CodeMirror available for use in your themes and plugins:
  • We’ve introduced a new code editing library, CodeMirror, for use within core. CodeMirror allows for syntax highlighting, error checking, and validation when creating code writing or editing experiences within your plugins, like CSS or JavaScript include fields.
  • MediaElement.js upgraded to 4.2.6:
  • WordPress 4.9 includes an upgraded version of MediaElement.js, which removes dependencies on jQuery, improves accessibility, modernizes the UI, and fixes many bugs.
  • Roles and Capabilities Improvements:
  • New capabilities have been introduced that allow granular management of plugins and translation files. In addition, the site switching process in multisite has been fine-tuned to update the available roles and capabilities in a more reliable and coherent way.

New in WordPress 4.8.3 (Oct 31, 2017)

  • Fixes an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability.
  • Also includes a change in behaviour for the esc_sql() function.

New in WordPress 4.9 Beta 3 (Oct 24, 2017)

  • The plugin/theme editors now show files in a scrollable expandable tree list. See #24048.
  • Backwards compatibility has been improved for MediaElement.js, which is upgraded from 2.2 to 4.2. See #42189.
  • When you create post stubs in the Customizer (such as for nav menu items, for the homepage or the posts page), if you then schedule your customized changes or save them as a draft, then these Customizer-created posts will appear in the admin as “Customization Drafts”; these drafts can be edited before your customized changes are published, at which time these posts (or pages) will also be automatically published. See #42220.
  • Theme browsing and installation experience in the Customizer has seen some bugfixes (e.g. #42215 and #42212), with some known remaining issues outstanding in Safari.
  • There is now a callout on the dashboard to install and activate Gutenberg. See #41316.
  • Menus in the Customizer have seen additional usability improvements. See #36279 and #42114.

New in WordPress 4.8.2 (Sep 20, 2017)

  • WORDPRESS VERSIONS 4.8.1 AND EARLIER ARE AFFECTED BY NINE SECURITY ISSUES:
  • $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Slavco.
  • A cross-site scripting (XSS) vulnerability was discovered in the oEmbed discovery. Reported by xknown of the WordPress Security Team.
  • A cross-site scripting (XSS) vulnerability was discovered in the visual editor. Reported by Rodolfo Assis (@brutelogic) of Sucuri Security.
  • A path traversal vulnerability was discovered in the file unzipping code. Reported by Alex Chapman (noxrnet).
  • A cross-site scripting (XSS) vulnerability was discovered in the plugin editor. Reported by 陈瑞琦 (Chen Ruiqi).
  • An open redirect was discovered on the user and term edit screens. Reported by Yasin Soliman (ysx).
  • A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team.
  • A cross-site scripting (XSS) vulnerability was discovered in template names. Reported by Luka (sikic).
  • A cross-site scripting (XSS) vulnerability was discovered in the link modal. Reported by Anas Roubi (qasuar).
  • IN ADDITION TO THE SECURITY ISSUES ABOVE, WORDPRESS 4.8.2 CONTAINS SIX MAINTENANCE FIXES TO THE 4.8 RELEASE SERIES:
  • Emoji:
  • #41584 - Upgrade Twemoji to 2.5.0
  • #41852 - Fix UN flag test by returning the correct value.
  • I18N:
  • #41794 - Support numbers in locales during installation
  • Security:
  • #13377 - Add more sanitization in _cleanup_header_comment
  • Widgets:
  • #41596 - New Text Widget recognizes HTML but does not render it in the front end
  • #41622 - Text widget can show DOMDocument::loadHTML() warnings in admin when is_legacy_widget method is called

New in WordPress 4.8.1 (Aug 3, 2017)

  • Administration:
  • #40982 - Permalink Settings: custom structure field keyboard trap
  • Build/Test Tools:
  • #41327 - Bump Akismet External - 4.9 Edition
  • Comments:
  • #40975 - 'Empty Spam' and 'Empty Trash' comment buttons not displayed on mobile
  • Customize:
  • #40978 - Customizer Panel Footer border missing
  • #40981 - Customizer: Menus: it is far too easy to mistakenly delete a menu because the "Delete Menu" link and the "Add Items" button are too close together
  • #41158 - Increase tinymce panel z-index
  • #41410 - Set `'filter' => 'content'` on starter content "business info" widget
  • Embeds:
  • #41019 - oEmbed: Update VideoPress oEmbed URL
  • #41048 - `WP_oEmbed_Controller::get_proxy_item()` should remove `_wpnonce` from cached `$args`
  • #41299 - oEmbed proxy fails to forward maxwidth and maxheight params
  • General:
  • #41056 - WP-API JS Client: Settings is incorrectly registered as a collection
  • Media:
  • #41231 - media-views.js: Cannot read .length of undefined (this.controller.$uploaderToggler.length)
  • REST API:
  • #38964 - Add filter to allow modifying response *after* embedded data is added
  • #40886 - REST API: PUT requests fail on Nginx servers when fancy permalinks aren't enabled
  • Taxonomy:
  • #41010 - wp_get_object_terms() returns duplicate terms if more than one taxonomy is given in args
  • TinyMCE:
  • #41408 - TinyMCE: Images with link and caption look "broken" when selected
  • Widgets:
  • #40907 - Introduce widget dedicated for HTML code
  • #40935 - Facebook Video Works On Preview But Not On Theme
  • #40951 - New Text Widget - Switching Between Visual/Text Editor Strips Out Code
  • #40960 - Widgets: The Text widget should respect the “Disable the visual editor when writing” setting
  • #40972 - TinyMCE editor in Text widget does not have RTL contents
  • #40974 - Updated text widget do not save text (when using paste)
  • #40977 - Widgets: Query param for `loop` added for non-hosted external videos
  • #40986 - Widgets: text widget and media widgets cannot be edited in accessibility mode
  • #41021 - Text widget does not show Title field or TinyMCE editor
  • #41361 - Text widget can raise JS error if customize-base is enqueued on widgets admin screen
  • #41386 - Text Widget - Wording - Legacy Mode 4.8.1 beta
  • #41392 - Theme styles for Text widget do not apply to Custom HTML widget
  • #41394 - Text widget: Rename legacy mode to visual mode and improve back-compat for widget_text filters

New in WordPress 4.8 (Jun 9, 2017)

  • EXCITING WIDGET UPDATES:
  • Image Widget:
  • Adding an image to a widget is now a simple task that is achievable for any WordPress user without needing to know code. Simply insert your image right within the widget settings. Try adding something like a headshot or a photo of your latest weekend adventure — and see it appear automatically.
  • Video Widget:
  • A welcome video is a great way to humanize the branding of your website. You can now add any video from the Media Library to a sidebar on your site with the new Video widget. Use this to showcase a welcome video to introduce visitors to your site or promote your latest and greatest content.
  • Audio Widget:
  • Are you a podcaster, musician, or avid blogger? Adding a widget with your audio file has never been easier. Upload your audio file to the Media Library, go to the widget settings, select your file, and you’re ready for listeners. This would be a easy way to add a more personal welcome message, too!
  • Rich Text Widget:
  • This feature deserves a parade down the center of town! Rich-text editing capabilities are now native for Text widgets. Add a widget anywhere and format away. Create lists, add emphasis, and quickly and easily insert links. Have fun with your newfound formatting powers, and watch what you can accomplish in a short amount of time.
  • LINK BOUNDARIES:
  • Have you ever tried updating a link, or the text around a link, and found you can’t seem to edit it correctly? When you edit the text after the link, your new text also ends up linked. Or you edit the text in the link, but your text ends up outside of it. This can be frustrating! With link boundaries, a great new feature, the process is streamlined and your links will work well. You’ll be happier. We promise.
  • NEARBY WORDPRESS EVENTS:
  • Did you know that WordPress has a thriving offline community with groups meeting regularly in more than 400 cities around the world? WordPress now draws your attention to the events that help you continue improving your WordPress skills, meet friends, and, of course, publish!
  • This is quickly becoming one of our favorite features. While you are in the dashboard (because you’re running updates and writing posts, right?) all upcoming WordCamps and official WordPress Meetups — local to you — will be displayed.
  • Being part of the community can help you improve your WordPress skills and network with people you wouldn’t otherwise meet. Now you can easily find your local events just by
  • logging in to your dashboard and looking at the new Events and News dashboard widget.
  • EVEN MORE DEVELOPER HAPPINESS:
  • More Accessible Admin Panel Headings:
  • New CSS rules mean extraneous content (like “Add New” links) no longer need to be included in admin-area headings. These panel headings improve the experience for people using assistive technologies.
  • Removal of Core Support for WMV and WMA Files:
  • As fewer and fewer browsers support Silverlight, file formats which require the presence of the Silverlight plugin are being removed from core support. Files will still display as a download link, but will no longer be embedded automatically.
  • Multisite Updates:
  • New capabilities have been introduced to 4.8 with an eye towards removing calls to
  • is_super_admin(). Additionally, new hooks and tweaks to more granularly control site and user counts per network have been added.
  • Text-Editor JavaScript API:
  • With the addition of TinyMCE to the text widget in 4.8 comes a new JavaScript API for instantiating the editor after page load. This can be used to add an editor instance to any text area, and customize it with buttons and functions. Great for plugin authors!
  • Media Widgets API:
  • The introduction of a new base media widget REST API schema to 4.8 opens up possibilities for even more media widgets (like galleries or playlists) in the future. The three new media widgets are powered by a shared base class that covers most of the interactions with the media modal. That class also makes it easier to create new media widgets and paves the way for more to come.
  • Customizer Width Variable:
  • Rejoice! New responsive breakpoints have been added to the customizer sidebar to make it wider on high-resolution screens. Customizer controls should use percentage-based widths instead of pixels.

New in WordPress 4.7.5 (May 17, 2017)

  • This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
  • WordPress versions 4.7.5 and earlier are affected by six security issues:
  • Insufficient redirect validation in the HTTP class. Reported by Ronni Skansing.
  • Improper handling of post meta data values in the XML-RPC API. Reported by Sam Thomas.
  • Lack of capability checks for post meta data in the XML-RPC API. Reported by Ben Bidner of the WordPress Security Team.
  • A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog. Reported by Yorick Koster.
  • A cross-site scripting (XSS) vulnerability was discovered when attempting to upload very large files. Reported by Ronni Skansing.
  • A cross-site scripting (XSS) vulnerability was discovered related to the Customizer. Reported by Weston Ruter of the WordPress Security Team.

New in WordPress 4.7.4 (Apr 20, 2017)

  • This release contains 47 maintenance fixes and enhancements, chief among them an incompatibility between the upcoming Chrome version and the visual editor, inconsistencies in media handling, and further improvements to the REST API.

New in WordPress 4.7.3 (Mar 7, 2017)

  • Fixed six security issues:
  • Cross-site scripting (XSS) via media file metadata. Reported by Chris Andrè Dale, Yorick Koster, and Simon P. Briggs.
  • Control characters can trick redirect URL validation. Reported by Daniel Chatfield.
  • Unintended files can be deleted by administrators using the plugin deletion functionality. Reported by xuliang.
  • Cross-site scripting (XSS) via video URL in YouTube embeds. Reported by Marc Montpas.
  • Cross-site scripting (XSS) via taxonomy term names. Reported by Delta.
  • Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources. Reported by Sipke Mellema.

New in WordPress 4.7.2 (Jan 27, 2017)

  • Fixed security issues:
  • The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it. Reported by David Herrera of Alley Interactive.
  • WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Mo Jangda (batmoo).
  • A cross-site scripting (XSS) vulnerability was discovered in the posts list table. Reported by Ian Dunn of the WordPress Security Team.

New in WordPress 4.7.1 (Jan 12, 2017)

  • A security release for all previous versions and we strongly encourage you to update your sites immediately.
  • WordPress versions 4.7 and earlier are affected by eight security issues:
  • Remote code execution (RCE) in PHPMailer – No specific issue appears to affect WordPress or any of the major plugins we investigated but, out of an abundance of caution, we updated PHPMailer in this release. This issue was reported to PHPMailer by Dawid Golunski and Paul Buonopane.
  • The REST API exposed user data for all users who had authored a post of a public post type. WordPress 4.7.1 limits this to only post types which have specified that they should be shown within the REST API. Reported by Krogsgard and Chris Jean.
  • Cross-site scripting (XSS) via the plugin name or version header on update-core.php. Reported by Dominik Schilling of the WordPress Security Team.
  • Cross-site request forgery (CSRF) bypass via uploading a Flash file. Reported by Abdullah Hussam.
  • Cross-site scripting (XSS) via theme name fallback. Reported by Mehmet Ince.
  • Post via email checks mail.example.com if default settings aren’t changed. Reported by John Blackbourn of the WordPress Security Team.
  • A cross-site request forgery (CSRF) was discovered in the accessibility mode of widget editing. Reported by Ronnie Skansing.
  • Weak cryptographic security for multisite activation key. Reported by Jack.

New in WordPress 4.7 (Dec 7, 2016)

  • Version 4.7 of WordPress, named “Vaughan” in honor of legendary jazz vocalist Sarah “Sassy” Vaughan, is available for download or update in your WordPress dashboard. New features in 4.7 help you get your site set up the way you want it.
  • Presenting Twenty Seventeen:
  • A brand new default theme brings your site to life with immersive featured images and video headers. Twenty Seventeen focuses on business sites and features a customizable front page with multiple sections. Personalize it with widgets, navigation, social menus, a logo, custom colors, and more. Our default theme for 2017 works great in many languages, on any device, and for a wide range of users.
  • Your Site, Your Way:
  • WordPress 4.7 adds new features to the customizer to help take you through the initial setup of a theme, with non-destructive live previews of all your changes in one uninterrupted workflow. To help give you a solid base to build from, individual themes can provide starter content that appears when you go to customize your brand new site. This can range from placing a business information widget in the best location to providing a sample menu with social icon links to a static front page complete with beautiful images. Don’t worry – nothing new will appear on the live site until you’re ready to save and publish your initial theme setup.
  • Edit Shortcuts:
  • Visible icons appear to show you which parts of your site can be customized while live previewing. Click on a shortcut and get straight to editing. Paired with starter content, getting started with customizing your site is faster than ever
  • Video Headers:
  • Sometimes a big atmospheric video as a moving header image is just what you need to showcase your wares; go ahead and try it out with Twenty Seventeen. Need some video inspiration? Try searching for sites with video headers available for download and use.
  • Smoother Menu Building:
  • Many menus for sites contain links to the pages of your site, but what happens when you don’t have any pages yet? Now you can add new pages while building menus instead of leaving the customizer and abandoning your changes. Once you’ve published your customizations, you’ll have new pages ready for you to fill with content.
  • Custom CSS:
  • Sometimes you just need a few visual tweaks to make your site perfect. WordPress 4.7 allows you to add custom CSS and instantly see how your changes affect your site. The live preview allows you to work quickly without page refreshes slowing you down.
  • PDF Thumbnail Previews:
  • Managing your document collection is easier with WordPress 4.7. Uploading PDFs will generate thumbnail images so you can more easily distinguish between all your documents.
  • Dashboard in your language:
  • Just because your site is in one language doesn’t mean that everybody helping manage it prefers that language for their admin. Add more languages to your site and a user language option will show up in your user’s profiles.
  • Introducing REST API Content Endpoints:
  • WordPress 4.7 comes with REST API endpoints for posts, comments, terms, users, meta, and settings. Content endpoints provide machine-readable external access to your WordPress site with a clear, standards-driven interface, paving the way for new and innovative methods of interacting with sites through plugins, themes, apps, and beyond.
  • Even More Developer Happiness:
  • Post Type Templates:
  • By opening up the page template functionality to all post types, theme developers have even more flexibility with the WordPress template hierarchy.
  • More Theme API Goodies:
  • WordPress 4.7 includes new functions, hooks, and behavior for theme developers.
  • Custom Bulk Actions:
  • List tables, now with more than bulk edit and delete.
  • WP_Hook:
  • The code that lies beneath actions and filters has been overhauled and modernized, fixing bugs along the way.
  • Settings Registration API:
  • register_setting() has been enhanced to include type, description, and REST API visibility.
  • Customize Changesets:
  • Customize changesets make changes in the customizer persistent, like autosave drafts. They also make exciting new features like starter content possible.

New in WordPress 4.7 RC 1 (Nov 24, 2016)

  • Highlights include a new default theme, video headers, custom CSS, customizer edit shortcuts, PDF thumbnail previews, user admin languages, REST API content endpoints, post type templates, and more.
  • Made quite a few refinements since releasing Beta 4 a week ago, including usability and accessibility enhancements for video headers, media and page template support in starter content, and polishing of how custom CSS can be migrated to and extended by plugins and themes. The REST API endpoints saw a number of bugfixes and notably now have anonymous comment off by default.

New in WordPress 4.7 Beta 4 (Nov 16, 2016)

  • Made about 60 changes, including tweaks to Twenty Seventeen, custom CSS, and the REST API content endpoints.

New in WordPress 4.7 Beta 3 (Nov 11, 2016)

  • REST API: The unfiltered_html capability is now respected and rest_base has been added to response objects of wp/v2/taxonomies and wp/v2/types, while get_allowed_query_vars() and the rest_get_post filter have been removed.
  • Roles/Capabilities: Added meta-caps for comment, term, and user meta, which are currently only used in the REST API.
  • I18N: Added the ability to change user’s locale back to site’s locale. (#38632)
  • Custom CSS: Renamed the unfiltered_css meta capability to edit_css and added revisions support to the custom_css post type.
  • Edit shortcuts: Theme authors should take a look at the developer guide to the customizer preview’s visible edit shortcuts and update their themes to take advantage of them if not already implementing selective refresh.
  • Various bug fixes: We’ve made over 50 changes in the last week.

New in WordPress 4.7 Beta 2 (Nov 6, 2016)

  • Twenty Seventeen: The theme wasn’t being installed on upgrades – sorry about that! Now you should see it if you’re upgrading an existing site. There are also plenty of fixes, especially for the header and small screen views.
  • Edit shortcuts: These are always visible while editing (hide them on bigger screens by collapsing the controls) and should now work properly in Firefox. (#27403 and #38532)
  • REST API endpoints: There have been a number of changes over the past week; your attention is requested on the following:
  • The DELETE response format has changed and may need to be accounted for. (#38494)
  • Enabled querying by multiple post statuses. (#38420)
  • Return an error when JSON decoding fails. (#38547)
  • More developer notes
  • Fine grained capabilities for taxonomy terms
  • WP_Taxonomy
  • wp_list_sort() and WP_List_Util
  • Post type templates
  • New post type labels
  • Attributes for resource hints
  • Various bug fixes: We’ve made almost 150 changes in the last week.

New in WordPress 4.7 Beta 1 (Oct 28, 2016)

  • Twenty Seventeen – A brand new default theme brings your site to life with immersive featured images, video headers, and subtle animations. With a focus on business sites, it features multiple sections on the front page as well as widgets, navigation and social menus, a logo, and more. Personalize its asymmetrical grid with a custom color scheme and showcase your multimedia content with post formats. Our default theme for 2017 works great in many languages, for any abilities, and on any device.
  • Video Headers – Sometimes a big atmospheric video as a moving header image is just what you need to showcase your wares; go ahead and try it out with Twenty Seventeen. Need some video inspiration? Try searching for sites with video headers available for download and use.
  • Set up your site in one flow – From finding and installing themes right inside the customizer, to automatically staged theme-specific starter content, to clickable shortcuts that jump directly to editing an item from the preview pane, to adding pages while you’re building a nav menu or setting a static front page: getting a new site spun up and ready to share with a friend or a coworker is faster and easier than it’s ever been. Note: starter content appears when live previewing brand new sites and is currently only available in Twenty Seventeen. We’ll be expanding this to other bundled themes very soon, and perhaps to sites with existing content in future releases of WordPress.
  • Custom CSS with live previews – Ever needed to hide or tweak the look of something in your theme or from a plugin? Now you can do it with CSS and live preview the results while customizing your site. CSS can be a powerful tool; you may find that you won’t need the theme editor or child themes anymore.
  • User admin languages – Just because your site is in one language doesn’t mean that everybody helping manage it prefers that language for their admin. To try this out, you’ll need to have more than one language installed, which will make a user language option available in your profile.
  • PDF thumbnail previews – Uploading PDFs will now generate thumbnail images so you can more easily distinguish between all your documents.
  • As always, there have been exciting changes for developers to explore as well, such as:
  • REST API content endpoints – If you only test one thing as a developer, please test these. This phase is particularly helpful for people building plugins, themes, and in-admin interfaces. Can you build the things you need? Are these ready for release, and is the world ready for them? (#38373)
  • WP_Hook – The code that lies beneath actions and filters has been overhauled. You likely aren’t affected, but if you’ve done things to the $wp_filter global or experienced funky recursion bugs in the past, please take a moment to read the dev note and test your code.
  • Custom bulk actions – List tables, now with more than bulk edit and delete.
  • Expanded Settings Registration API via register_setting().
  • For theme developers: Post type templates (#18375)
  • More goodies for theme developers!
  • Locale switching (#26511)
  • Comment allowed checks have the potential for a back-compat break.

New in WordPress 4.6.1 (Sep 8, 2016)

  • SECURITY FIXES:
  • Fixes two security issues: a cross-site scripting vulnerability via image filename, reported by SumOfPwn researcher Cengiz Han Sahin; and a path traversal vulnerability in the upgrade package uploader, reported by Dominik Schilling from the WordPress security team.
  • BUG FIXES:
  • Bootstrap/Load:
  • #37680 – PHP Warning: ini_get_all() has been disabled for security reasons
  • Database:
  • #37683 – $collate and $charset can be undefined in wpdb::init_charset()
  • #37689 – Issues with utf8mb4 collation and the 4.6 update
  • Editor:
  • #37690 – Backspace causes jumping
  • Email:
  • #37736 – Emails fail on certain server setups
  • External Libraries:
  • #37700 – Warning: curl_exec() has been disabled for security reasons (Requests library)
  • #37720 – The minified version of the Masonry shim was not updated in #37666 (Masonry library)
  • HTTP API:
  • #37733 – cURL error 3: malformed for remote requests
  • #37768 – HTTP API no longer accepts integer and float values for the cookies argument
  • Post Thumbnails:
  • #37697 – Strange behavior with thumbnails on preview in 4.6
  • Script Loader:
  • #37800 – Close “link rel” dns-prefetch tag
  • Taxonomy:
  • #37721 – Improve error handling of is_object_in_term in taxonomy.php
  • Themes:
  • #37755 – Visual Editor: Weird unicode (Vietnamese) characters display on WordPress 4.6
  • TinyMCE:
  • #37760 – Problem with RTL
  • Upgrade/Install:
  • #37731 – Infinite loop in _wp_json_sanity_check() during plugin install

New in WordPress 4.6 (Aug 17, 2016)

  • STREAMLINED UPDATES:
  • Don’t lose your place: stay on the same page while you update, install, and delete your plugins and themes.
  • NATIVE FONTS:
  • The WordPress dashboard now takes advantage of the fonts you already have, making it load faster and letting you feel more at home on whatever device you use
  • EDITOR IMPROVEMENTS:
  • Inline Link Checker:
  • Ever accidentally made a link to https://wordpress.org/example.org? Now WordPress automatically checks to make sure you didn’t.
  • Content Recovery:
  • As you type, WordPress saves your content to the browser. Recovering saved content is even easier with WordPress 4.6.
  • UNDER THE HOOD:
  • Resource Hints:
  • Resource hints help browsers decide which resources to fetch and preprocess. WordPress 4.6 adds them automatically for your styles and scripts making your site even faster
  • Robust Requests:
  • The HTTP API now leverages the Requests library, improving HTTP standard support and adding case-insensitive headers, parallel HTTP requests, and support for Internationalized Domain Names
  • WP_Term_Query and WP_Post_Type:
  • A new WP_Term_Query class adds flexibility to query term information while a new WP_Post_Type object makes interacting with post types more predictable
  • Meta Registration API:
  • The Meta Registration API has been expanded to support types, descriptions, and REST API visibility.
  • Translations On Demand:
  • WordPress will install and use the newest language packs for your plugins and themes as soon as they’re available from WordPress.org’s community of translators.
  • JavaScript Library Updates:
  • Masonry 3.3.2, imagesLoaded 3.2.0, MediaElement.js 2.22.0, TinyMCE 4.4.1, and Backbone.js 1.3.3 are bundled.
  • Customizer APIs for Setting Validation and Notifications:
  • Settings now have an API for enforcing validation constraints. Likewise, customizer controls now support notifications, which are used to display validation errors instead of failing silently.
  • Multisite, now faster than ever:
  • Cached and comprehensive site queries improve your network admin experience. The addition of WP_Site_Query and WP_Network_Query help craft advanced queries with less effort.

New in WordPress 4.6 RC 2 (Aug 11, 2016)

  • Support for custom HTTP methods and proxy authentication has been restored.
  • Various fixes for the streamlined updates, including better failure messages and error handling, basic back-compat styling for custom update notifications, and additional and standardized JavaScript events.
  • Unnecessary reference parameters have been removed from new multisite functions.
  • A compatibility issue with PHP 7.0.9 (and PHP 7.1) has been fixed.

New in WordPress 4.6 Beta 4 (Jul 20, 2016)

  • Media: alt attributes are now always added to images inserted from URLs (#36735).
  • Object subtype handling has been removed from register_meta(). Details about this change are explained in a post for developers.
  • Resource hints are now limited to enqueued assets (#37385).
  • A regression with query alterations introduced by the new WP_Term_Query has been fixed (#37378).
  • The Ajax searches for installed and new plugins have been enhanced to fix several accessibility issues and to improve compatibility with older browsers. (#37233, #37373)
  • The media player MediaElement.js has been updated to 2.22.0 to fix YouTube video embeds (#37363).
  • The Import screen was overhauled, improving accessibility and making it much easier to install and run an importer (#35191).
  • Emoji support has been updated to include all of the latest Unicode 9 emoji characters (#37361).
  • Various bug fixes.

New in WordPress 4.6 Beta 3 (Jul 13, 2016)

  • Revisions: Autosaves can now be restored when revisions are disabled (#36262).
  • An improved handling of PHP’s memory limit which doesn’t lower the limit anymore (#32075).
  • TinyMCE has been updated to 4.4.0 (#37327).
  • HTTP API: Proxy settings weren’t honored by the new HTTP library. This has been fixed (#37107).
  • Improved handling of UTF-8 address headers for emails (#21659).
  • Various bug fixes. We’ve made more than 65 changes during the last week.

New in WordPress 4.6 Beta 2 (Jul 7, 2016)

  • Highlights:
  • Meta: The fallback authentication for the previous registration method has been restored. Also, retrieving registered metadata now works and non-core object types are no longer forcibly blocked. See #35658.
  • REST API: The order of setting sanitization and validation has been reversed; validation now occurs prior to sanitization. Previously, the sanitization callback ran before the validation callback. See #37192.
  • Customize: The order of setting sanitization and validation has been reversed; validation now occurs prior to sanitization. See #37247.
  • HTTP API: WP_Http::request() returns an array again. See #37097.
  • Various bug fixes. We’ve made just over 50 changes in the last week.

New in WordPress 4.6 Beta 1 (Jun 30, 2016)

  • Shiny Updates v2 ([37714]) – Shiny Updates replaces progress updates with a simpler and more straight forward experience when installing, updating, and deleting plugins and themes.
  • Native Fonts in the Admin (#36753) – Experience faster load times, especially when working offline, a removal of a third-party dependency, and a more native-feeling experience as the lines between the mobile web and native applications continue to blur.
  • Editor Improvements – A more reliable recovery mode (#37025) and detection of broken URLs while you type them (#36638).
  • There have been changes for developers to explore as well:
  • Resource Hints (#34292) – Allow browsers to prefetch specific pages, render them in the background, perform DNS lookups, or to begin the connection handshake (DNS, TCP, TLS) in the background.
  • New WP_Site_Query (#35791) and WP_Network_Query (#32504) classes to query sites and networks with lazy loading for details.
  • Requests (#33055) – A new PHP library for HTTP requests that supports parallel requests and more.
  • WP_Term_Query (#35381) is modeled on existing query classes and provides a more consistent structure for generating term queries.
  • Language Packs (#34114, #34213) – Translations managed through translate.wordpress.org now have a higher priority and are loaded just-in-time.
  • WP_Post_Type (#36217) provides easier access to post type objects and their underlying properties.
  • The Widgets API (#28216) was enhanced to support registering pre-instantiated widgets.
  • Index definitions are now normalized by dbDelta() ([37583]).
  • Comments can now be stored in a persistent object cache (#36906).
  • External Libraries were updated to the latest versions – Masonry to 3.3.2 and imagesLoaded to 3.2.0 (#32802), MediaElement.js to 2.21.2 (#36759), and TinyMCE to 4.3.13 (#37225).
  • REST API responses now include an auto-discovery header (#35580) and a refreshed nonce when responding to an authenticated response (#35662).
  • Expanded Meta Registration API via register_meta() (#35658).
  • Customizer – Improved API for setting validation (#34893, #36944).

New in WordPress 4.5.2 (May 6, 2016)

  • This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
  • WordPress versions 4.5.1 and earlier are affected by a SOME vulnerability through Plupload, the third-party library WordPress uses for uploading files. WordPress versions 4.2 through 4.5.1 are vulnerable to reflected XSS using specially crafted URIs through MediaElement.js, the third-party library used for media players. MediaElement.js and Plupload have also released updates fixing these issues.
  • Both issues were analyzed and reported by Mario Heiderich, Masato Kinugawa, and Filedescriptor from Cure53. Thanks to the team for practicing responsible disclosure, and to the Plupload and MediaElement.js teams for working closely with us to coordinate and fix these issues.
  • Additionally, there are multiple widely publicized vulnerabilities in the ImageMagick image processing library, which is used by a number of hosts and is supported in WordPress

New in WordPress 4.5.1 (Apr 26, 2016)

  • Build/Test Tools:
  • #36498 Shrinkwrap npm dependencies for 4.5
  • Bundled Theme:
  • #36510 Twenty eleven page templates with widgets incorrectly styled
  • Customize:
  • #36457 Customizer Device Preview: Use px units for tablet preview size
  • Database:
  • #36629 Database connect functions can cause un-catchable warnings
  • Editor:
  • #36458 Fix support for Safari + VoiceOver when editing inline links
  • Emoji:
  • #36604 Emoji skin tone support test incorrectly passing in Chrome
  • Feeds:
  • #36620 Feeds using an rss-http content type are now served as application/octet-stream
  • Media:
  • #36501 Fatal error: Undefined class constant 'ALPHACHANNEL_UNDEFINED'
  • #36578 wp_ajax_send_attachment_to_editor() bug
  • #36621 Don’t cache the results of wp_mkdir_p() in a persistent cache
  • Rewrite Rules:
  • #36506 Duplicate directives in web.config after WordPress 4.5 installation on Windows
  • TinyMCE:
  • #36545 WordPress TinyMCE toolbar/tabs unresponsive in Chrome Version 50.0.2661.75 beta-m (64-bit)

New in WordPress 4.5 (Apr 12, 2016)

  • Editing Improvements:
  • Inline Linking - Stay focused on your writing with a less distracting interface that keeps you in place and allows you to easily link to your content.
  • Formatting Shortcuts - Do you enjoy using formatting shortcuts for lists and headings? Now they’re even more useful, with horizontal lines and .
  • Customization Improvements:
  • Live Responsive Previews - Make sure your site looks great on all screens! Preview mobile, tablet, and desktop views directly in the customizer.
  • Custom Logos - Themes can now support logos for your business or brand. Try it out with Twenty Sixteen and Twenty Fifteen in the Site Identity section of the customizer.
  • Under the Hood:
  • Smart Image Resizing - Generated images now load up to 50% faster with no noticeable quality loss. It’s really cool.
  • Selective Refresh - The customizer now supports a comprehensive framework for rendering parts of the preview without rewriting your PHP code in JavaScript.
  • Script Loader Improvements - Better support has been added for script header/footer dependencies. New wp_add_inline_script() enables adding extra code to registered scripts.
  • Better Embed Templates - Embed templates have been split into parts and can be directly overridden by themes via the template hierarchy.
  • JavaScript Library Updates - jQuery 1.12.3, jQuery Migrate 1.4.0, Backbone 1.2.3, and Underscore 1.8.3 are bundled.

New in WordPress 4.5 RC 2 (Apr 10, 2016)

  • Normalized non-slashing of data in the REST API infrastructure. If you use the REST API infrastructure, check out the post on this change.
  • Customizer settings for widget instances get registered a bit later to give a chance for the widget instances themselves to be registered first. See #36431 for details.
  • Fixed various cropping issues in the Custom Logo feature and Twenty Fifteen / Twenty Sixteen themes.

New in WordPress 4.5 Beta 4 (Mar 17, 2016)

  • Add support for oEmbed moments and timelines from Twitter (#36197).
  • More changes to better support HHVM with Imagick. Please test with HHVM setups and resizing/rotating images (#35973).
  • Tightened up the Inline Link feature (#33301, #30468).
  • Support editor shortcut with 3 or more dashes (---); no spaces. To give more time to study the best shortcuts for users, text patterns for bold and italic have been removed and won’t ship with for 4.5 (#33300).
  • Fixes for SSL with Responsive Images. Please test with SSL, especially on sites with mixed http/https setups (#34945).
  • Allow rewrite rules to work in nested WordPress installations on IIS (#35558).
  • Various bug fixes. We’ve made almost 100 changes during the last week.

New in WordPress 4.5 Beta 3 (Mar 10, 2016)

  • Many Theme Logo Support (#33755) fixes, including support for bundled Twenty Fifteen (#35944).
  • Add Responsive Preview to theme install previewer (#36017).
  • Support Imagick in HHVM (#35973).
  • Whitelist IPTC, XMP, and EXIF profiles from strip_meta() to maintain authorship, copyright, license, and image orientation (#28634).
  • Support Windows shares/DFS roots in wp_normalize_path() (#35996).
  • New installs default to generating secret keys and salts locally instead of relying on the WordPress.org API. Please test installing WP in situations where it can’t connect to the internet (like on a 🛳, ✈️, or 🛰) (#35290).
  • OPTIONS requests to REST API should return Allow header (#35975).
  • Upgrade twemoji.js to version 2 (#36059) and add extra IE11 compatibility (#35977) for Emoji.
  • Various bug fixes. We’ve made more than 100 changes during the last week.

New in WordPress 4.5 Beta 2 (Mar 3, 2016)

  • Added Horizontal Rule (HR) editing shortcut and dismissible “Paste as Text” notice in TinyMCE.
  • Selective Refresh support is enabled for core themes titles and taglines, which allows shift-click to focus on controls and PHP filters to apply in the preview.
  • Resolved a fatal error on image upload when ImageMagick could not complete stripping meta during resize (#33642).
  • Various bug fixes. We’ve made just over 100 changes in the last week.

New in WordPress 4.5 Beta 1 (Feb 25, 2016)

  • Changes:
  • Responsive Preview of your site in the Customizer (#31195) – See how your site looks in mobile, tablet, and desktop contexts before making changes to its appearance.
  • Theme Logo Support (#33755) – Native support for a theme logo within the Customizer.
  • Inline Link Editing (#33301) – Within the visual editor, edit links inline for a smoother workflow.
  • Paste Support for Editor Shortcuts (#33300) – Paste a limited syntax of Markdown-like text directly into the visual editor to skip that pesky HTML conversion step. Includes a few new shortcuts, like `..` for code and **..** for bold.
  • Comment Moderation Improvements (#34133) – An enhanced experience when moderating comments, including preview with rendered formatting.
  • Optimization of Image Generation (#33642) – Image sizes are generated more efficiently and remove unneeded meta, while still including color profiles in Imagick, for reduced sizes of up to 50% with near identical visual quality.
  • There have been changes for developers to explore as well:
  • Selective Refresh (#27355) – A comprehensive framework for rendering parts of the customizer preview in real time. Theme and plugin authors should test their widgets specifically for compatibility with selective refresh, and note that it may ultimately be opt-in for 4.5.
  • Backbone and Underscore updated to latest versions (#34350) – Backbone is upgraded from 1.1.2 to 1.2.3 and Underscore is upgraded from 1.6.0 to 1.8.3. See the this post for important changes.
  • Embed templates (#34561) – Embed templates were split into parts and can now be directly overridden by themes via the template hierarchy.
  • New WP_Site class (#32450) – More object-oriented approach for managing sites in Multisite
  • Script loader (#14853, #35873) – Introduces wp_add_inline_script() for including inline JavaScript just like wp_add_inline_style() works for CSS, and better support for script header/footer dependencies.

New in WordPress 4.4.2 (Feb 2, 2016)

  • WordPress versions 4.4.1 and earlier are affected by two security issues: a possible XSS for certain local URIs, reported by Ronni Skansing; and an open redirection attack, reported by Shailesh Suthar.
  • Fixed issues:
  • 35356: wp_list_comments ignores $comments parameter
  • 35478: 4.4 Regression on Querying for Comments by Multiple Post Fields
  • 35192: Comments_clauses filter
  • 35251: 'networks' should be global cache group
  • 35316: Images with latin extended characters in exif (slovak/czech) are missing thumbnails
  • 35327: Using libsodium for random bytes breaks plugin update in WP 4.4
  • 35344: Strange pagination issue on front page after 4.4.1 update
  • 35355: Customizer should not try to return to the login screen
  • 35361: Error in SQL syntax search page
  • 35376: Default URL for emoji images should be always https
  • 35378: Incorrect comment ordering when comment threading is turned off
  • 35401: Taxonomies Quick Edit: prevent page reload when submitting
  • 35402: per_page parameter no longer works in wp_list_comments
  • 35412: ModSecurity2 blocks Potential Obfuscated Javascript in outbound anomaly
  • 35419: Incorrect comment pagination when comment threading is turned off
  • 35462: update_term_cache and deleting object_id
  • 35447: Button to delete inactive widgets is displayed on inactive sidebars

New in WordPress 4.4.1 (Jan 6, 2016)

  • WordPress versions 4.4 and earlier are affected by a cross-site scripting vulnerability that could allow a site to be compromised. This was reported by Crtc4L.
  • There were also several non-security bug fixes:
  • Emoji support has been updated to include all of the latest emoji characters, including the new diverse emoji! 👍🏿👌🏽👏🏼
  • Some sites with older versions of OpenSSL installed were unable to communicate with other services provided through some plugins.
  • If a post URL was ever re-used, the site could redirect to the wrong post.
  • Administration:
  • 34987 “Configure” link for dashboard widgets no longer displayed.
  • 35047 Notices are not moved to first header when header-elements are nested inside .wrap
  • 35057 bug in new default_hidden_columns filter
  • 35112 Screen Options in Appearance -> Menu not saved correctly sometimes:
  • Bootstrap/Load:
  • 34967 SHORTINIT and date_i18n: Call to undefined function _x()
  • 35013 WP4.4 function handle_404 yelds a fatal error on line 613 when trying to clone $wp_query->post if it’s not an object:
  • Build/Test tools:
  • 30787 Shrinkwrap NPM dependencies:
  • Bundled Theme:
  • 35270 Bump twentysixteen for 4.4.1:
  • Canonical:
  • 34890 Canonical meta tag for paginated posts incorrect with ugly permalinks:
  • Comments:
  • 34946 new comment redirects break anchors in Safari
  • 34997 preprocess_comment filter does not contain old user_ID field for user_id, instead it has new user_id field
  • 35006 Comments sent immediately to Trash for matching keyword blacklist should not generate email notifications
  • 35025 Performance regression in comments_template in 4.4
  • 35068 Comments not showing up when there are unapproved messages
  • 35175 Page parameter no longer works in wp_list_comments:
  • Customize:
  • 35081 Missing Change Theme button when there are only two themes available:
  • Embeds:
  • 35152 Remove Rdio embed support
  • 35194 Remove embed discovery tags from HTML header of static home pages
  • 35237 Invalid argument supplied for foreach() in /wp-includes/embed-template.php on line 54:
  • Emoji:
  • 33592 Unicode 8.0 Emoji:
  • External Libraries:
  • 34948 Update random_compat for “Don’t instantiate COM if it’s a disabled class”:
  • Filesystem API:
  • 34976 Plug ins fail to update after WP 4.4 installed:
  • Formatting:
  • 35008 Ampersands in URLs are no longer converted to entities
  • 35058 PHP Fatal when map_deep tries to work on an object that has a property by reference:
  • HTTP API:
  • 34935 Removed SSL certificates causing errors in WP 4.4:
  • Help/About:
  • 35215 Setting help tab priorities fails to correctly order the tabs:
  • Login/Registration:
  • 34925 4.4 wp-login.php: no longer possible to use the login_post scheme
  • 35103 login_url Filter is now applied to Login Form Action Attribute:
  • Mail:
  • 35212 Update PHPMailer to 5.2.14:
  • Media:
  • 35045 Responsive images not added when effective scheme differs from image src scheme
  • 35101 image_default_link_type option not being respected
  • 35102 Responsive images support for external URLs
  • 35106 Responsive images break uploads with full path stored in metadata
  • 35108 Responsive images blurry – srcset attribute doesn’t include full size version
  • 35153 Default link target for media files is none:
  • Menus:
  • 34446 WordPress Notice after add support for post type archives in menu
  • 34449 Remove CPT if exists menu item
  • 35107 wp_nav_menu outputs tags without line breaks in 4.4, causes strange bug with justified text:
  • Permalinks:
  • 35084 check for post status in get_page_uri causes issues with permalinks:
  • Query:
  • 35031 wp_old_slug_redirect() in 4.4 redirecting existing posts
  • 35115 404 error when URL includes title=…:
  • Shortcodes:
  • 34939 Shortcode regex no longer matches [shortcode=XXX]:
  • Taxonomy:
  • 34723 Warning in get_the_terms() because of non-array
  • 35089 Query var on non-public taxonomy remains boolean true since [35333]
  • 35137 get_terms() with a meta_query filter returns duplicated terms
  • 35156 wp_list_categories() does not accept comma-separated IDs for exclude_tree parameter
  • 35180 In WordPress 4.4 the_tags() is displaying tags ordered by ID instead of alphabetically by name:
  • Themes:
  • 34962 Issues with wp_get_document_title function causing problems with document titles:
  • Users:
  • 34993 Deleting a user no longer asks what to do with their content:
  • Widgets:
  • 34978 Extra quotes in title in WP_Widget_RSS class, widget method
  • 34995 WP_Widget::widget not called:
  • XML-RPC:
  • 35053 XML-RPC when post with date_created_gmt, its post_date will gmt date not local date
  • 35185 Unable to create Post via XMLRPC after upgrading to 4.4

New in WordPress 4.4 (Dec 9, 2015)

  • The new default theme, Twenty Sixteen, is a modern take on a classic blog design.
  • Twenty Sixteen was built to look great on any device. A fluid grid design, flexible header, fun color schemes, and more, will all make your content shine.
  • Responsive Images - An image of a laptop, iPad, Android phone, and iPhone containing the same image displayed at multiple sizes to demonstrate responsive image features.
  • WordPress now takes a smarter approach to displaying appropriate image sizes on any device, ensuring a perfect fit every time. You don’t need to do anything to your theme, it just works.
  • Embed Everything - Now you can embed your posts on other WordPress sites. Simply drop a post URL into the editor and see an instant embed preview, complete with the title, excerpt, and featured image if you’ve set one. We’ll even include your site icon and links for comments and sharing.
  • In addition to post embeds, WordPress 4.4 also adds support for five new oEmbed providers: Cloudup, Reddit Comments, ReverbNation, Speaker Deck, and VideoPress.
  • Under the Hood:
  • REST API infrastructure - Infrastructure for the REST API has been integrated into core, marking a new era in developing with WordPress. The REST API gives developers an easy way to build and extend RESTful APIs on top of WordPress.
  • Infrastructure is the first part of a multi-stage rollout for the REST API. Inclusion of core endpoints is targeted for an upcoming release. To get a sneak peek of the core endpoints, and for more information on extending the REST API, check out the official WordPress REST API plugin.
  • Term meta - Terms now support metadata, just like posts. See add_term_meta(), get_term_meta(), and update_term_meta() for more information.
  • Comment query improvements - Comment queries now have cache handling to improve performance. New arguments in WP_Comment_Query make crafting robust comment queries simpler.
  • Term, comment, and network objects - New WP_Term, WP_Comment, and WP_Network objects make interacting with terms, comments, and networks more predictable and intuitive in code.

New in WordPress 4.4 Beta 1 (Oct 23, 2015)

  • New:
  • Twenty Sixteen — The newest default theme for WordPress.
  • Responsive Images — WordPress automatically delivers a more appropriate image to users depending on a variety of conditions like screen size, viewport size, and screen resolution.
  • Embeds — WordPress can now embed rich content from nearly all sites that support the oEmbed standard — not just YouTube, Flickr, Twitter, and the like. You can even embed previews of posts from other WordPress sites by pasting the URL on its own line.
  • Changes:
  • REST API (phase 1) — The underlying infrastructure of the WordPress REST API plugin has been included in WordPress 4.4. Plugin authors can take advantage of this by adding custom endpoints.
  • Term Metadata — Taxonomy term metadata is now included in WordPress 4.4. If you’ve already been using a plugin to implement term metadata, you should read this post on how to prepare. Also, the underlying WP_Term class improves caching when working with terms. (#14162)
  • Improved output — wp_title() is now deprecated; WordPress can handle the rendering of the document title automatically.
  • Comments — Comment queries are now split for performance. Also, the underlying WP_Comment class improves caching and introduces strong-typing. (#8071, #32619)

New in WordPress 4.3.1 (Sep 16, 2015)

  • This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
  • This release addresses three issues, including two cross-site scripting vulnerabilities and a potential privilege escalation.
  • WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point.
  • A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team.
  • Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check Point.
  • Our thanks to those who have practiced responsible disclosure of security issues.
  • WordPress 4.3.1 also fixes twenty-six bugs.

New in WordPress 4.3 (Aug 18, 2015)

  • Menus in the Customizer:
  • Create your menu, update it, and assign it, all while live-previewing in the customizer. The streamlined customizer design provides a mobile-friendly and accessible interface. With every release, it becomes easier and faster to make your site just the way you want it.
  • Formatting Shortcuts:
  • Your writing flow just got faster with new formatting shortcuts in WordPress 4.3. Use asterisks to create lists and number signs to make a heading. No more breaking your flow; your text looks great with a * and a #.
  • Site Icons:
  • Site icons represent your site in browser tabs, bookmark menus, and on the home screen of mobile devices. Add your unique site icon in the customizer; it will even stay in place when you switch themes. Make your whole site reflect your brand.
  • Better Passwords:
  • Keep your site more secure with WordPress’ improved approach to passwords. Instead of receiving passwords via email, you’ll get a password reset link. When you add new users to your site or edit a user profile, WordPress will automatically generate a secure password.
  • Other improvements:
  • A smoother admin experience – Refinements to the list view across the admin make your WordPress more accessible and easier to work with on any device.
  • Comments turned off on pages – All new pages that you create will have comments turned off. Keep discussions to your blog, right where they’re supposed to happen.
  • Customize your site quickly – Wherever you are on the front-end, you can click the customize link in the toolbar to swiftly make changes to your site.

New in WordPress 4.2.4 (Aug 4, 2015)

  • This release addresses six issues, including three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise a site.
  • It also includes a fix for a potential timing side-channel attack and prevents an attacker from locking a post from being edited.
  • In addition to the security fixes, WordPress 4.2.4 contains fixes for 4 bugs from 4.2.3, including:
  • FIX - WPDB: When checking the encoding of strings against the database, make sure we're only relying on the return value of strings that were sent to the database. #32279
  • FIX - Don't blindly trust the output of glob() to be an array. #33093
  • FIX - Shortcodes: Handle do_shortcode('

New in WordPress 4.3 RC 1 (Jul 30, 2015)

  • More than 100 changes

New in WordPress 4.2.3 (Jul 23, 2015)

  • A security release for all previous versions and we strongly encourage you to update your sites immediately.
  • WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site. This was reported by Jon Cave and fixed by Robert Chapin, both of the WordPress security team.
  • Fixed an issue where it was possible for a user with Subscriber permissions to create a draft through Quick Draft. Reported by Netanel Rubin from Check Point Software Technologies.
  • WordPress 4.2.3 also contains fixes for 20 bugs from 4.2.

New in WordPress 4.3 Beta 4 (Jul 23, 2015)

  • Fixed several bugs and broken flows in the publish box in the edit screen.
  • Addressed a number of edge cases for word count in the editor.
  • Site icons can now be previewed within the customizer. The feature has been removed from general settings.
  • Various bug fixes. We’ve made more than 60 changes in the last week.

New in WordPress 4.3 Beta 3 (Jul 16, 2015)

  • Performance improvements for Menus in the Customizer, as well as bug fixes and visual enhancements.
  • Added Site Icon to the Customizer. The feature is now complete and requires lots of testing. Please help us ensure the site icon feature works well in both Settings and the Customizer.
  • The improvements to Passwords have been added to the installation flow. When installing and setting up WordPress, a strong password will be suggested to site administrators. Please test and let us know if you encounter issues.
  • Improved accessibility of comments and media list tables. If you use a screen reader, please let us know if you encounter any issues.
  • Lots and lots of code documentation improvements.
  • Various other bug fixes. We’ve made more than 140 changes in the last week.

New in WordPress 4.3 Beta 2 (Jul 9, 2015)

  • Fixed an issue in beta 1 where an alert appeared when saving or publishing a new post/page for the first time.
  • Customizer improvements including enhanced accessibility, smoother menu creation and location assignment, and the ability to handle nameless menus. Please help us test menus in the Customizer to fix any remaining edge cases!
  • More robust list tables with full content support on small screens and a fallback for the primary column for custom list tables. We’d love to know how these list tables, such as All Posts and Comments, work for you now on small screen devices.
  • The Site Icon feature has been improved so that cropping is skipped if the image is the exact size (512px square) and the media modal now suggests a minimum icon size. Please let us know how the flow feels and if you encounter any glitches!
  • The toolbar now has a direct link to the customizer, along with quick access to themes, widgets, and menus in the dashboard.
  • We enabled utf8mb4 for MySQL extension users, which was previously unintentionally limited to MySQLi users. Please let us know if you run into any issues.
  • Various bug fixes. We’ve made almost 100 changes in the last week.

New in WordPress 4.3 Beta 1 (Jul 2, 2015)

  • Menus can now be managed with the Customizer, which allows you to live preview changes you’re making without changing your site for visitors until you’re ready. We’re especially interested to know if this helps streamline the process of setting up your site (#32576).
  • Take control of another piece of your site with the Site Icon feature. You can now manage your site’s favicon and app icon from the admin area (#16434).
  • We put a lot of work into Better Passwords throughout WordPress. Now, WordPress will limit the life time of password resets, no longer send passwords via email, and generate and suggest secure passwords for you. Try it out and let us know what you think! (#32589)
  • We’ve also added Editor Improvements. Certain text patterns are automatically transformed as you type, including * and - transforming into unordered lists, 1. and 1) for ordered lists, > for blockquotes and one to six number signs (#) for headings (#31441).
  • We’ve improved the list view across the admin dashboard. Now, when you view your posts and pages on small screen devices, columns are not truncated and can be toggled into view (#32395).
  • Developers: There have been a few of changes for you to test as well, including:
  • Taxonomy Roadmap: Terms shared across multiple taxonomies will now be split into separate terms on update to 4.3. Please let us know if you hit any snags (#30261).
  • Added singular.php to the template hierarchy as a fallback for single.php and page.php. (#22314).
  • The old Distraction Free Writing code was removed (#30949).
  • List tables now can (and often should) have a primary column defined. We’re working on a fallback for existing custom list tables but right now they likely have some breakage in the aforementioned responsive view (#25408).

New in WordPress 4.2.2 (May 7, 2015)

  • Critical security release for all previous versions and we strongly encourage you to update your sites immediately. Version 4.2.2 addresses two security issues:
  • The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack. All affected themes and plugins hosted on WordPress.org (including the Twenty Fifteen default theme) have been updated today by the WordPress security team to address this issue by removing this nonessential file. To help protect other Genericons usage, WordPress 4.2.2 proactively scans the wp-content directory for this HTML file and removes it. Reported by Robert Abela of Netsparker.
  • WordPress versions 4.2 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. WordPress 4.2.2 includes a comprehensive fix for this issue.
  • The release also includes hardening for a potential cross-site scripting vulnerability when using the visual editor.
  • In addition to the security fixes, WordPress 4.2.2 contains fixes for 13 bugs from 4.2.1, including:
  • Fixes an emoji loading error in IE9 and IE10
  • Fixes a keyboard shortcut for saving from the Visual editor on Mac
  • Fixes oEmbed for YouTube URLs to always expect https
  • Fixes how WordPress checks for encoding when sending strings to MySQL
  • Fixes a bug with allowing queries to reference tables in the dbname.tablename format
  • Lowers memory usage for a regex checking for UTF-8 encoding
  • Fixes an issue with trying change the wrong index in the wp_signups table on utf8mb4 conversion
  • Improves performance of loop detection in _get_term_children()
  • Fixes a bug where attachment URLs were incorrectly being forced to use https in some contexts

New in WordPress 4.2.1 (Apr 28, 2015)

  • A critical security release for all previous versions and we strongly encourage you to update your sites immediately.
  • A few hours ago, the WordPress team was made aware of a cross-site scripting vulnerability, which could enable commenters to compromise a site. The vulnerability was discovered by Jouko Pynnönen.
  • WordPress 4.2.1 has begun to roll out as an automatic background update, for sites that support those.

New in WordPress 4.2 (Apr 24, 2015)

  • An easier way to share content:
  • Press ThisClip it, edit it, publish it. Get familiar with the new and improved Press This. From the Tools menu, add Press This to your browser bookmark bar or your mobile device home screen. Once installed you can share your content with lightning speed. Sharing your favorite videos, images, and content has never been this fast or this easy.
  • Extended character support:
  • Character support for emoji, special charactersWriting in WordPress, whatever your language, just got better. WordPress 4.2 supports a host of new characters out-of-the-box, including native Chinese, Japanese, and Korean characters, musical and mathematical symbols, and hieroglyphs.
  • Don’t use any of those characters? You can still have fun — emoji are now available in WordPress! Get creative and decorate your content with 💙, 🐸, 🐒, 🍕, and all the many other emoji.
  • Switch themes in the Customizer:
  • Browse and preview your installed themes from the Customizer. Make sure the theme looks great with your content, before it debuts on your site.
  • Even more embeds:
  • Paste links from Tumblr.com and Kickstarter and watch them magically appear right in the editor. With every release, your publishing and editing experience get closer together.
  • Streamlined plugin updates:
  • Goodbye boring loading screen, hello smooth and simple plugin updates. Click Update Now and watch the magic happen.
  • utf8mb4 support:
  • Database character encoding has changed from utf8 to utf8mb4, which adds support for a whole range of new 4-byte characters.
  • JavaScript accessibility:
  • You can now send audible notifications to screen readers in JavaScript with wp.a11y.speak(). Pass it a string, and an update will be sent to a dedicated ARIA live notifications area.
  • Shared term splitting:
  • Terms shared across multiple taxonomies will be split when one of them is updated. Find out more in the Plugin Developer Handbook.
  • Complex query ordering:
  • WP_Query, WP_Comment_Query, and WP_User_Query now support complex ordering with named meta query clauses.

New in WordPress 4.1.2 (Apr 22, 2015)

  • A critical security release. WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site.
  • Fixed three other security issues:
  • In WordPress 4.1 and higher, files with invalid or unsafe names could be uploaded. Discovered by Michael Kapfer and Sebastian Kraemer of HSASec.
  • In WordPress 3.9 and higher, a very limited cross-site scripting vulnerability could be used as part of a social engineering attack. Discovered by Jakub Zoczek.
  • Some plugins were vulnerable to an SQL injection vulnerability. Discovered by Ben Bidner of the WordPress security team.

New in WordPress 4.2 RC 1 (Apr 16, 2015)

  • Made more than 140 changes since releasing Beta 4 a week and a half ago.

New in WordPress 4.2 Beta 4 (Apr 4, 2015)

  • Incrementally improved the experience when accessing the Customizer on mobile. Please test on your mobile devices and let us know if anything seems wonky.
  • Added the ability to make admin notices dismissible. Plugin and theme authors: adding .notice and .is-dismissible as adjacent classes to your notice containers should automatically make them dismissible. Please test.
  • Fixed some reported issues with backward-compatibility issues caused by the modularization of core JS files.
  • Removed the ability to swipe the admin menu open and closed on touch devices due to reports of some issues with built-in history navigation on certain platforms.
  • Improved accessibility of the WordPress admin by replacing skip-to-content links with landmark roles. Screen reader users: please test in any core admin screens.
  • Various bug fixes. We’ve made more than 90 changes in the last week.

New in WordPress 4.2 Beta 3 (Mar 27, 2015)

  • Removed Shiny Installs functionality due to concerns about the activation workflow. Please test the remaining “Shiny Updates” functionality from both the Plugins > Add New and Plugins screens to ensure in-line updating still works as well as before.
  • Fixed an issue with the Comments Quick Edit layout breaking on smaller screens. Please test on your mobile devices.
  • Improved accessibility of login screen errors. Screen reader users: please let us know if you encounter any issues.
  • Refined the emoji compatibility script to only load on the front- and back-end if the browser requires it. If you’re using a legacy web browser, please test.
  • Fixed several issues in Press This with inserted images being improperly linked to locations other than the source site. Go ahead, “press” a site with images on the page and tell us if the image links aren’t working as you’d expect.
  • Standardized the time display format in a variety of admin screens, switching to 24-hour notation where a.m. or p.m. are not specified. Please let us know if you notice you notice anything amiss!
  • Various other bug fixes. We’ve made more than 65 changes in the last week.

New in WordPress 4.2 Beta 2 (Mar 20, 2015)

  • Added support for entering FTP and SSH credentials when updating plugins in-place. FTP and SSH users, please test!
  • Improved cross-browser support for emoji throughout WordPress. If you’re using an older web browser, please tell us if you have problems using emoji.
  • Further refined Press This authoring with auto-embedded media and better content scanning. We’d love to know how auto-embeds work for you.
  • Added a constructor and improved method consistency in WP_Comment_Query. Developers: if you’re extending WP_Comment_Query, please let us know if you run into any issues.
  • Various bug fixes. We’ve made more than 70 changes in the last week.

New in WordPress 4.2 Beta 1 (Mar 13, 2015)

  • Press This has been completely revamped to make sharing content from around the web easier than ever. The new workflow is mobile friendly, and we’d love for you to try it out on all of your devices. Navigate to the Tools screen in your WordPress backend to get started (#31373).
  • Browsing and switching installed themes has been added to the Customizer to make switching faster and more convenient. We’re especially interested to know if this helps streamline the process of setting up your site (#31303).
  • The workflow for updating and installing plugins just got more intuitive with the ability to install or update in-place from the Plugins screens. Try it out and let us know what you think! (#29820)
  • If you felt like emoji were starkly missing from your content toolbox, worry no more. We’ve added emoji support nearly everywhere, even post slugs 👍 (#31242).
  • Taxonomy Roadmap: Terms shared across multiple taxonomies will now be split into separate terms when one of them is updated. Please let us know if you hit any snags (#5809).
  • New wp.a11y.speak() functionality helps your JavaScript talk to screen readers to better inform impaired users what’s happening on-screen. Try it out in your plugin or theme and let us know if you notice any adverse affects (#31368).
  • Named clause support has been added to WP_Query, WP_Comment_Query, and WP_User_Query, allowing specific meta_query clauses to be used with orderby. If you have any complex queries, please test them (#31045, #31265).

New in WordPress 4.1.1 (Feb 19, 2015)

  • Fixes 21 bugs in version 4.1.

New in WordPress 4.1 (Dec 19, 2014)

  • INTRODUCING TWENTY FIFTEEN:
  • Our newest default theme, Twenty Fifteen, is a blog-focused theme designed for clarity.
  • Twenty Fifteen has flawless language support, with help from Google’s Noto font family.
  • The straightforward typography is readable on any screen size.
  • Your content always takes center stage, whether viewed on a phone, tablet, laptop, or desktop computer.
  • DISTRACTION-FREE WRITING:
  • Just write.
  • Sometimes, you just need to concentrate on putting your thoughts into words. Try turning on distraction-free writing mode. When you start typing, all the distractions will fade away, letting you focus solely on your writing. All your editing tools instantly return when you need them.
  • THE FINER POINTS:
  • Choose a language:
  • Right now, WordPress 4.1 is already translated into over forty languages, with more always in progress. You can switch to any translation on the General Settings screen.
  • Log out everywhere:
  • If you’ve ever worried you forgot to sign out from a shared computer, you can now go to your profile and log out everywhere.
  • Vine embeds:
  • Embedding videos from Vine is as simple as pasting a URL onto its own line in a post. See the full list of supported embeds.
  • Plugin recommendations:
  • The plugin installer suggests plugins for you to try. Recommendations are based on the plugins you and other users have installed.
  • UNDER THE HOOD:
  • Complex Queries:
  • Metadata, date, and term queries now support advanced conditional logic, like nested clauses and multiple operators — A AND ( B OR C ).
  • Customizer API:
  • The customizer now supports conditionally showing panels and sections based on the page being previewed.
  • tags in themes:
  • add_theme_support( 'title-tag' ) tells WordPress to handle the complexities of document titles.
  • Developer Reference:
  • Continued improvements to inline code documentation have made the developer reference more complete than ever.

New in WordPress 4.0.1 (Nov 21, 2014)

  • Addresses these eight security issues:
  • Three cross-site scripting issues that a contributor or author could use to compromise a site. Discovered by Jon Cave, Robert Chapin, and John Blackbourn of the WordPress security team.
  • A cross-site request forgery that could be used to trick a user into changing their password.
  • An issue that could lead to a denial of service when passwords are checked. Reported by Javier Nieto Arevalo and Andres Rojas Guerrero.
  • Additional protections for server-side request forgery attacks when WordPress makes HTTP requests. Reported by Ben Bidner (vortfu).
  • An extremely unlikely hash collision could allow a user’s account to be compromised, that also required that they haven’t logged in since 2008 (I wish I were kidding). Reported by David Anderson.
  • WordPress now invalidates the links in a password reset email if the user remembers their password, logs in, and changes their email address. Reported separately by Momen Bassel, Tanoy Bose, and Bojan Slavković of ManageWP.
  • Version 4.0.1 also fixes 23 bugs with 4.0, and we’ve made two hardening changes, including better validation of EXIF data we are extracting from uploaded photos.

New in WordPress 4.1 Beta 1 (Nov 15, 2014)

  • New default theme, Twenty Fifteen. It’s a clean, mobile-first, blog-focused theme designed through simplicity.
  • A new distraction-free writing mode for the editor. It’s enabled by default for beta, and we’d love feedback on it.
  • The ability to automatically install new language packs right from the General Settings screen (available as long as your site’s filesystem is writable).
  • A new inline formatting toolbar for images embedded into posts.
  • There have been a lot of changes for developers to test as well:
  • Improvements to meta, date, comment, and taxonomy queries, including complex (nested, multiple relation) queries; and querying comment types (#12668).
  • A single term shared across multiple taxonomies is now split into two when updated. For more, see this post, #5809, and #30335.
  • A new and better way for themes to handle title tags.
  • Several improvements to the Customizer API, including contextual panels and sections, and JavaScript templates for controls.

New in WordPress 4.0 (Sep 5, 2014)

  • Brings you a smoother writing and management experience.
  • Manage your media with style:
  • Explore your uploads in a beautiful, endless grid. A new details preview makes viewing and editing any amount of media in sequence a snap.
  • Working with embeds has never been easier
  • Paste in a YouTube URL on a new line, and watch it magically become an embedded video. Now try it with a tweet. Oh yeah — embedding has become a visual experience. The editor shows a true preview of your embedded content, saving you time and giving you confidence.
  • We’ve expanded the services supported by default, too — you can embed videos from CollegeHumor, playlists from YouTube, and talks from TED. Check out all of the embeds that WordPress supports.
  • Focus on your content:
  • Writing and editing is smoother and more immersive with an editor that expands to fit your content as you write, and keeps the formatting tools available at all times.
  • Add plugins:
  • There are more than 30,000 free and open source plugins in the WordPress plugin directory. WordPress 4.0 makes it easier to find the right one for your needs, with new metrics, improved search, and a more visual browsing experience.

New in WordPress 4.0 Beta 4 (Aug 16, 2014)

  • Further improvements to the editor scrolling experience, especially when it comes to the second column of boxes.
  • Better handling of small screens in the media library modals.
  • A separate bulk selection mode for the media library grid view.
  • Improvements to the installation language selector.
  • Visual tweaks to plugin details and customizer panels.

New in WordPress 3.9.2 (Aug 7, 2014)

  • Fixes a possible denial of service issue in PHP’s XML processing, reported by Nir Goldshlager of the Salesforce.com Product Security Team. It was fixed by Michael Adams and Andrew Nacin of the WordPress security team and David Rothstein of the Drupal security team. This is the first time our two projects have coordinated joint security releases.
  • Contains other security changes:
  • Fixes a possible but unlikely code execution when processing widgets (WordPress is not affected by default), discovered by Alex Concha of the WordPress security team.
  • Prevents information disclosure via XML entity attacks in the external GetID3 library, reported by Ivan Novikov of ONSec.
  • Adds protections against brute attacks against CSRF tokens, reported by David Tomaschik of the Google Security Team.
  • Contains some additional security hardening, like preventing cross-site scripting that could be triggered only by administrators.

New in WordPress 4.0 Beta 2 (Jul 19, 2014)

  • Further refinements for the the plugin installation and media library experiences.
  • Updated TinyMCE, which now includes better indentation for lists and the restoration of the color picker.
  • Cookies are now tied to a session internally, so if you have trouble logging in, #20276 may be the culprit.
  • Various bug fixes (there were nearly 170 changes since last week).

New in WordPress 4.0 Beta 1 (Jul 10, 2014)

  • Previews of embedding via URLs in the visual editor and the “Insert from URL” tab in the media modal. Try pasting a URL (such as a WordPress.tv or YouTube video) onto its own line in the visual editor. (#28195, #15490)
  • The Media Library now has a “grid” view in addition to the existing list view. Clicking on an item takes you into a modal where you can see a larger preview and edit information about that attachment, and you can navigate between items right from the modal without closing it. (#24716)
  • We’re freshening up the plugin install experience. You’ll see some early visual changes as well as more information when searching for plugins and viewing details. (#28785, #27440)
  • Selecting a language when you run the installation process. (#28577)
  • The editor intelligently resizes and its top and bottom bars pin when needed. Browsers don’t like to agree on where to put things like cursors, so if you find a bug here, please also let us know your browser and operating system. (#28328)
  • Made some improvements to how your keyboard and cursor interact with TinyMCE views such as the gallery preview. Much like the editor resizing and scrolling improvements, knowing about your setup is particularly important for bug reports here. (#28595)
  • Widgets in the Customizer are now loaded in a separate panel. (#27406)
  • Also made some changes to some formatting functions, so if you see quotes curling in the wrong direction, please file a bug report.

New in WordPress 3.9.1 (May 9, 2014)

  • Fixes 34 bugs in 3.9, including numerous fixes for multisite networks, customizing widgets while previewing themes, and the updated visual editor.
  • Made some improvements to the new audio/video playlists feature and made some adjustments to improve performance.

New in WordPress 3.9 (Apr 17, 2014)

  • A SMOOTHER MEDIA EDITING EXPERIENCE:
  • Improved visual editing:
  • The updated visual editor has improved speed, accessibility, and mobile support. You can paste into the visual editor from your word processor without wasting time to clean up messy styling. (Yeah, we’re talking about you, Microsoft Word.)
  • Edit images easily:
  • With quicker access to crop and rotation tools, it’s now much easier to edit your images while editing posts. You can also scale images directly in the editor to find just the right fit.
  • Drag and drop your images:
  • Uploading your images is easier than ever. Just grab them from your desktop and drop them in the editor.
  • GALLERY PREVIEWS:
  • Galleries display a beautiful grid of images right in the editor, just like they do in your published post.
  • DO MORE WITH AUDIO AND VIDEO:
  • Images have galleries; now we’ve added simple audio and video playlists, so you can showcase your music and clips.
  • LIVE WIDGET AND HEADER PREVIEWS:
  • Add, edit, and rearrange your site’s widgets right in the theme customizer. No “save and surprise” — preview your changes live and only save them when you’re ready.
  • The improved header image tool also lets you upload, crop, and manage headers while customizing your theme.
  • STUNNING NEW THEME BROWSER:
Looking for a new theme should be easy and fun. Lose yourself in the boundless supply of free WordPress.org themes with the beautiful new theme browser.

New in WordPress 3.9 RC 2 (Apr 15, 2014)

  • Made about five dozen changes since the first release candidate.
  • Probably the biggest fixes are to live widget previews and the new theme browser, along with some extra TinyMCE compatibility and some RTL fixes.

New in WordPress 3.8.3 (Apr 15, 2014)

  • Fixes a small but unfortunate bug in the WordPress 3.8.2 security release.

New in WordPress 3.9 RC 1 (Apr 9, 2014)

  • If you’re a plugin author, there are two important changes in particular to be aware of:
  • TinyMCE received a major update, to version 4.0. Any editor plugins written for TinyMCE 3.x might require some updates. (If things broke, we’d like to hear about them so we can make adjustments.) For more, see TinyMCE’s migration guide and API documentation, and the notes on the core development blog.
  • WordPress 3.9 now uses the MySQLi Improved extension for sites running PHP 5.5. Any plugins that made direct calls to mysql_* functions will experience some problems on these sites. For more information, see the notes on the core development blog.

New in WordPress 3.8.2 (Apr 9, 2014)

  • This releases fixes a weakness that could let an attacker force their way into your site by forging authentication cookies.
  • It also contains a fix to prevent a user with the Contributor role from improperly publishing posts.
  • This release also fixes nine bugs and contains three other security hardening changes:
  • Pass along additional information when processing pingbacks to help hosts identify potentially abusive requests
  • Fix a low-impact SQL injection by trusted users. Reported by Tom Adams of dxw
  • Prevent possible cross-domain scripting through Plupload, the third-party library WordPress uses for uploading files.

New in WordPress 3.9 Beta 3 (Mar 31, 2014)

  • More than 200 changes, including:
  • New features like live widget previews and the new theme installer are now more ready for prime time, so check ‘em out.
  • UI refinements when editing images and when working with media in the editor. We’ve also brought back some of the advanced display settings for images.
  • If you want to test out audio and video playlists, the links will appear in the media manager once you’ve uploaded an audio or video file.
  • For theme developers, we’ve added HTML5 caption support (#26642) to match the new gallery support (#26697).
  • The formatting function that turns straight quotes into smart quotes (among other things) underwent some changes to drastically speed it up, so let us know if you see anything weird.

New in WordPress 3.9 Beta 2 (Mar 20, 2014)

  • Rendering of embedded audio and video players directly in the visual editor.
  • Visual and functional improvements to the editor, the media manager, and theme installer.
  • Various bug fixes to TinyMCE, the software behind the visual editor.
  • Lots of fixes to widget management in the theme customizer.

New in WordPress 3.9 Beta 1 (Mar 12, 2014)

  • Updated TinyMCE, the software powering the visual editor, to the latest version. Be on the lookout for cleaner markup. Also try the new paste handling — if you paste in a block of text from Microsoft Word, for example, it will no longer come out terrible. (The “Paste from Word” button you probably never noticed has been removed.) It’s possible some plugins that added stuff to the visual editor (like a new toolbar button) no longer work, so we’d like to hear about them (#24067). (And be sure to open a support thread for the plugin author.)
  • Added widget management to live previews (the customizer). Please test editing, adding, and rearranging widgets! (#27112) We’ve also added the ability to upload, crop, and manage header images, without needing to leave the preview. (#21785)
  • Brought 3.8′s beautiful new theme browsing experience to the theme installer. Check it out! (#27055)
  • Galleries now receive a live preview in the editor. Upload some photos and insert a gallery to see this in action. (#26959)
  • You can now drag-and-drop images directly onto the editor to upload them. It can be a bit finicky, so try it and help us work out the kinks. (#19845)
  • Some things got improved around editing images. It’s a lot easier to make changes to an image after you insert it into a post (#24409) and you no longer get kicked to a new window when you need to crop or rotate an image (#21811).
  • New audio/video playlists. Upload a few audio or video files to test these. (#26631)

New in WordPress 3.8.1 (Jan 24, 2014)

  • A maintenance releases that addresses 31 bugs in 3.8, including various fixes and improvements for the new dashboard design and new themes admin screen.
  • An issue with taxonomy queries in WP_Query was resolved. And if you’ve been frustrated by submit buttons that won’t do anything when you click on them (or thought you were going crazy, like some of us), we’ve found and fixed this “dead zone” on submit buttons.
  • It also contains a fix for embedding tweets (by placing the URL to the tweet on its own line), which was broken due to a recent Twitter API change.

New in WordPress 3.8 (Dec 13, 2013)

  • Named “Parker” in honor of Charlie Parker, bebop innovator
  • Introducing a modern new design:
  • WordPress has gotten a facelift. 3.8 brings a fresh new look to the entire admin dashboard. Gone are overbearing gradients and dozens of shades of grey — bring on a bigger, bolder, more colorful design!
  • about-modern-wordpress
  • Modern aesthetic - The new WordPress dashboard has a fresh, uncluttered design that embraces clarity and simplicity.
  • Clean typography - The Open Sans typeface provides simple, friendly text that is optimized for both desktop and mobile viewing. It’s even open source, just like WordPress.
  • Refined contrast - We think beautiful design should never sacrifice legibility. With superior contrast and large, comfortable type, the new design is easy to read and a pleasure to navigate.
  • WordPress on every device:
  • We all access the internet in different ways. Smartphone, tablet, notebook, desktop — no matter what you use, WordPress will adapt and you’ll feel right at home.
  • High definition at high speed:
  • WordPress is sharper than ever with new vector-based icons that scale to your screen. By ditching pixels, pages load significantly faster, too.
  • Admin color schemes to match your personality
  • WordPress just got a colorful new update. We’ve included eight new admin color schemes so you can pick the one that suits you best.
  • Color schemes can be previewed and changed from your Profile page.
  • Refined theme management:
  • The new themes screen lets you survey your themes at a glance. Or want more information? Click to discover more. Then sit back and use your keyboard’s navigation arrows to flip through every theme you’ve got.
  • Smoother widget experience:
  • Drag-drag-drag. Scroll-scroll-scroll. Widget management can be complicated. With the new design, we’ve worked to streamline the widgets screen.
  • Have a large monitor? Multiple widget areas stack side-by-side to use the available space. Using a tablet? Just tap a widget to add it.
  • Twenty Fourteen, a sleek new magazine theme
  • The new Twenty Fourteen theme displayed on a laptop. tablet and phone
  • Turn your blog into a magazine:
  • Create a beautiful magazine-style site with WordPress and Twenty Fourteen. Choose a grid or a slider to display featured content on your homepage. Customize your site with three widget areas or change your layout with two page templates.
  • With a striking design that does not compromise our trademark simplicity, Twenty Fourteen is our most intrepid default theme yet.

New in WordPress 3.8 Beta 1 (Nov 22, 2013)

  • The new admin design, especially the responsive aspect of it. Try it out on different devices and browsers, see how it goes, especially the more complex pages like widgets or seldom-looked-at-places like Press This. Color schemes, which you can change on your profile, have also been spruced up.
  • The dashboard homepage has been refreshed, poke and prod it.
  • Choosing themes under Appearance is completely different, try to break it however possible.
  • There’s a new default theme, Twenty Fourteen.
  • Over 250 issues closed already.

New in WordPress 3.7.1 (Nov 8, 2013)

  • This maintenance release addresses 11 bugs in WordPress 3.7, including:
  • Images with captions no longer appear broken in the visual editor.
  • Allow some sites running on old or poorly configured servers to continue to check for updates from WordPress.org.
  • Avoid fatal errors with certain plugins that were incorrectly calling some WordPress functions too early.
  • Fix hierarchical sorting in get_pages(), exclusions in wp_list_categories(), and in_category() when called with empty values.
  • Fix a warning that may occur in certain setups while performing a search, and a few other notices.

New in WordPress 3.7 (Oct 28, 2013)

  • This release features some of the most important architectural updates we’ve made to date. Here are the big ones:
  • Updates while you sleep: With WordPress 3.7, you don’t have to lift a finger to apply maintenance and security updates. Most sites are now able to automatically apply these updates in the background. The update process also has been made even more reliable and secure, with dozens of new checks and safeguards.
  • Stronger password recommendations: Your password is your site’s first line of defense. It’s best to create passwords that are complex, long, and unique. To that end, our password meter has been updated in WordPress 3.7 to recognize common mistakes that can weaken your password: dates, names, keyboard patterns (123456789), and even pop culture references.
  • Better global support: Localized versions of WordPress will receive faster and more complete translations. WordPress 3.7 adds support for automatically installing the right language files and keeping them up to date, a boon for the many millions who use WordPress in a language other than English.
  • For developers there are lots of options around how to control the new updates feature, including allowing it to handle major upgrades as well as minor ones, more sophisticated date query support, and multisite improvements.

New in WordPress 3.7 RC 1 (Oct 23, 2013)

  • Automatic background updates for security and minor releases will update every 12 hours or so to the latest development version, and then email you the results.

New in WordPress 3.7 Beta 1 (Sep 30, 2013)

  • If you’re running WordPress in another language, we’ll automatically download any available translations for official WordPress importers and the default themes. (More to come here.)
  • Our password meter got a whole lot better, thanks to Dropbox’s zxcvbn library. Again, subtle but effective. Strong passwords are very important!
  • Search results are now ordered by relevance, rather than just by date. When your keywords match post titles and not just content, they’ll be pushed to the top.
  • Developers should check out the new advanced date queries in WP_Query.

New in WordPress 3.6.1 (Sep 12, 2013)

  • Block unsafe PHP unserialization that could occur in limited situations and setups, which can lead to remote code execution.
  • Prevent a user with an Author role, using a specially crafted request, from being able to create a post “written by” another user.
  • Fix insufficient input validation that could result in redirecting or leading a user to another website.

New in WordPress 3.6 (Aug 2, 2013)

  • Highlights:
  • Includes a beautiful new blog-centric theme, bullet-proof autosave and post locking, a revamped revision browser, native support for audio and video embeds, and improved integrations with Spotify, Rdio, and SoundCloud.
  • User Features:
  • The new Twenty Thirteen theme inspired by modern art puts focus on your content with a colorful, single-column design made for media-rich blogging.
  • Revamped Revisions save every change and the new interface allows you to scroll easily through changes to see line-by-line who changed what and when.
  • Post Locking and Augmented Autosave will especially be a boon to sites where more than a single author is working on a post. Each author now has their own autosave stream, which stores things locally as well as on the server (so much harder to lose something) and there’s an interface for taking over editing of a post, as demonstrated beautifully by our bearded buddies in the video above.
  • Built-in HTML5 media player for native audio and video embeds with no reliance on external services.
  • The Menu Editor is now much easier to understand and use.
  • Developer features:
  • A new audio/video API gives you access to metadata like ID3 tags.
  • You can now choose HTML5 markup for things like comment and search forms, and comment lists.
  • Better filters for how revisions work, so you can store a different amount of history for different post types.
  • Tons more listed on the Codex, and of course you can always browse the over 700 closed tickets.

New in WordPress 3.6 RC 2 (Jul 30, 2013)

  • Revisions so smooth
  • We autosave your changes
  • Data loss begone!

New in WordPress 3.5.2 (Jun 22, 2013)

  • This is the second maintenance release of 3.5, fixing 12 bugs.
  • This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
  • The WordPress security team resolved seven security issues, and this release also contains some additional security hardening.
  • The security fixes included:
  • Blocking server-side request forgery attacks, which could potentially enable an attacker to gain access to a site.
  • Disallow contributors from improperly publishing posts, reported by Konstantin Kovshenin, or reassigning the post’s authorship, reported by Luke Bryan.
  • An update to the SWFUpload external library to fix cross-site scripting vulnerabilities. Reported by mala and Szymon Gruszecki.
  • Prevention of a denial of service attack, affecting sites using password-protected posts.
  • An update to an external TinyMCE library to fix a cross-site scripting vulnerability. Reported by Wan Ikram.
  • Multiple fixes for cross-site scripting. Reported by Andrea Santese and Rodrigo.
  • Avoid disclosing a full file path when a upload fails. Reported by Jakub Galczyk.

New in WordPress 3.6 Beta 3 (May 11, 2013)

  • Contains about a hundred changes, including improvements to the image Post Format flow (yay, drag-and-drop image upload!)
  • A more polished revision comparison screen
  • A more quote-like quote format for Twenty Thirteen.
  • Now has oEmbed support for the popular music-streaming services Rdio and Spotify.

New in WordPress 3.6 Beta 2 (Apr 30, 2013)

  • Contains a modified approach for format choosing and switching.
  • Made the Post Formats UI hide-able via Screen Options, and set a reasonable default based on what your theme supports.
  • A lot of bug fixes and polishing tweaks.

New in WordPress 3.6 Beta 1 (Apr 5, 2013)

  • Post Formats: Post Formats now have their own UI, and theme authors have access to templating functions to access the structured data.
  • Twenty Thirteen: We’re shipping this year’s default theme in our first release of the year. Twenty Thirteen is an opinionated, color-rich, blog-centric theme that makes full use of the new Post Formats support.
  • Audio/Video: You can embed audio and video files into your posts without relying on a plugin or a third party media hosting service.
  • Autosave: Posts are now autosaved locally. If your browser crashes, your computer dies, or the server goes offline as you’re saving, you won’t lose the your post.
  • Post Locking: See when someone is currently editing a post, and kick them out of it if they fall asleep at the keyboard.
  • Nav Menus: Nav menus have been simplified with an accordion-based UI, and a separate tab for bulk-assigning menus to locations.
  • Revisions: The all-new revisions UI features avatars, a slider that “scrubs” through history, and two-slider range comparisons.

New in WordPress 3.5.1 (Jan 25, 2013)

  • A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We’d like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work.
  • Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team.
  • A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue.

New in WordPress 3.5 (Dec 12, 2012)

  • The most dramatic new change you’ll notice is a completely re-imagined flow for uploading photos and creating galleries. Media has long been a friction point and we’ve listened hard and given a lot of thought into crafting this new system.
  • Includes a new default theme, Twenty Twelve, which has a very clean mobile-first responsive design and works fantastic as a base for a CMS site.
  • Refreshed the styles of the dashboard, updating everything to be Retina-ready with beautiful high resolution graphics, a new color picker, and streamlining a couple of fewer-used sections of the admin.

New in WordPress 3.5 RC3 (Dec 4, 2012)

  • Final UI improvements for the new media manager, based on lots of great feedback.
  • Show more information about uploading errors when they occur.
  • When inserting an image into a post, don’t forget the alternative text.
  • Fixes for the new admin button styles.
  • Improvements for mobile devices, Internet Explorer, and right-to-left languages.
  • Fix cookies for subdomain installs when multisite is installed in a subdirectory.
  • Fix ms-files.php rewriting for very old multisite installs.

New in WordPress 3.5 Beta 3 (Nov 13, 2012)

  • The Add Media dialog is complete.
  • Also updated to jQuery UI 1.9.1, SimplePie 1.3.1, and TinyMCE 3.5.7.

New in WordPress 3.5 Beta 2 (Oct 13, 2012)

  • New workflow for working with image galleries, including drag-and-drop reordering and quick caption editing.
  • New user interface for setting static front pages for the Reading Settings screen.
  • New image editing API.

New in WordPress 3.5 Beta 1 (Sep 28, 2012)

  • Appearance: A simplified welcome screen. A new color picker. And the all-HiDPI (retina) dashboard.
  • Accessibility: Keyboard navigation and screen reader support have both been improved.
  • Plugins: You can browse and install plugins you’ve marked as favorites on WordPress.org, directly from your dashboard.
  • Mobile: It’ll be easier to link up your WordPress install with our mobile apps, as XML-RPC is now enabled by default.
  • Links: We’ve hidden the Link Manager for new installs.
  • External libraries updated: TinyMCE 3.5.6. SimplePie 1.3. jQuery 1.8.2. jQuery UI 1.9 (and it’s not even released yet). We’ve also added Backbone 0.9.2 and Underscore 1.3.3, and you can use protocol-relative links when enqueueing scripts and styles. (#16560)
  • WP Query: You can now ask to receive posts in the order specified by post__in. (#13729)
  • XML-RPC: New user management, profile editing, and post revision methods. We’ve also removed AtomPub. (#18428, #21397, #21866)
  • Multisite: switch_to_blog() is now used in more places, is faster, and more reliable. Also: You can now use multisite in a subdirectory, and uploaded files no longer go through ms-files (for new installs). (#21434, #19796, #19235)
  • TinyMCE: We’ve added API support for “views” which you can use to offer previews and interaction of elements from the visual editor. (#21812)
  • Posts API: Major performance improvements when working with hierarchies of pages and post ancestors. Also, you can now “turn on” native custom columns for taxonomies on edit post screens. (#11399, #21309, #21240)
  • Comments API: Search for comments of a particular status, or with a meta query (same as with WP_Query). (#21101, #21003)
  • oEmbed: We’ve added support for a few oEmbed providers, and we now handle SSL links. (#15734, #21635, #16996, #20102)

New in WordPress 3.4.2 (Sep 7, 2012)

  • Fix some issues with older browsers in the administration area.
  • Fix an issue where a theme may not preview correctly, or its screenshot may not be displayed.
  • Improve plugin compatibility with the visual editor.
  • Address pagination problems with some category permalink structures.
  • Avoid errors with both oEmbed providers and trackbacks.
  • Prevent improperly sized header images from being uploaded.
  • Also fixes a few security issues and contains some security hardening. The vulnerabilities included potential privilege escalation and a bug that affects multisite installs with untrusted users. These issues were discovered and fixed by the WordPress security team.

New in WordPress 3.4.1 (Jun 28, 2012)

  • Fixes an issue where a theme’s page templates were sometimes not detected.
  • Addresses problems with some category permalink structures.
  • Better handling for plugins or themes loading JavaScript incorrectly.
  • Adds early support for uploading images on iOS 6 devices.
  • Allows for a technique commonly used by plugins to detect a network-wide activation.
  • Better compatibility with servers running certain versions of PHP (5.2.4, 5.4) or with uncommon setups (safe mode, open_basedir), which had caused warnings or in some cases prevented emails from being sent.
  • Fixes a few security issues and contains some security hardening. The vulnerabilities included potential information disclosure as well as an bug that affects multisite installs with untrusted users.

New in WordPress 3.4 (Jun 14, 2012)

  • Includes significant improvements to theme customization, custom headers, Twitter embeds, and image captions.
  • For Users:
  • The biggest change in 3.4 is the theme customizer which allows you to play around with various looks and settings for your current theme or one you’re thinking about switching to without publishing those changes to the whole world. For themes that support it, you can change colors, backgrounds, and of course custom image headers. We have more planned for the customizer down the road.
  • Throughout the rest of the admin you’ll notice tweaks to make your everyday life easier. For example, if you have lots of themes we’ve made it quicker to browse them all at once without paging. We’ve made it possible to use images from your media library to populate custom headers, and for you to choose the height and width of your header images.
  • Expanded the embed support to include tweets: just put a Twitter permalink on its own line in the post editor and we’ll turn it into a beautiful embedded Tweet. And finally, image captions have been improved to allow HTML, like links, in them.
  • For Developers:
  • There are hundreds of under-the-hood improvements in this release, notably in the XML-RPC, themes, and custom header APIs, and significant performance improvements in WP_Query and the translation system. The Codex has a pretty good summary of the developer features, and you can always dive into Trac directly.

New in WordPress 3.4 RC 3 (Jun 12, 2012)

  • Fixed a few lingering issues with the new live preview feature, as well as with custom headers and backgrounds.

New in WordPress 3.4 Beta 4 (May 3, 2012)

  • Less bugs, more polish

New in WordPress 3.4 Beta 3 (Apr 21, 2012)

  • Nearly 90 changes have been made since Beta 2.

New in WordPress 3.3.2 (Apr 21, 2012)

  • A security update for all previous versions.
  • Three external libraries included in WordPress received security updates:
  • Plupload (version 1.5.4), which WordPress uses for uploading media.
  • SWFUpload, which WordPress previously used for uploading media, and may still be in use by plugins.
  • SWFObject, which WordPress previously used to embed Flash content, and may still be in use by plugins and themes.
  • Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances, disclosed by Jon Cave of our WordPress core security team, and Adam Backstrom.
  • Cross-site scripting vulnerability when making URLs clickable, by Jon Cave.
  • Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs. Thanks to Mauro Gentile for responsibly disclosing these issues to the security team.

New in WordPress 3.4 Beta 2 (Apr 12, 2012)

  • Committed more than 60 bug fixes and feature adjustments based on testing and feedback.

New in WordPress 3.4 Beta 1 (Apr 5, 2012)

  • New:
  • Theme Customizer with Previewer
  • Flexible Custom Header Sizes
  • Selecting Custom Header and Background Images from Media Library
  • Better experience searching for and choosing a theme
  • And some of the under-the-hood changes:
  • New XML-RPC API for external and mobile applications
  • New API for registering theme support for custom headers and backgrounds
  • Performance improvements to WP_Query by splitting the query (Please test!)
  • Internationalization improvements (improved performance and locale support)
  • Performance and API improvements when working with lists of installed themes
  • Support for installing child themes from the WordPress Themes Directory

New in WordPress 3.3.1 (Jan 4, 2012)

  • Fixes 15 issues with WordPress 3.3, as well as a fix for a cross-site scripting vulnerability that affected version 3.3.

New in WordPress 3.3 (Dec 13, 2011)

  • For Users - Experienced users will appreciate the new drag-and-drop uploader, hover menus for the navigation, the new toolbar, improved co-editing support, and the new Tumblr importer. We’ve also been thinking a ton about what the WordPress experience is like for people completely new to the software. Version 3.3 has significant improvements there with pointer tips for new features included in each update, a friendly welcome message for first-time users, and revamped help tabs throughout the interface. Finally we’ve improved the dashboard experience on the iPad and other tablets with better touch support.
  • For Developers - There is a ton of candy for developers as well. I’d recommend starting your exploration with the new editor API, new jQuery version, better ways to hook into the help screens, more performant post-slug-only permalinks, and of course the entire list of improvements on the Codex and in Trac.

New in WordPress 3.3 Beta 4 (Nov 25, 2011)

  • Fixed a bunch of bugs
  • Cleaned up the UI
  • Added real text in some of the screens that still had placeholder text in Beta 3 (post-update screen, the Dashboard welcome area, new feature pointers), and generally tightened things up.

New in WordPress 3.3 Beta 2 (Oct 20, 2011)

  • Updated the Blue theme
  • Fixed IE7 and RTL support
  • Improved flyout menu styling and fixed several glitches
  • Finished the Pointers implementation
  • Landed the dashboard Welcome box for new installs
  • Improved contextual help styling
  • Tweaked the admin bar a little more
  • Fixed a bunch of bugs

New in WordPress 3.3 Beta 1 (Oct 11, 2011)

  • Media uploader
  • Improved admin bar
  • Fly out admin menus

New in WordPress 3.2.1 (Jul 13, 2011)

  • A maintenance release fixes a server incompatibility related to JSON that’s unfortunately affected some of you, as well as a few other fixes in the new dashboard design and the Twenty Eleven theme.

New in WordPress 3.2 (Jul 5, 2011)

  • Refreshed dashboard design.
  • Faster and lighter.
  • Distraction-free writing or zen mode.
  • New Twenty Eleven theme.

New in WordPress 3.2 RC3 (Jun 30, 2011)

  • Contains all of the fixes in 3.1.4; few minor RTL, JavaScript, and user interface fixes; and ensures graceful failures if 3.2 is run on PHP4.

New in WordPress 3.2 RC2 (Jun 25, 2011)

  • Handled a number of issues since RC1, including additional Twenty Eleven tweaks, a new theme support option for defaulting to randomized headers, and various RTL fixes.

New in WordPress 3.2 RC1 (Jun 14, 2011)

  • More than 350 tickets closed

New in WordPress 3.2 Beta 2 (May 26, 2011)

  • Google Chrome Frame is now supported in the admin, if you have it installed. This is especially useful for IE 6 users (remember, IE 6 is otherwise deprecated for the admin).
  • The admin is less ugly in IE 7.
  • The blue admin color scheme has caught up to the grey one, and is ready for testing.

New in WordPress 3.1.3 (May 26, 2011)

  • Various security hardening by Alexander Concha.
  • Taxonomy query hardening by John Lamansky.
  • Prevent sniffing out user names of non-authors by using canonical redirects. Props Verónica Valeros.
  • Media security fixes by Richard Lundeen of Microsoft, Jesse Ou of Microsoft, and Microsoft Vulnerability Research.
  • Improves file upload security on hosts with dangerous security settings.
  • Cleans up old WordPress import files if the import does not finish.
  • Introduce “clickjacking” protection in modern browsers on admin and login pages.

New in WordPress 3.2 Beta 1 (May 12, 2011)

  • Performance improvements like you wouldn’t believe. What’s that mean? Things are faster!
  • Distraction-free Writing. The visual editor’s full-screen composing experience has gotten a major overhaul, and is now available from HTML mode, too. More than ever, WordPress allows you to focus on what matters most — your content.
  • Admin UI Refresh. The last major redesign of the WordPress admin was in 2008. This isn’t a major redesign, just a little facelift to keep us feeling young. WordPress turns 8 later this month, you know.
  • New Default Theme. Introducing Twenty Eleven, based on the popular Duster theme. Rotating header images, post format support, and more.
  • Browse Happy. WordPress is made to work with modern browsers. If you visit your Dashboard using an outdated web browser, we’ll let you know there’s a newer version available.
  • Admin Bar. We’ve added more links to the admin bar to make it even more useful.

New in WordPress 3.1.2 (Apr 26, 2011)

  • A security release for all previous WordPress versions.
  • This release addresses a vulnerability that allowed Contributor-level users to improperly publish posts.
  • The issue was discovered by a member of our security team, WordPress developer Andrew Nacin, with Benjamin Balter.
  • The developers suggest you update to 3.1.2 promptly, especially if you allow users to register as contributors or if you have untrusted users. This release also fixes a few bugs that missed the boat for version 3.1.1.

New in WordPress 3.1 (Feb 24, 2011)

  • WordPress 3.1 “Reinhardt” is named in honor of the jazz guitarist Django Reinhardt.
  • This release features a lightning fast redesigned linking workflow which makes it easy to link to your existing posts and pages, an admin bar so you’re never more than a click away from your most-used dashboard pages, a streamlined writing interface that hides many of the seldom-used panels by default to create a simpler and less intimidating writing experience for new bloggers (visit Screen Options in the top right to get old panels back), and a refreshed blue admin scheme available for selection under your personal options.
  • There’s a bucket of candy for developers as well, including our new Post Formats support which makes it easy for themes to create portable tumblelogs with different styling for different types of posts, new CMS capabilities like archive pages for custom content types, a new Network Admin, an overhaul of the import and export system, and the ability to perform advanced taxonomy and custom fields queries.

New in WordPress 3.1 RC 4 (Feb 8, 2011)

  • includes the security fixes and enhancements included in 3.0.5 and addresses about two dozen additional bugs.
  • Includes fixes for:
  • Deleting a user and reassigning their posts to another user.
  • Marking multiple users or sites as spam in multisite.
  • PHP4 compatibility.

New in WordPress 3.0.5 (Feb 8, 2011)

  • This security release is required if you have any untrusted user accounts, but it also comes with important security enhancements and hardening. All WordPress users are strongly encouraged to update.
  • Two moderate security issues were fixed that could have allowed a Contributor- or Author-level user to gain further access to the site.
  • One information disclosure issue was addressed that could have allowed an Author-level user to view contents of posts they should not be able to see, such as draft or private posts.
  • Two security enhancements were added. One improved the security of any plugins which were not properly leveraging our security API. The other offers additional defense in depth against a vulnerability that was fixed in previous release.

New in WordPress 3.1 RC 3 (Jan 24, 2011)

  • The biggest change is the removal of AJAX list tables, which had been an effort to move all of our list-style screens to full AJAX for pagination, searches, and column sorts, and to consolidate the list-style screens into a single API that plugins could leverage. Unfortunately, with more testing came realizations that there were too many major bugs and usability issues with how the functionality was implemented, so we’ve spent the last week rolling back the most important portions of the feature.
  • For users: AJAX has been entirely disabled for the list tables. We hope to bring this back again, in a form that is properly and fully implemented, in a future release. Column sorting remains, but everything else has returned to its 3.0 state.
  • For developers: The entire list table API is now marked private. If you attempt to leverage new components of the API, you are pretty much guaranteeing that your plugins will break in a future release, so please don’t do that. :-) We hope to enable all the fun new goodies for public use in a future release.
  • This is the only way it could be prevented any regressions in functionality and usability from WordPress 3.0 to 3.1. That’s right, users and plugin authors can still do everything you used to be able to do (and a little bit more).
  • Because of the code churn between RC2 and RC3, this release candidate needs a lot of testing. Every list screen needs testing. In particular, the comment moderation screen needs testing, especially with keyboard shortcuts (if you didn’t know about those, now’s your chance to try them out).
  • Other fixes in RC3 include:
  • Properly display the author dropdown in Quick Edit
  • Various important fixes to numerous taxonomy query variables
  • Fixes to the theme deletion process
  • Fixes to pages used for posts
  • IIS and Multisite: Avoid resetting web.config on permalink save
  • Properly validate post formats and their rewrite rules

New in WordPress 3.1 RC 2 (Jan 3, 2011)

  • The security fixes included in WordPress 3.0.4
  • Fix issues related to handling a static front page
  • Fixes and enhancements for the pagination buttons
  • Fix searching for partial usernames
  • Properly reactivate plugins after editing them
  • Always show the current author in the author dropdown when editing a post
  • Fixes for attachment taxonomies
  • Fix node removal for the admin bar
  • Fix the custom post type show_in_menu argument
  • Various fixes for right-to-left languages
  • and a few dozen more changes

New in WordPress 3.0.4 (Dec 30, 2010)

  • A very important update to apply to your sites as soon as possible because it fixes a core security bug in our HTML sanitation library, called KSES. The release is rated as “critical.”

New in WordPress 3.0.3 (Dec 9, 2010)

  • Fixes issues in the remote publishing interface, which under certain circumstances allowed Author- and Contributor-level users to improperly edit, publish, or delete posts.
  • These issues only affect sites that have remote publishing enabled.
  • Remote publishing is disabled by default, but you may have enabled it to use a remote publishing client such as one of the WordPress mobile apps. You can check these settings on the “Settings → Writing” screen.

New in WordPress 3.0.2 (Dec 1, 2010)

  • Fixes a moderate security issue that could allow a malicious Author-level user to gain further access to the site, addresses a handful of bugs, and provides some additional security enhancements.

New in WordPress 3.0.1 (Jul 30, 2010)

  • Fixed 55 tickets total. A break down of ticket status by component can be found in Trac.
  • Added unregister_nav_menu(), for child themes.

New in WordPress 3.0 (Jun 18, 2010)

  • Major new features in this release include a sexy new default theme called Twenty Ten. Theme developers have new APIs that allow them to easily implement custom backgrounds, headers, shortlinks, menus (no more file editing), post types, and taxonomies. (Twenty Ten theme shows all of that off.)
  • Developers and network admins will appreciate the long-awaited merge of MU and WordPress, creating the new multi-site functionality which makes it possible to run one blog or ten million from the same installation.
  • As a user, you will love the new lighter interface, the contextual help on every screen, the 1,217 bug fixes and feature enhancements, bulk updates so you can upgrade 15 plugins at once with a single click.

New in WordPress 3.0 RC 1 (May 28, 2010)

  • Custom menus are finished!
  • Multi-site is all set.
  • The look of the WordPress admin has been lightened up a little bit, so you can focus more on your content.
  • There are a ton of changes, so plugin authors, please test your plugins now, so that if there is a compatibility issue, we can figure it out before the final release.
  • Plugin and theme *users* are also encouraged to test things out. If you find problems, let your plugin/theme authors know so they can figure out the cause.

New in WordPress 3.0 Beta 1 (Apr 6, 2010)

  • The custom menus system (Appearance > Menus) is not quite finished. In Beta 2, the layout will be different and a bunch of the functionality will be improved, but we didn’t want to hold things up for this one screen. You can play with making custom menus, and report bugs if you find them, but this is not how the final screen will look/work, so don’t get attached to it.
  • The merge! Yes, WordPress and WordPress MU have merged. This does not mean that you can suddenly start adding a bunch of new blogs from within your regular WordPress Dashboard. If you’re interested in testing the Super Admin stuff associated with multiple sites, you’ll need some simple directions to get started.
  • Fiddling with a few small things in the UI, as we were focused on getting the more function-oriented code finished first. For example, we’re getting a new icon for the Super Admin section.
  • New default theme, Twenty Ten, including the custom background and header options.
  • Custom Post Type functionality has been beefed up. It’s really easy to add new types, so do that and see how it looks!
  • WordPress MU users should test the multiple sites functionality to make sure nothing broke during the merge.

New in WordPress 2.9.2 (Feb 15, 2010)

  • There is a problem where logged in users can peek at trashed posts belonging to other authors. If you have untrusted users signed up on your blog and sensitive posts in the trash, you should upgrade to 2.9.2.

New in WordPress 2.9.1 (Jan 5, 2010)

  • Addresses a handful of minor issues as well as a rather annoying problem where scheduled posts and pingbacks are not processed correctly due to incompatibilities with some hosts.

New in WordPress 2.9.1 RC 1 (Dec 30, 2009)

  • Contains a few more fixes, bringing the number of fixed tickets up to 23.

New in WordPress 2.9.1 Beta 1 (Dec 28, 2009)

  • The recent 2.9 release triggered a bug in certain versions of PHP’s curl extension. With these versions of curl, scheduled posts and pingbacks are not processed correctly. This version fixes this problem as well as a handful of other.

New in WordPress 2.9 (Dec 19, 2009)

  • The coolest new stuff from a user point of view is:
  • Global undo/”trash” feature, which means that if you accidentally delete a post or comment you can bring it back from the grave (i.e., the Trash). This also eliminates those annoying “are you sure” messages we used to have on every delete.
  • Built-in image editor allows you to crop, edit, rotate, flip, and scale your images to show them who’s boss. This is the first wave of our many planned media-handling improvements.
  • Batch plugin update and compatibility checking, which means you can update 10 plugins at once, versus having to do multiple clicks for each one, and we’re using the new compatibility data from the plugins directory to give you a better idea of whether your plugins are compatible with new releases of WordPress. This should take the fear and hassle out of upgrading.
  • Easier video embeds that allow you to just paste a URL on its own line and have it magically turn it into the proper embed code, with Oembed support for YouTube, Daily Motion, Blip.tv, Flickr, Hulu, Viddler, Qik, Revision3, Scribd, Google Video, Photobucket, PollDaddy, and WordPress.tv (and more in the next release).
  • 2.9 provides the smoothest ride yet because of a number of improvements under the hood and more subtle improvements you’ll begin to appreciate once you’ve been around the block a few times. Here’s just a sampling:
  • We now have rel=canonical support for better SEO.
  • There is automatic database optimization support, which you can enable in your wp-config.php file by adding define('WP_ALLOW_REPAIR', true);.
  • Themes can register “post thumbnails” which allow them to attach an image to the post, especially useful for magazine-style themes.
  • A new commentmeta table that allows arbitrary key/value pairs to be attached to comments, just like posts, so you can now expand greatly what you can do in the comment framework.
  • Custom post types have been upgraded with better API support so you can juggle more types than just post, page, and attachment. (More of this planned for 3.0.)
  • You can set custom theme directories, so a plugin can register a theme to be bundled with it or you can have multiple shared theme directories on your server.
  • We’ve upgraded TinyMCE WYSIWYG editing and Simplepie.
  • Sidebars can now have descriptions so it’s more obvious what and where they do what they do.
  • Specify category templates not just by ID, like before, but by slug, which will make it easier for theme developers to do custom things with categories — like post types!
  • Registration and profiles are now extensible to allow you to collect things more easily, like a user’s Twitter account or any other fields you can imagine.
  • The XML-RPC API has been extended to allow changing the user registration option. We fixed some Atom API attachment issues.
  • Create custom galleries with the new include and exclude attributes that allow you to pull attachments from any post, not just the current one.
  • When you’re editing files in the theme and plugin editors it remembers your location and takes you back to that line after you save. (Thank goodness!!!)
  • The Press This bookmarklet has been improved and is faster than ever; give it a try for on-the-fly blogging from wherever you are on the internet.
  • Custom taxonomies are now included in the WXR export file and imported correctly.
  • Better hooks and filters for excerpts, smilies, HTTP requests, user profiles, author links, taxonomies, SSL support, tag clouds, query_posts and WP_Query

New in WordPress 2.8.6 (Nov 18, 2009)

  • Fixes two security problems that can be exploited by registered, logged in users who have posting privileges. If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.
  • The first problem is an XSS vulnerability in Press This. The second problem is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations.

New in WordPress 2.8.5 (Oct 21, 2009)

  • A fix for the Trackback Denial-of-Service attack that is currently being seen.
  • Removal of areas within the code where php code in variables was evaluated.
  • Switched the file upload functionality to be whitelisted for all users including Admins.
  • Retiring of the two importers of Tag data from old plugins.

New in WordPress 2.8.4 (Aug 13, 2009)

  • Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn’t allow remote access, but it is very annoying.
  • We fixed this problem last night and have been testing the fixes and looking for other problems since then.

New in WordPress 2.8.2 (Jul 21, 2009)

  • WordPress 2.8.2 fixes an XSS vulnerability.
  • Comment author URLs were not fully sanitized when displayed in the admin.
  • This could be exploited to redirect you away from the admin to another site.

New in WordPress 2.8 (Jun 12, 2009)

  • Highlights:
  • New drag-and-drop widgets admin interface and new widgets API
  • Syntax highlighting and function lookup built into plugin and theme editors
  • Browse the theme directory and install themes from the admin
  • Allow the dashboard widgets to be arranged in up to four columns
  • Allow configuring the number of items to show on management pages with an option in Screen Options
  • Support timezones and automatic daylight savings time adjustment
  • Support IIS 7.0 URL Rewrite Module
  • Faster loading of admin pages via script compression and concatenation
  • New Features:
  • User Features:
  • New Theme Installer routines
  • Add CodePress syntax highlighting to Theme and Plugin editors
  • Add Documentation(function) lookup to Theme and Plugin editors
  • Use "Custom Header" for menu text and revise Default theme to reflect change
  • Separate Comments into a separate postbox, from Discussion postbox, on the Edit Post screen
  • Make tags accessible without Javascript on the edit screen
  • Don't ask for confirmation when marking a comment as spam
  • Don't notify post author of own comments
  • Fix comment paging for static front page
  • Allow the dashboard widgets to be arranged in up to four columns as set via the Screen Options tab
  • Make titles into links in Dashboard Right Now module (this was in 2.7.1)
  • Improved Admin icons (grey-to-transparent shadows)
  • Update Blue Admin Color Scheme
  • Press This improvements UI, quoting fixes, plus ability for Contributors to use Press This
  • Add a Cancel Upload button and a Delete link to Administration > Media > Add New
  • Add column "Rating" in Administration > Links > Edit
  • Improve installer to help people entering wrong email addresses
  • Improved Widget user interface
  • Allow editing of all plugin files (Ticket 6732)
  • Improved Plugin search (this was in 2.7.1) on Administration > Plugins > Add New
  • Per Page option for plugins
  • Move "Install a plugin in .zip format" to new Upload tab under Administration > Plugins > Add New
  • Show absolute date instead of relative date for scheduled posts
  • Fix tags suggest for post quick edit and bulk edit
  • Permalink editor changes and fix for pages
  • Autosave post/page when pressing Control/Command+S
  • Add toggle all button to the Gallery tab in the uploader
  • Support more than one gallery on the same page
  • Add per page option to Screen Options for comments, posts, pages, media, categories, and tags
  • Overhaul of LiveJournal importer (also add define WP_IMPORTING)
  • Import category descriptions for Administration > Tools > Import > WordPress
  • Show Tools menu for all users so they can access Turbo
  • Check for new version when visiting Administration > Tools > Upgrade
  • In upgrade process, provide better explanation for database upgrade message
  • Fix most popular link category list
  • Add description field for Tags in Administration > Posts > Tags
  • WAI-ARIA landmark roles to added to WordPress Default theme
  • "Choose a city in the same timezone as you" for Timezone in Administration > Settings > General
  • Remove My Hacks option from Administration > Settings > Miscellaneous
  • Hide email addresses from low privilege users on Administration > Comments
  • Allow case-insensitive logins
  • Login and Registration pages noindex followed
  • Give login screen proper iPhone viewport
  • Enforce unique email addresses in Add/Edit users
  • Make user_nicenames unique during registration
  • Add "Send this password to the new user by email" option to Administration > Users > Add New
  • Don't set user's Website url to http:// in Administration > Users > Add New
  • Add password strength meter to Add User and Edit User
  • Hide things that need to be available to screen readers via offscreen positioning
  • Use invisible class for hiding labels and legends
  • Use a semantic class name for text targeted to screen readers
  • Development, Themes, Plugins:
  • Improved database performance
  • Drop post_category column from wp_posts table, and link_category column from wp_links schemas
  • Fix delete statements to ensure data integrity when innodb and foreign keys are used
  • Enforce consistent ID types to allow for foreign keys to be defined between tables
  • Add Sticky to list of post states
  • Add a filter to the post states list
  • Introduction and widespread use of transient and related filters
  • Add filters so AIM, Yahoo, and Jabber IM labels, in user profile, can be changed
  • Add hook "after_db_upgrade"
  • Add hooks for the Users, Categories, Link Categories, Tags and Comments table columns
  • HTTP API updates and fixes
  • Add support for blocking all outbound HTTP requests
  • Updated List of HTTP status codes (Ticket 9297)
  • Use SimplePie for widget and dashboard feeds
  • Switch to pomo lib. Support gettext contexts. Deprecate long form functions
  • TinyMCE 3.2.4.1
  • Use Jcrop 0.9.8 for cropping
  • Update pclzip to 2.8
  • Update PHPMailer to 2.0.4
  • Update SWFUpload to 2.2.0.1
  • Improved performance for script loading
  • Improved archive and calendar queries
  • Cron spawning improvements
  • Timezone enhancements for PHP 5
  • Add WP_Widget class and move native widgets into WP_Widget
  • Allow other taxonomies (e.g. post categories) to be used with wp_tag_cloud (Changeset 10554)
  • Add echo argument to wp_tag_cloud()
  • Allow a plugin to control how many posts are displayed on edit pages
  • Add "style" and "html" arguments to wp_list_authors (Ticket 4420)
  • Add "exclude_tree" argument to wp_list_categories and make exclude behave like exclude_tree when hierarchical is specified--this was actually a 2.7.1 change (Ticket 8614)
  • New Template Tag, the_modified_author (Ticket 9154)
  • Enhanced support for custom taxonomies
  • Put page title before blog name in admin title (Ticket 9028)
  • Use https://api.wordpress.org/secret-key/1.1/ for the WordPress.org secret-key service
  • Various phpDoc updates
  • Refactor filters to avoid potential XSS attacks
  • XMLRPC improvements
  • Improved mysql2date coding
  • Make authentication more pluggable
  • Switch to using the ID when calling get_avatar internally to support caching plugins
  • Allow plugins to provide a canonical redirect_url even if WordPress does not provide its own
  • Drafts have post_date populated now, so look for a zeroed out post_date_gmt to determine non-scheduled nature
  • Fixes to query_posts (obey post_type, drop orderby=category, use group by for meta key queries, remove meta_value from selected fields)
  • New orderby=none parameter for use with query_posts
  • Allow a plugin to filter the classes applied in wp_list_pages()
  • Functions (get_adjacent_post_rel_link() and adjacent_post_rel_link()) to display relational links for adjacent posts in the head (Ticket 8703)
  • Add the sticky post grey background to the default theme
  • Proxy support
  • Let a plugin filter the expanded capabilities returned by map_meta_cap
  • Allow the update period to be filtered in RSS/RDF feeds
  • Store field types in wpdb object
  • Add tag description functions tag_description and term_description
  • Add page class to get_body_class()
  • Deprecate get_catname()
  • Use comments_open() and pings_open() in WordPress Default and Classic themes
  • Add wp_trim_excerpt() filter
  • Consolidate plugin/theme/core upgrade/install functions
  • Add page-id-x class to body for pages
  • Return empty list in wp_list_bookmarks() if requested bookmark category does not exist
  • Allow menu reordering via plugin
  • Add hook for updating user profile
  • Add redirect argument to wp_loginout
  • Add wp_lostpassword_url (Ticket 9932)
  • Add get_the_author_meta() and the_author_meta() functions
  • Deprecate the_author_ID, the_author_login, the_author_firstname, the_author_lastname, the_author_nickname, the_author_email, the_author_url, the_author_aim, the_author_yim, the_author_mns, the_author_description and all their "get_*()" functions. (The full list at wp-includes/deprecated.php)
  • Let plugins use screen layout columns
  • Add labels to titles and text inputs
  • Add hook for adding info to plugin update message
  • Don't do core version check from front page loads
  • Allow a plugin to vary the comment cookie lifetime (or even remove the cookies altogether)
  • Allow plugin to replace just the default help while preserving the contextual help
  • New escaping naming convention Ticket 9650
  • Deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security (ref. Development Updates)
  • Deprecate sanitize_url() and clean_url() in favor of esc_url_raw() and esc_url() (ref. Development Updates)
  • Add number/offset arguments to get_pages() (same parameters can be used for wp_list_pages()
  • Make login more pluggable
  • Add the_widget() function to output a generic widget anywhere in a template (Ticket 9701)
  • Allow plugins to override tz support enable/disable
  • Fix combining category and tag queries
  • Support IIS 7.0 URL Rewrite Module
  • Recognize Expression Web 2 as IIS
  • Allow multiple search form templates
  • Introduce sanitize_html_class() and use it to give categories, tags, users etc meaningful classnames where possible but fallback to the id if necessary (Ticket 8446)
  • Allow a different role to be set for users when they are created in a call to wp_insert_user()
  • Improve Filesystem method choice for 'direct'; introduce FS_METHOD constant
  • Add a hook in print_footer_scripts as in print_head_scripts
  • Add a comment_moderation_headers filter
  • Move upload_dir filter to before directory is created, so plugins can have a better effect
  • Pass name to sidebar, footer, and header get actions
  • Upgrader improvements, including move curl to last position and fockopen to 2nd position due to higher compatibility
  • Updated Trac
  • Advanced Features:
  • JS script loader Improvements:
  • jQuery 1.3.2
  • Improvements to the script loader: allows plugins to queue scripts for the front end head and footer, adds hooks for server side caching of compressed scripts, adds support for ENFORCE_GZIP constant (deflate is used by default since it's faster)
  • Load the minified versions of the scripts by default, define('SCRIPT_DEBUG', true); can be used to load the development versions
  • Remove events from categories chechboxes in quick edit to speed up page unload
  • Make simple form validation and ajax-add new categories compatible with jQuery 1.3.1
  • Load farbtastic.js has to be loaded in the head
  • Note: see Lester Chan's Loading Javascript in Footer blog and Andrew Ozz's Script Loader Updates blog
  • New Widgets API:
  • WP_Widget is a class that abstracts away much of the complexity involved in writing a widget, especially multi-widgets.
  • Basically, you extend WP_Widget with your own class that provides a constructor and three methods -- widget(), form(), and update().
  • widget() - outputs the actual content of the widget.
  • update() - processes options to be saved.
  • form() - outputs the options form.
  • A widget is registered by passing the name of the widget class to register_widget().
  • All widgets written with WP_Widget are multiple instance capable.
  • Options
  • Options for old single-instance widgets ported to WP_Widget will be upgraded to the new multi-option storage format, which is simply a multi-dimensional array keyed by instance ID.
  • Options for widgets using the old multi-instance pattern should work as is.
  • If your widget has custom option storage needs, you can provide your own get_settings() and save_settings() methods.
  • The WP_Widget source can be viewed here (read the phpdoc for moreinfo on usage): http://core.trac.wordpress.org/browser/trunk/wp-includes/widgets.php
  • You can see examples of how to use it here: http://core.trac.wordpress.org/browser/trunk/wp-includes/default-widgets.php
  • If you author any widgets, try porting them to WP_Widget and give your feedback on what can be improved an Trac Ticket 8441.
  • Props to the MultiWidget class, on which WP_Widget is based: http://blog.firetree.net/2008/11/30/wordpress-multi-widget/
  • The above extracted from Ryan Boren's wp-hackers post.
  • Menu reordering via plugin:
  • Example plugin demonstrates menus with Dashboard, Posts, and Comments in the first menu group. The remaining menus follow in their usual order.
  • When filtering the order array, any menus that are not mentioned in the array will be sorted after ones that are mentioned.
  • Unmentioned menus are sorted in their usual order, relative to other unmentioned menus.
  • Information extracted from Ryan Boren's comments on Trac Ticket 9652