WordPress.org

WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.5.1 and earlier are affected by a SOME vulnerability through Plupload, the third-party library WordPress uses for uploading files. WordPress versions 4.2 through 4.5.1 are vulnerable to reflected XSS using specially crafted URIs through MediaElement.js, the third-party library used for media players. MediaElement.js and Plupload have also released updates fixing these issues.

Both issues were analyzed and reported by Mario Heiderich, Masato Kinugawa, and Filedescriptor from Cure53. Thanks to the team for practicing responsible disclosure, and to the Plupload and MediaElement.js teams for working closely with us to coördinate and fix these issues.

Download WordPress 4.5.2 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.5.2.

Additionally, there are multiple widely publicized vulnerabilities in the ImageMagick image processing library, which is used by a number of hosts and is supported in WordPress. For our current response to these issues, see this post on the core development blog.

After about six million downloads of WordPress 4.5, we are pleased to announce the immediate availability of WordPress 4.5.1, a maintenance release.

This release fixes 12 bugs, chief among them a singular class issue that broke sites based on the Twenty Eleven theme, an incompatibility between certain Chrome versions and the visual editor, and an Imagick bug that could break media uploads. This maintenance release fixes a total of 12 bugs in Version 4.5. For more information, see the release notes or consult the list of changes.

Download WordPress 4.5.1 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.5.1.

Thanks to everyone who contributed to 4.5.1:

Aaron Jorbin, Andrea Fercia, Andrew Ozz, Boone Gorges, Dominik Schilling, Felix Arntz, Gary Pendergast, gblsm, Helen Hou-Sandi, Joe McGill, John Blackbourn, Nick Halsey, Pascal Birchler, and Pieter.

Version 4.5 of WordPress, named “Coleman” in honor of jazz saxophonist Coleman Hawkins, is available for download or update in your WordPress dashboard. New features in 4.5 help streamline your workflow, whether you’re writing or building your site.

---

Editing Improvements

Inline Linking

Stay focused on your writing with a less distracting interface that keeps you in place and allows you to easily link to your content.

Formatting Shortcuts

Do you enjoy using formatting shortcuts for lists and headings? Now they’re even more useful, with horizontal lines and <code>.

---

Customization Improvements

Live Responsive Previews

Make sure your site looks great on all screens! Preview mobile, tablet, and desktop views directly in the customizer.

Custom Logos

Themes can now support logos for your business or brand. Try it out with Twenty Sixteen and Twenty Fifteen in the Site Identity section of the customizer.

---

Under the Hood

---

The Crew

This release was led by Mike Schroder, backed up by Adam Silverstein as Release Deputy, Mel Choyce as Release Design Lead, and the help of these fine individuals. There are 298 contributors with props in this release. Pull up some Coleman Hawkins on your music service of choice, and check out some of their profiles:

@mercime, Aaron D. Campbell, Aaron Edwards, Aaron Hockley, Aaron Jorbin, Abiral Neupane, Ahmad Awais, aidanlane, Alice Brosey, Amanda Rush, Andrea Fercia, Andrea Gandino, Andrew Nacin, Andrew Ozz, Andrew Rockwell, Andy, Ankit K Gupta, Anton Timmermans, apaliku, Aram Zucker-Scharff, ash.matadeen, Ashok Kumar Nath, BandonRandon, Barry Ceelen, Ben Dunkle, berengerzyla, Bernhard Riedl, Bhushan S. Jawle, Birgir Erlendsson (birgire), Boone B. Gorges, Brad Williams, Brady Vercher, Brandon Allen, Brandon Hubbard, Brandon Kraft, Brian Krogsgard, Bruno Borges, Callum Macdonald, Cami Kaos, Chandra Patel, Charles Fulton, Chetan Chauhan, Chouby, ChriCo, Chris Christoff, Chris Mok, christophherr, ckoerner, Claudio Sanches, Compute, coreymcollins, d4z_c0nf, Daisuke Takahashi, danhgilmore, Daniel Bachhuber, Daniel Bailey, Daniel Jalkut (Red Sweater), Daniel Llewellyn, Daniele Scasciafratte, danielpataki, Danny van Kooten, Dave Clements, David A. Kennedy, David Brumbaugh, David Herrera, David Newton, David Shanske, Davide 'Folletto' Casali, Denis de Bernardy, Dennis Ploetner, Derek Herman, Dion Hulse, dmsnell, Dominik Schilling, Dossy Shiobara, Dotan Cohen, Dreb Bits, Drew Jaynes, duaneblake, Dzikri Aziz, Elio Rivero, Ella Iseulde Van Dorpe, Emerson Maningo, enej, Eric Andrew Lewis, Eric Binnion, Eric Daams, Erick Hitter, Evan Herman, Fabien Quatravaux, faishal, fantasyworld, Felix Arntz, finnj, firebird75, Fredrik Forsmo, fusillicode, Gary Jones, Gary Pendergast, gblsm, George Stephanis, Giuseppe Mamone, Giustino Borzacchiello, Grant Palin, groovecoder, Guido Scialfa, Gustavo Bordoni, hakre, Helen Hou-Sandí, Henry Wright, Hinaloe, Hugh Lashbrooke, Hugo Baeta, Iain Poulson, Ignacio Cruz Moreno, imath, Ionut Staicu, Ivan Kristianto, J.D. Grimes, jadpm, James DiGioia, Jason, Jasper de Groot, Jeffrey de Wit, Jeffrey Schutzman, Jennifer M. Dodd, Jeremy Felt, Jeremy Herve, Jeremy Pry, Jesin A, Jess G., Joan Boluda, Joe Hoyle, Joe McGill, joelerr, John Blackbourn, John James Jacoby, JohnnyPea, Jonathan Brinley, Jonny Harris, Jory Hogeveen, Joseph Fusco, Josh Levinson, Josh Pollock, jrchamp, jrf, Juanfra Aldasoro, Juhi Saxena, Julio Potier, katieburch, Kelly Dwan, Kevin Hagerty, Kiran Potphode, Kirk Wight, Kite, kjbenk, Konstantin Kovshenin, Konstantin Obenland, Konstantinos Kouratoras, KrissieV, Lance Willett, leemon, Lew Ayotte, Liam Dempsey, Luan Ramos, luciole135, Lukas Pawlik, Lutz Schröer, madvic, Marco Chiesi, Marin Atanasov, Mario Peshev, Mark Barnes, Mark Jaquith, Mark Uraine, Marko Heijnen, Martin Burke, Matt Felten, Matt Mullenweg, Matt Wiebe, MattGeri, maweder, Mayo Moriyama, mcapybara, Mehul Kaklotar, Meitar, mensmaximus, Michael Arestad, michalzuber, micropat, Mika Epstein, Mike Glendinning, Mike Hansen, Mike Jolley, Milan Dinić, Morgan Estes, moto hachi ( mt8.biz ), Mr Papa, mwidmann, nexurium, Niall Kennedy, Nic Ford, Nick Halsey , Nilambar Sharma, Ninos, oaron, overclokk, Pascal Birchler, Pat O'Brien, Paul Bearne, Paul de Wouters, Payton Swick, Perez Labs, Pete Nelson, Peter Wilson, petermolnar, Petter Walbø Johnsgård, Pieter, Pippin Williamson, Pirate Dunbar, prettyboymp, Profforg, programmin, Rachel Baker, rahal.aboulfeth, Rami Yushuvaev, Rastislav Lamos, Ricky Lee Whittemore, Ritesh Patel, rob, Roger Chen, RomSocial, Ruud Laan, Ryan Boren, Ryan Kienstra, Ryan McCue, Ryan Welcher, Sagar Jadhav, Sal Ferrarello, salvoaranzulla, Sam Hotchkiss, Sara Rosso, Scott Arciszewski, Scott Kingsley Clark, Scott Reilly, Scott Taylor, scottbrownconsulting, scribu, Sebastian Pisula, Sergej Müller, Sergey Biryukov, Shane, Shinichi Nishikawa, Sidati, Siobhan, sky, slushman, smerriman, stephanethomas, Stephen Edgar, Stephen Harris, Steve Grunwell, Steven Word, Store Locator Plus, Subharanjan, Sudar Muthu, Sumit Singh, Taco Verdonschot, tahteche, Takashi Irie, Takayuki Miyoshi, Tammie Lister, tharsheblows, theMikeD, thomaswm, Timothy Jacobs, timplunkett, tmuikku, Toni Viemerö, Toro_Unit (Hiroshi Urabe), Tracy Levesque, Tran Ngoc Tuan Anh, Travis Smith, Ty Carlson, Ulrich, Utkarsh, vhomenko, virgodesign, vlad.olaru, voldemortensen, vtieu, webaware, Wesley Elfring, Weston Ruter, WisdmLabs, WP Delighter, wp-architect, xavortm, yetAnotherDaniel, and zinigor.

 

Special thanks go to Siobhan McKeown for producing the release video and Jack Lenox for the voice-over.

Finally, thanks to all of the contributors who provided translations for the release. WordPress 4.5 comes fully translated into 44 languages and the release video has been translated into 32 languages!

If you want to follow along or help out, check out Make WordPress and our core development blog. Thanks for choosing WordPress. See you soon for version 4.6!

The second release candidate for WordPress 4.5 is now available.

We’ve made 91 changes since the first release candidate. RC means we think we’re done, but with millions of users and thousands of plugins and themes, it’s possible we’ve missed something. We hope to ship WordPress 4.5 on Tuesday, April 12, but we need your help to get there.

If you haven’t tested 4.5 yet, now is the time!

Think you’ve found a bug? Please post to the Alpha/Beta support forum. If any known issues come up, you’ll be able to find them here.

To test WordPress 4.5, you can use the WordPress Beta Tester plugin or you can download the release candidate here (zip).

For more information about what’s new in version 4.5, check out the Beta 1, Beta 2, Beta 3, and Beta 4 blog posts.

Developers, please test your plugins and themes against WordPress 4.5 and update your plugin’s Tested up to version in the readme to 4.5. If you find compatibility problems, we never want to break things, so please be sure to post to the support forums so we can figure those out before the final release.

Polyglots, strings are now hard frozen, including the About Page, so you are clear to translate!

A few changes of note since the first release candidate:

• Normalized non-slashing of data in the REST API infrastructure. If you use the REST API infrastructure, check out the post on this change.
• Customizer settings for widget instances get registered a bit later to give a chance for the widget instances themselves to be registered first. See #36431 for details.
• Fixed various cropping issues in the Custom Logo feature and Twenty Fifteen / Twenty Sixteen themes.

Be sure to follow along the core development blog, where you can find the Field Guide for 4.5.

It’s great fun to test
Enjoyment in another
Release Candidate

Global WordPress Translation Day is a one-day contributor initiative organised by the WordPress project’s Polyglots team that is dedicated to helping new contributors who would like to translate WordPress in one of the 160 languages WordPress is available in.

Global WordPress Translation Day will be on Sunday, April 24th, starting at 0:00 UTC and will go on for 24 hours covering all time zones.

What are we doing?

• Live training: A 24h live streaming of tutorials about translating WordPress in different languages and making your code translatable (30min/1h sessions in different languages including a general instruction and specifics for that particular language). The internationalization sessions will be in English. The sessions will be presented by some of the most experienced WordPress translators and internationalization experts. The Schedule can be found on the website.
• Local translation contributor days: Groups of contributors gather at different locations and work face to face.
• Local remote translation contributor days: Current translation teams dedicate time and get involved remotely to do orientation for their potential contributors or work with their current translation teams on translating as many strings as they can.

If you organise a local meetup, why not organise a contributor day for translating in your language?

Join us! Read about the initiative and sign up as an organiser.

Can I get involved if I only speak English?

Yes! Even if you only speak English, it would be great to get involved and check out some of the English locale variants – English as spoken in the United Kingdom, Canada, New Zealand, Australia, South Africa. English has many variants across the globe and you can learn about the differences and why it’s important that users have the option to choose a variant during some of our sessions. And if you’re in a funky mood, you can give translating the interface into Emoji a try! Yes, we have a WordPress in Emoji locale!

Questions?

The polyglots team and the event organisers hang out in #Polyglots in Slack. They will gladly help you out.

The release candidate for WordPress 4.5 is now available.

We’ve made 49 changes since releasing Beta 4 a week ago. RC means we think we’re done, but with millions of users and thousands of plugins and themes, it’s possible we’ve missed something. We hope to ship WordPress 4.5 on Tuesday, April 12, but we need your help to get there.

If you haven’t tested 4.5 yet, now is the time!

Think you’ve found a bug? Please post to the Alpha/Beta support forum. If any known issues come up, you’ll be able to find them here.

To test WordPress 4.5, you can use the WordPress Beta Tester plugin or you can download the release candidate here (zip).

For more information about what’s new in version 4.5, check out the Beta 1, Beta 2, Beta 3, and Beta 4 blog posts.

Developers, please test your plugins and themes against WordPress 4.5 and update your plugin’s Tested up to version in the readme to 4.5 before next week. If you find compatibility problems, we never want to break things, so please be sure to post to the support forums so we can figure those out before the final release.

Be sure to follow along the core development blog, where we’ll continue to post notes for developers for 4.5.

Free as in Freedom
It is WordPress 4.5
Also free as in beer

WordPress 4.5 Beta 4 is now available!

This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site just to play with the new version. To test WordPress 4.5, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the beta here (zip).

For more information on what’s new in 4.5, check out the Beta 1, Beta 2, and Beta 3 blog posts, along with in-depth field guides on make/core. This is the final planned beta of WordPress 4.5, with a release candidate scheduled for next week.

Some of the changes in Beta 4 include:

• Add support for oEmbed moments and timelines from Twitter (#36197).
• More changes to better support HHVM with Imagick. Please test with HHVM setups and resizing/rotating images (#35973).
• Tightened up the Inline Link feature (#33301, #30468).
• Support <hr> editor shortcut with 3 or more dashes (---); no spaces. To give more time to study the best shortcuts for users, text patterns for bold and italic have been removed and won’t ship with for 4.5 (#33300).
• Fixes for SSL with Responsive Images. Please test with SSL, especially on sites with mixed http/https setups (#34945).
• Allow rewrite rules to work in nested WordPress installations on IIS (#35558).
• Various bug fixes. We’ve made almost 100 changes during the last week.

If you think you’ve found a bug, you can post to the Alpha/Beta area in the support forums. We’d love to hear from you! If you’re comfortable writing a reproducible bug report, file one on the WordPress Trac. There, you can also find a list of known bugs.

Happy testing!

Llegamos al fin
del tiempo pa’ beta
¡Pruébalo Ahora!

WordPress 4.5 Beta 3 is now available!

This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site just to play with the new version. To test WordPress 4.5, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the beta here (zip).

For more information on what’s new in 4.5, check out the Beta 1 and Beta 2 blog posts, along with in-depth field guides on make/core. Some of the fixes in Beta 3 include:

• Many Theme Logo Support (#33755) fixes, including support for bundled Twenty Fifteen (#35944).
• Add Responsive Preview to theme install previewer (#36017).
• Support Imagick in HHVM (#35973).
• Whitelist IPTC, XMP, and EXIF profiles from strip_meta() to maintain authorship, copyright, license, and image orientation (#28634).
• Support Windows shares/DFS roots in wp_normalize_path() (#35996).
• New installs default to generating secret keys and salts locally instead of relying on the WordPress.org API. Please test installing WP in situations where it can’t connect to the internet (like on a 🛳, ✈️, or 🛰) (#35290).
• OPTIONS requests to REST API should return Allow header (#35975).
• Upgrade twemoji.js to version 2 (#36059) and add extra IE11 compatibility (#35977) for Emoji.
• Various bug fixes. We’ve made more than 100 changes during the last week.

If you think you’ve found a bug, you can post to the Alpha/Beta area in the support forums. We’d love to hear from you! If you’re comfortable writing a reproducible bug report, file one on the WordPress Trac. There, you can also find a list of known bugs.

Happy testing!

Beta one, two, three
so many bugs have been fixed
Closer now; four, five.

WordPress 4.5 Beta 2 is now available!

This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site just to play with the new version. To test WordPress 4.5, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the beta here (zip).

For more information on what’s new in 4.5, check out the Beta 1 blog post. Some of the fixes in Beta 2 include:

• Added Horizontal Rule (HR) editing shortcut and dismissible “Paste as Text” notice in TinyMCE.
• Selective Refresh support is enabled for core themes titles and taglines, which allows shift-click to focus on controls and PHP filters to apply in the preview.
• Resolved a fatal error on image upload when ImageMagick could not complete stripping meta during resize (#33642).
• Various bug fixes. We’ve made just over 100 changes in the last week.

If you think you’ve found a bug, you can post to the Alpha/Beta area in the support forums. We’d love to hear from you! If you’re comfortable writing a reproducible bug report, file one on the WordPress Trac. There, you can also find a list of known bugs.

Happy testing!

It’s peer pressure time
Testing: all cool kids do it
Help find ALL the bugs!

It’s time for our second global contributor weekend, and this time we’re focusing on the video team. For this month’s challenge, in honor of it being our second month, you have two options for how you can participate! The challenge for this month overall is to work with at least one hour worth of WordCamp video, which you can do by either creating subtitles or editing the video file in preparation for upload to WordPress.tv.

One of the great things about contributing to the video team is that you get to learn so much, since all the work basically involves watching WordCamp presentation videos. Subtitling is a doubly important need, as it is needed to make all those WordCamp videos accessible to people who are deaf or hard of hearing and can’t listen to the audio track, as well as making it possible for the videos to be consumed (in some cases after subtitle translation) by people who speak different languages.

The challenge will last from Saturday, February 27, 2016 through Sunday, February 28, 2016, and the results will be reviewed afterward by members of the video team. If you enjoy the challenge, the video team would be very excited to welcome you into their ranks! Interested? Here’s how to participate.

What About Last Month?

In January, the inaugural contributor weekend was focused on the support forums. That challenge had 73 participants, including 10 people who provided 20 or more correct answers to open support threads, thereby winning the challenge. Congratulations to Harris Anastasiadis, Ahmad Awais, Takis Bouyouris, Phil Erb, Eric Gunawan, Jackie McBride, Diana Nichols, Kostas Nicolacopoulos, Juhi Saxena, and Sarah Semark! To them and to everyone else who participated, thank you so much for your efforts. Every answer helps, and over the course of this contributor weekend, these amazing volunteers responded to 800 support threads. The support forums queue of requests with no replies went from 28 pages to 7 pages — that was an incredible success, of which every participant was a part!

So head on over to see how to get involved with the one-hour video challenge this weekend, and help us make next month’s post just as impressive! 🙂