WordPress announced security release version 7.1.4 to fix 22 vulnerabilities with some that have been sitting in core since version 4.7.

WordPress announced a security release, version 7.1.4, intended to fix 22 vulnerabilities, including a potentially dangerous weakness in the update process and numerous stored cross-site scripting vulnerabilities.

This release contains three significant kinds of fixes:

1. The WordPress update process itself was vulnerable.

A race condition could allow remote code execution during the upgrade window. This is arguably the most consequential of the discovered flaws that is being patched because these kinds of vulnerabilities can lead to a full site takeover. The official announcement however does not offer information about the conditions necessary to exploit it.

2.…