An Update with You in Mind
Gear up for a more intuitive WordPress!
Version 4.8 of WordPress, named “Evans” in honor of jazz pianist and composer William John “Bill” Evans, is available for download or update in your WordPress dashboard. New features in 4.8 add more ways for you to express yourself and represent your brand.
Though some updates seem minor, they’ve been built by hundreds of contributors with you in mind. Get ready for new features you’ll welcome like an old friend: link improvements, three new media widgets covering images, audio, and video, an updated text widget that supports visual editing, and an upgraded news section in your dashboard which brings in nearby and upcoming WordPress events.
Exciting Widget Updates
Image Widget
Adding an image to a widget is now a simple task that is achievable for any WordPress user without needing to know code. Simply insert your image right within the widget settings. Try adding something like a headshot or a photo of your latest weekend adventure — and see it appear automatically.
Video Widget
A welcome video is a great way to humanize the branding of your website. You can now add any video from the Media Library to a sidebar on your site with the new Video widget. Use this to showcase a welcome video to introduce visitors to your site or promote your latest and greatest content.
Audio Widget
Are you a podcaster, musician, or avid blogger? Adding a widget with your audio file has never been easier. Upload your audio file to the Media Library, go to the widget settings, select your file, and you’re ready for listeners. This would be a easy way to add a more personal welcome message, too!
Rich Text Widget
This feature deserves a parade down the center of town! Rich-text editing capabilities are now native for Text widgets. Add a widget anywhere and format away. Create lists, add emphasis, and quickly and easily insert links. Have fun with your newfound formatting powers, and watch what you can accomplish in a short amount of time.
Link Boundaries
Have you ever tried updating a link, or the text around a link, and found you can’t seem to edit it correctly? When you edit the text after the link, your new text also ends up linked. Or you edit the text in the link, but your text ends up outside of it. This can be frustrating! With link boundaries, a great new feature, the process is streamlined and your links will work well. You’ll be happier. We promise.
Nearby WordPress Events
Did you know that WordPress has a thriving offline community with groups meeting regularly in more than 400 cities around the world? WordPress now draws your attention to the events that help you continue improving your WordPress skills, meet friends, and, of course, publish!
This is quickly becoming one of our favorite features. While you are in the dashboard (because you’re running updates and writing posts, right?) all upcoming WordCamps and official WordPress Meetups — local to you — will be displayed.
Being part of the community can help you improve your WordPress skills and network with people you wouldn’t otherwise meet. Now you can easily find your local events just by logging in to your dashboard and looking at the new Events and News dashboard widget.
Even More Developer Happiness 😊
New CSS rules mean extraneous content (like “Add New” links) no longer need to be included in admin-area headings. These panel headings improve the experience for people using assistive technologies.
As fewer and fewer browsers support Silverlight, file formats which require the presence of the Silverlight plugin are being removed from core support. Files will still display as a download link, but will no longer be embedded automatically.
New capabilities have been introduced to 4.8 with an eye towards removing calls to
is_super_admin(). Additionally, new hooks and tweaks to more granularly control site and user counts per network have been added.
With the addition of TinyMCE to the text widget in 4.8 comes a new JavaScript API for instantiating the editor after page load. This can be used to add an editor instance to any text area, and customize it with buttons and functions. Great for plugin authors!
The introduction of a new base media widget REST API schema to 4.8 opens up possibilities for even more media widgets (like galleries or playlists) in the future. The three new media widgets are powered by a shared base class that covers most of the interactions with the media modal. That class also makes it easier to create new media widgets and paves the way for more to come.
Rejoice! New responsive breakpoints have been added to the customizer sidebar to make it wider on high-resolution screens. Customizer controls should use percentage-based widths instead of pixels.
The Squad
This release was led by Matt and Jeff Paul, with the help of the following fabulous folks. There are 346 contributors with props in this release, with 106 of them contributing for the first time. Pull up some Bill Evans on your music service of choice, and check out some of their profiles:
1naveengiri,
4nickpick,
Aaron D. Campbell,
Aaron Jorbin,
abhishek,
Abhishek Kumar,
abrain,
Adam Harley (Kawauso),
Adam Silverstein,
Adam Soucie,
Afzal Multani,
Ahmad Awais,
ajoah,
Alex Concha,
Alex Floyd Marshall,
Alex King,
Alex Shiels,
Andrea Fercia,
Andrea Middleton,
Andrew Nacin,
Andrew Ozz,
Andrew Rockwell,
Andy Mercer,
Ankit K Gupta,
arena94,
Arshid,
Arun,
asalce,
ashokkumar24,
Barry Ceelen,
bcworkz,
Bharat Kambariya,
Blobfolio,
bonger,
Boone B. Gorges,
Boro Sitnikovski,
Brad Touesnard,
Brady Vercher,
Brandon Kraft,
Brandon Lavigne,
Bridget Willard,
Bunty,
Cami Kaos,
Carl Alberto,
Casey Driscoll,
cazm,
ccprog,
Chandra Patel,
chesio,
chetansatasiya,
Chirag Patel,
Chouby,
Chris Klosowski,
Chris Mok,
chriseverson,
Christian Chung,
Corey McKrill,
Courtney P.K.,
Cristiano Zanca,
csloisel,
Curdin Krummenacher,
Cyrus Collier,
Daniel Bachhuber ,
Daniel Llewellyn,
Daniele Scasciafratte,
Darren Ethier (nerrad),
Darshan_dj,
darthaud,
Daryl L. L. Houston (dllh),
David A. Kennedy,
David Anderson,
David Binovec,
David Herrera,
David Shanske,
davidbenton,
designsimply,
Dhanendran,
Dharmesh Patel,
Dhaval Parekh,
dingo-d,
Dion Hulse,
Dominik Schilling,
Dotan Cohen,
DoubleH,
DreamOn11,
Drew Jaynes,
Drivingralle,
dspilka,
Edwin Cromley,
Ejner Galaz,
Ella Iseulde Van Dorpe,
emirpprime,
Eric Andrew Lewis,
Erick Hitter,
Ethan Allen,
Fabien Quatravaux,
Felix Arntz,
fibonaccina,
Florian TIAR,
Francesca Marano,
Frank Neumann-Staude,
Franz Josef Kaiser,
Gabriel Maldonado,
Garth Mortensen,
Gary Cao,
Gary Pendergast,
George Stephanis,
Gustave F. Gerhardt,
hedgefield,
Helen Hou-Sandí,
helgatheviking,
Hristo Pandjarov,
Ian Dunn,
ig_communitysites,
Igor Zinovyev,
imath,
Ipstenu (Mika Epstein),
ireneyoast,
Ivan Stefanov,
ivantedja,
J.D. Grimes,
Jack Reichert,
Jake Spurlock,
James Nylen,
Jaydeep Rami,
jazbek,
Jeff Bowen,
Jeff Farthing,
Jeff Paul,
Jeffrey de Wit,
Jen Miller,
Jeremy Felt,
Jeremy Pry,
Jignesh Nakrani,
Jip Moors,
jjcomack,
Joe Dolson,
Joe Hoyle,
Joe McGill,
John Blackbourn,
John James Jacoby,
John Regan,
Jonathan Desrosiers,
Jonny Harris,
Joost de Valk,
Josepha,
Josh Pollock,
Juhi Saxena,
Justin Kopepasah,
Justin Tucker,
K.Adam White,
kafleg,
Kailey (trepmal),
karinedo,
Kathryn,
kaushik,
Keanan Koppenhaver,
keesiemeijer,
Kelly Dwan,
Kite,
kjellr,
Konstantin Kovshenin,
Konstantin Obenland,
kostasx,
kubik-rubik,
KUCKLU,
Lance Willett,
Laurel Fulford,
Lee Willis,
leemon,
LewisCowles,
LiamMcArthur,
Lucas Stark,
lukasbesch,
Luke Cavanagh,
Maedah Batool,
Mahesh Prajapati,
mantismamita,
Marin Atanasov,
Mario Aguiar,
Mark Jaquith,
Mark Root-Wiley,
Mark Uraine,
Marko Heijnen,
Matheus Martins,
MatheusGimenez,
mathieuhays,
matias,
Matt Wiebe,
Matthew Boynes,
Matthew Haines-Young,
mattyrob,
Maxime Culea,
Mayo Moriyama,
Mayur Keshwani,
Mel Choyce,
Menaka S.,
Michael Arestad,
michalzuber,
michelleweber,
Miina Sikk,
Mike Crantea,
Mike Hansen,
Mike Jolley,
Mike Little,
Mike Nelson,
Mike Schroder,
Milan Dinić,
Milind More,
Mithun Raval,
MMDeveloper,
Mohammad Jangda,
mohanjith,
monikarao,
Morgan Estes,
moto hachi ( mt8.biz ),
MrGregWaugh,
mschadegg,
Muhammet Arslan,
MULTIDOTS,
Naoko Takano,
Naomi C. Bush,
Nate Reist,
Ned Zimmerman,
Nick Halsey ,
Nikhil Chavan,
Nitin Kevadiya,
Nitish Kaila,
nobremarcos,
NoseGraze,
nsundberg,
nullvariable,
odyssey,
page-carbajal,
Pascal Birchler,
Paul Bearne,
Paul Biron,
Paul de Wouters,
Paul Ryan,
pavelevap,
Payton Swick,
pdufour,
Perdaan,
Peter Wilson,
Philip John,
Piotr Delawski,
Piotr Soluch,
postpostmodern,
Pranali Patel,
Pratik Shrestha,
Presskopp,
printsachen1,
Priyanka Behera,
prosti,
ptbello,
Rachel Baker,
Rafael Ehlers,
raggedrobins,
raisonon,
Rami Yushuvaev,
ramiabraham,
ranh,
RC Lations,
redrambles,
reidbusi,
reldev,
rellect,
RENAUT,
rensw90,
reportermike,
Rian Rietveld,
Riddhi Mehta,
Robbie Cahill,
Robert O'Rourke,
Robin Cornett,
runciters,
Ryan Boren,
Ryan McCue,
Ryan Welcher,
Sagar Jadhav,
Sagar Prajapati,
sagarkbhatt,
Sal Ferrarello,
Samantha Miller,
Sami Keijonen,
Samuel Sidler,
Sanket Parmar,
sathyapulse,
sboisvert,
Scott Reilly,
Scott Taylor,
Sean Hayes,
Sebastian Pisula,
Sergey Biryukov,
sfpt,
sgolemon,
Shady Sharaf,
Shashwat Mittal,
shazahm1,
shulard,
slbmeh,
Soren Wrede,
Stanimir Stoyanov,
Stephane Daury (stephdau),
Stephen Edgar,
Stephen Harris,
Steven Word,
Storm Rockwell,
Sudar Muthu,
Supercoder,
Sybre Waaijer,
szaqal21,
taggon,
Takayuki Miyauchi,
Takayuki Miyoshi,
Tammie Lister,
technopolitica,
teinertb,
tejas5989,
terwdan,
tharsheblows,
theMikeD,
thepelkus,
Thorsten Frommen,
Timmy Crawford,
Timothy Jacobs,
timph,
tmatsuur,
tomdxw,
Topher,
Travis Smith,
triplejumper12,
truongwp,
tymvie,
Ulrich,
Utkarsh,
vaishu.agola27,
vijustin,
vortfu,
Weston Ruter,
wpfo,
xrmx,
ze3kr, and
Zeljko Ascic.
Finally, thanks to all the community translators who worked on WordPress 4.8. Their efforts bring WordPress 4.8 fully translated to 38 languages at release time with more on the way.
Do you want to report on WordPress 4.8? We’ve compiled a press kit featuring information about the release features, and some media assets to help you along.
If you want to follow along or help out, check out Make WordPress and our core development blog. Thanks for choosing WordPress — we hope you enjoy!
Like this:
Like Loading...
The second release candidate for WordPress 4.8 is now available.
To test WordPress 4.8, you can use the WordPress Beta Tester plugin or you can download the release candidate here (zip).
We’ve made a handful of changes since releasing RC 1 last week. For more details about what’s new in version 4.8, check out the Beta 1, Beta 2, and RC1 blog posts.
Think you’ve found a bug? Please post to the Alpha/Beta support forum. If any known issues come up, you’ll be able to find them here.
Happy testing!
Like this:
Like Loading...
The release candidate for WordPress 4.8 is now available.
RC means we think we’re done, but with millions of users and thousands of plugins and themes, it’s possible we’ve missed something. We hope to ship WordPress 4.8 on Thursday, June 8, but we need your help to get there. If you haven’t tested 4.8 yet, now is the time!
To test WordPress 4.8, you can use the WordPress Beta Tester plugin or you can download the release candidate here (zip).
We’ve made a handful of changes since releasing Beta 2 earlier this week. For more details about what’s new in version 4.8, check out the Beta 1 and Beta 2 blog posts.
Think you’ve found a bug? Please post to the Alpha/Beta support forum. If any known issues come up, you’ll be able to find them here.
Developers, please test your plugins and themes against WordPress 4.8 and update your plugin’s Tested up to version in the readme to 4.8. If you find compatibility problems please be sure to post to the support forums so we can figure those out before the final release – we work hard to avoid breaking things. An in-depth field guide to developer-focused changes is coming soon on the core development blog.
Do you speak a language other than English? Help us translate WordPress into more than 100 languages!
This release’s haiku is courtesy of @matveb:
Érrese uno
Cien veces y más
Erre ce dos
Thanks for your continued help testing out the latest versions of WordPress.
Like this:
Like Loading...
WordPress 4.8 Beta 2 is now available!
This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site just to play with the new version. To test WordPress 4.8, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the beta here (zip).
For more information on what’s new in 4.8, check out the Beta 1 blog post. Since then, we’ve made over 50 changes in Beta 2.
Do you speak a language other than English? Help us translate WordPress into more than 100 languages!
If you think you’ve found a bug, you can post to the Alpha/Beta area in the support forums. We’d love to hear from you! If you’re comfortable writing a reproducible bug report, file one on WordPress Trac, where you can also find a list of known bugs.
WordPress four point eight
One step closer to release
Please test Beta 2!
Like this:
Like Loading...
WordPress 4.7.5 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
WordPress versions 4.7.4 and earlier are affected by six security issues:
- Insufficient redirect validation in the HTTP class. Reported by Ronni Skansing.
- Improper handling of post meta data values in the XML-RPC API. Reported by Sam Thomas.
- Lack of capability checks for post meta data in the XML-RPC API. Reported by Ben Bidner of the WordPress Security Team.
- A Cross Site Request Forgery (CSRF) vulnerability was discovered in the filesystem credentials dialog. Reported by Yorick Koster.
- A cross-site scripting (XSS) vulnerability was discovered when attempting to upload very large files. Reported by Ronni Skansing.
- A cross-site scripting (XSS) vulnerability was discovered related to the Customizer. Reported by Weston Ruter of the WordPress Security Team.
Thank you to the reporters of these issues for practicing responsible disclosure.
In addition to the security issues above, WordPress 4.7.5 contains 3 maintenance fixes to the 4.7 release series. For more information, see the release notes or consult the list of changes.
Download WordPress 4.7.5 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.7.5.
Thanks to everyone who contributed to 4.7.5.
Like this:
Like Loading...
WordPress has grown a lot over the last thirteen years – it now powers more than 28% of the top ten million sites on the web. During this growth, each team has worked hard to continually improve their tools and processes. Today, the WordPress Security Team is happy to announce that WordPress is now officially on HackerOne!
HackerOne is a platform for security researchers to securely and responsibly report vulnerabilities to our team. It provides tools that improve the quality and consistency of communication with reporters, and will reduce the time spent on responding to commonly reported issues. This frees our team to spend more time working on improving the security of WordPress.
The security team has been working on this project for quite some time. Nikolay Bachiyski started the team working on it just over a year ago. We ran it as a private program while we worked out our procedures and processes, and are excited to finally make it public.
With the announcement of the WordPress HackerOne program we are also introducing bug bounties. Bug bounties let us reward reporters for disclosing issues to us and helping us secure our products and infrastructure. We’ve already awarded more than $3,700 in bounties to seven different reporters! We are thankful to Automattic for paying the bounties on behalf of the WordPress project.
The program and bounties cover all our projects including WordPress, BuddyPress, bbPress, GlotPress, and WP-CLI as well as all of our sites including WordPress.org, bbPress.org, WordCamp.org, BuddyPress.org, and GlotPress.org.
Like this:
Like Loading...
We’re planning a smaller WP release early next month, bringing in three major enhancements:
- An improved visual editor experience, with a new TinyMCE that allows you to navigate more intuitively in and out of inline elements like links. (Try it out to see, it’s hard to describe.)
- A revamp of the dashboard news widget to bring in nearby and upcoming events including meetups and WordCamps.
- Several new media widgets covering images, audio, and video, and an enhancement to the text widget to support visual editing.
The first beta of 4.8 is now available for testing. You can use the beta tester plugin (or just run trunk) to try the latest and greatest, and each of these areas could use a ton of testing. Our goals are to make editing posts with links more intuitive, make widgets easier for new users and more convenient for existing ones, and get many more people aware of and attending our community events.
Four point eight is here
Small changes with a big punch
Big ones come later
Like this:
Like Loading...
After almost sixty million downloads of WordPress 4.7, we are pleased to announce the immediate availability of WordPress 4.7.4, a maintenance release.
This release contains 47 maintenance fixes and enhancements, chief among them an incompatibility between the upcoming Chrome version and the visual editor, inconsistencies in media handling, and further improvements to the REST API. For a full list of changes, consult the release notes and the list of changes.
Download WordPress 4.7.4 or visit Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.7.4.
Thanks to everyone who contributed to 4.7.4:
Aaron Jorbin, Adam Silverstein, Andrea Fercia, Andrew Ozz, aussieguy123, Blobfolio, boldwater, Boone Gorges, Boro Sitnikovski, chesio, Curdin Krummenacher, Daniel Bachhuber, Darren Ethier (nerrad), David A. Kennedy, davidbenton, David Herrera, Dion Hulse, Dominik Schilling (ocean90), eclev91, Ella Van Dorpe, Gustave F. Gerhardt, ig_communitysites, James Nylen, Joe Dolson, John Blackbourn, karinedo, lukasbesch, maguiar, MatheusGimenez, Matthew Boynes, Matt Wiebe, Mayur Keshwani, Mel Choyce, Nick Halsey, Pascal Birchler, Peter Wilson, Piotr Delawski, Pratik Shrestha, programmin, Rachel Baker, sagarkbhatt, Sagar Prajapati, sboisvert, Scott Taylor, Sergey Biryukov, Stephen Edgar, Sybre Waaijer, Timmy Crawford, vortfu, and Weston Ruter.
Like this:
Like Loading...
WordPress 4.7.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
WordPress versions 4.7.2 and earlier are affected by six security issues:
- Cross-site scripting (XSS) via media file metadata. Reported by Chris Andrè Dale, Yorick Koster, and Simon P. Briggs.
- Control characters can trick redirect URL validation. Reported by Daniel Chatfield.
- Unintended files can be deleted by administrators using the plugin deletion functionality. Reported by TrigInc and xuliang.
- Cross-site scripting (XSS) via video URL in YouTube embeds. Reported by Marc Montpas.
- Cross-site scripting (XSS) via taxonomy term names. Reported by Delta.
- Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources. Reported by Sipke Mellema.
Thank you to the reporters for practicing responsible disclosure.
In addition to the security issues above, WordPress 4.7.3 contains 39 maintenance fixes to the 4.7 release series. For more information, see the release notes or consult the list of changes.
Download WordPress 4.7.3 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.7.3.
Thanks to everyone who contributed to 4.7.3: Aaron D. Campbell, Adam Silverstein, Alex Concha, Andrea Fercia, Andrew Ozz, asalce, blobfolio, bonger, Boone Gorges, Boro Sitnikovski, Brady Vercher, Brandon Lavigne, Bunty, ccprog, chetansatasiya, David A. Kennedy, David Herrera, Dhanendran, Dion Hulse, Dominik Schilling (ocean90), Drivingralle, Ella Van Dorpe, Gary Pendergast, Ian Dunn, Ipstenu (Mika Epstein), James Nylen, jazbek, Jeremy Felt, Jeremy Pry, Joe Hoyle, Joe McGill, John Blackbourn, John James Jacoby, Jonathan Desrosiers, Kelly Dwan, Marko Heijnen, MatheusGimenez, Mike Nelson, Mike Schroder, Muhammet Arslan, Nick Halsey, Pascal Birchler, Paul Bearne, pavelevap, Peter Wilson, Rachel Baker, reldev, Robert O’Rourke, Ryan Welcher, Sanket Parmar, Sean Hayes, Sergey Biryukov, Stephen Edgar, triplejumper12, Weston Ruter, and wpfo.
Like this:
Like Loading...
WordPress 4.7.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
WordPress versions 4.7.1 and earlier are affected by three security issues:
- The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it. Reported by David Herrera of Alley Interactive.
WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Mo Jangda (batmoo).- A cross-site scripting (XSS) vulnerability was discovered in the posts list table. Reported by Ian Dunn of the WordPress Security Team.
- An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint. Reported by Marc-Alexandre Montpas of Sucuri Security. *
Thank you to the reporters of these issues for practicing responsible disclosure.
Download WordPress 4.7.2 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.7.2.
Thanks to everyone who contributed to 4.7.2.
* Update: An additional serious vulnerability was fixed in this release and public disclosure was delayed. For more information on this vulnerability, additional mitigation steps taken, and an explanation for why disclosure was delayed, please read Disclosure of Additional Security Fix in WordPress 4.7.2.
Like this:
Like Loading...
Older Posts »
