WordPress 5.8.1 security release addresses trio of vulnerabilities

James Walker 10 September 2021 at 13:23 UTC

Block editor XSS and REST API data exposure issues among now-patched bugs

WordPress has rolled out an update to its core codebase that includes mitigations against three security flaws

As well as fixing 61 bugs, WordPress 5.8.1, released yesterday (September 9), addresses a data exposure vulnerability within the REST API, an interface that allows plugins and themes to interact with WordPress core.

It also fixes a cross-site scripting (XSS) vulnerability in the Gutenberg block editor, as well as multiple vulnerabilities in the Lodash JavaScript Library that are rated critical to high severity.

RELATED WordPress security: Information leak flaw addressed in Ninja Forms

The library has now been updated to version 4.17.21 in each branch to incorporate upstream security fixes.

The update also includes 41 bug fixes on WordPress core, as well as 20 bug fixes for the block editor.

Core update

WordPress versions between 5.4 and 5.8 are affected, and the open source web giant recommends updating immediately, if they have not already done so.

Version 5.8 was released in July, extending the Site Health admin interface to make it easier for developers to include their own tabs and allow website administrators to navigate their way around the Site Health portal more easily.

Read more of the latest WordPress security news and analysis

It also added several new block editor features, support for the WebP image format, an ‘Update URI’ header for plugin developers, and changes to the REST API.

The next major release will be version 5.9, currently in alpha, with beta 1 set for November 16 and general release planned for December 14.

“The main goal for 2021 is getting full site editing to all WordPress users,” says executive director Josepha Haden Chomphosy.

READ MORE Interview: Patchstack’s Oliver Sild on securing WordPress, one plugin vulnerability at a time