WordPress 7.1.3 came out on 6 October 2026. It is a security and maintenance release with seven fixes for security problems and four bug fixes. WordPress recommends that you update your sites immediately. Sites that support automatic background updates start updating on their own.
What WordPress 7.1.3 fixes
The announcement lists seven problems and gives neither CVE numbers nor CVSS scores. Here they are in plain words, in the order of the announcement.
- Stored XSS on the Comments screen. A malicious script is saved through a comment that is waiting for approval and runs in the admin.
- Denial of service (DoS) in the
WP_Http::make_absolute_url()method. - Second-order SQL injection in the WXR export. The export is
Tools > Exportin the admin. - An Author can make posts sticky. The Author role should not have this ability.
- Disclosure of comments on private and unpublished posts. No login is needed for it.
- XSS in Imgur embeds.
- Forgeable parameters passed to the
{status}_{type}hook. They can lead to a collision of action names.
Stored XSS means that a malicious script is saved in the site and runs in the browser of whoever opens the affected page. In a second-order SQL injection the malicious input is saved first and becomes dangerous only when a later query uses it. A denial of service means that the site may stop responding. Besides the seven security fixes there are four bug fixes, and the announcement links to their list in WordPress Trac.
Are you affected?
If your site runs a WordPress version below 7.1.3, it does not have these fixes yet. The version is shown at the bottom of the admin and in Dashboard > Updates. If you have Terminal and WP-CLI, two commands only read and show the version and whether a newer one exists. How to work with them is described in the WP-CLI guide.
# cPanel > Terminal, in the site's folder
# Read-only. Shows the version and whether a newer one exists.
wp core version
wp core check-update
Not every site supports automatic background updates, so check the version yourself. The fixes are also being backported, where necessary, to older branches that still receive them. According to the announcement they reach back to 4.7. The backports are in progress and the fixes ship as they become ready. Only the newest version is actively supported. If you are on an older branch, see in Dashboard > Updates what WordPress offers for it.
What to do
- Back up the files and the database. How to do it is described in the backup guide.
- Update WordPress to 7.1.3 from
Dashboard > Updateswith theUpdate Nowbutton. From cPanel you can also do it through WP Toolkit, if you have it, as in the WP Toolkit guide. - Open the site and the admin and try a form. If you have a shop, try an order as well. Then check the version once more.
What we do
If you would rather not follow updates yourself, monthly maintenance takes over the monitoring, updates, vulnerabilities and backups of your site every month, wherever it is hosted. Write to us through the inquiry form and we will get in touch.
Frequently asked questions
What does WordPress 7.1.3 fix?
WordPress 7.1.3 came out on 6 October 2026 with seven fixes for security problems and four bug fixes. They include stored XSS on the Comments screen, a second-order SQL injection in the WXR export and the disclosure of comments on private and unpublished posts. WordPress recommends updating immediately.
Do the problems fixed in WordPress 7.1.3 have CVE numbers?
No. The WordPress 7.1.3 announcement lists the seven problems without CVE numbers or CVSS scores. So there is no number to compare their severity by, and updating is the simpler answer.
Is my site affected by the problems fixed in WordPress 7.1.3?
Any site on a WordPress version below 7.1.3 does not have these fixes yet. The version is shown at the bottom of wp-admin and under Dashboard > Updates. The fixes are also being backported to older branches that still receive them, as far back as 4.7.
How do I check my WordPress version with a command?
In cPanel's Terminal, in the site's folder, wp core version shows the version and wp core check-update shows whether a newer one exists. Both WP-CLI commands only read and change nothing.
Will WordPress update itself to 7.1.3?
Sites that support automatic background updates start updating on their own. Not every site supports them, though, so check the version under Dashboard > Updates after a while.
What is stored XSS?
With stored XSS a malicious script is saved in the site and runs in the browser of anyone who opens the affected page. WordPress 7.1.3 fixes such a problem on the Comments screen, where the script reaches the admin through a comment waiting for approval.
How do I update to WordPress 7.1.3 safely?
Back up the files and the database first. Then update from Dashboard > Updates with the Update Now button, or through WP Toolkit in cPanel. Finally open the site and the admin, try a form, and for a shop an order as well, then check the version once more.
What if my site is on an older WordPress branch?
The WordPress 7.1.3 fixes are being backported where necessary to older branches back to 4.7, and they ship as they become ready. See what Dashboard > Updates offers for your branch. Only the newest version is actively supported, so plan the move to it.