+44 0330 223 3428
Call Us
+44 0330 223 3428

Dev Blog: WordPress 4.9.5 Security and Maintenance Release

Dev Blog: WordPress 4.9.5 Security and Maintenance Release

WordPress 4.9.5 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately.

WordPress versions 4.9.4 and earlier are affected by three security issues. As part of the core team’s ongoing commitment to security hardening, the following fixes have been implemented in 4.9.5:

  1. Don’t treat localhost as same host by default.
  2. Use safe redirects when redirecting the login page if SSL is forced.
  3. Make sure the version string is correctly escaped for use in generator tags.

Thank you to the reporters of these issues for practicing coordinated security disclosurexknown of the WordPress Security Team, Nitin Venkatesh (nitstorm), and Garth Mortensen of the WordPress Security Team.

Twenty-five other bugs were fixed in WordPress 4.9.5. Particularly of note were:

  • The previous styles on caption shortcodes have been restored.
  • Cropping on touch screen devices is now supported.
  • A variety of strings such as error messages have been updated for better clarity.
  • The position of an attachment placeholder during uploads has been fixed.
  • Custom nonce functionality in the REST API JavaScript client has been made consistent throughout the code base.
  • Improved compatibility with PHP 7.2.

This post has more information about all of the issues fixed in 4.9.5 if you’d like to learn more.

Download WordPress 4.9.5 or venture over to Dashboard → Updates and click “Update Now.” Sites that support automatic background updates are already beginning to update automatically.

Thank you to everyone who contributed to WordPress 4.9.5:

1265578519, Aaron Jorbin, Adam Silverstein, Alain Schlesser, alexgso, Andrea Fercia, andrei0x309, antipole, Anwer AR, Birgir Erlendsson (birgire), Blair jersyer, Brooke., Chetan Prajapati, codegrau, conner_bw, David A. Kennedy, designsimply, Dion Hulse, Dominik Schilling (ocean90), ElectricFeet, ericmeyer, FPCSJames, Garrett Hyder, Gary Pendergast, Gennady Kovshenin, Henry Wright, Jb Audras, Jeffrey Paul, Jip Moors, Joe McGill, Joen Asmussen, John Blackbourn, johnpgreen, Junaid Ahmed, kristastevens, Konstantin Obenland, Laken Hafner, Lance Willett, leemon, Mel Choyce, Mike Schroder, mrmadhat, nandorsky, Nidhi Jain, Pascal Birchler, qcmiao, Rachel Baker, Rachel Peter, RavanH, Samuel Wood (Otto), Sebastien SERRE, Sergey Biryukov, Shital Marakana, Stephen Edgar, Tammie Lister, Thomas Vitale, Will Kwon, and Yahil Madakiya.



Source: WordPress

Related Post
Dev Blog: WordPress 5.1 RC2

Dev Blog: WordPress 5.1 RC2 The second release candidate for WordPress 5.1 is now available! WordPress 5.1 will be released on Thursday, February 21, but we need your help to get there—if you haven’t tried 5.1 yet, now is the time! There are two ways to test the WordPress 5.1 release candidate: try the WordPress […]

Read more
Post Status: Children say his superpower is love: an interview with Topher DeRosia

Post Status: Children say his superpower is love: an interview with Topher DeRosia DK: How did you first got into programming, the web, and WordPress? TD: Getting into programming is a long slow story. Someone mentioned the other day how they learned HTML through View Source, and I did that as well, but then it […]

Read more
WPTavern: Amazon Introduces Blog Blueprint to Deliver WordPress Posts as Audio on Alexa

WPTavern: Amazon Introduces Blog Blueprint to Deliver WordPress Posts as Audio on Alexa Last week Amazon launched Alexa Skill Blueprints that allow anyone to publish new skills to the Alexa Skills Store without having to have any coding knowledge. The blueprints are templates that provide a starting point where users can create a new skill […]

Read more