Automattic Release Notes

New Features

• Add a What's new feed with announcements from the Pocket Casts team, opened from the bell on the Profile tab. Unread messages show a dot, which you can turn off in Settings → General, and read messages sync across your devices when you're signed in (#6082)

Bug Fixes

• Show the same flat toolbar on every screen opened from Profile (#6093)
• Fix a crash when refreshing podcasts while the system account service is unavailable (#6105)
• Fix a crash when opening onboarding or upgrade screens on Android 8.0 (#6104)

Release Notes

Make it easier to watch a video full screen: a button over the video in the player zooms it into the full screen player, rotating to landscape for landscape videos on iPhone, and a matching button brings it back #4988

Fix the in-app support form failing with "Oops something went wrong" for some customers #5266

Fix a bookmark disappearing from the list before the deletion confirmation appears when you swipe to delete it #5273

Fix the app never compacting its database, so storage freed by removing podcasts and episodes is now reclaimed #5233

The network header artwork now extends under the navigation bar on iOS 26 #5066

Fix a crash when resuming some downloaded episodes partway through #5279

Fix the message on the empty Podcasts tab being cut off after one line #5176

Fix long episode titles running past the edges of the Now Playing row on the Apple Watch #5139

Fix VoiceOver reading image names instead of labels for the podcast Follow button, the Cast button, the player's chapter and Effects buttons, the Profile banner's close button, and the notifications permission checkbox #5178

Fix episode downloads still using the old file link after the podcast replaced it with a new one, which could make the download fail #5274

Add a What's New feed with announcements from the Pocket Casts team, opened from the Profile tab #5077 #5294 #5300

Fix memory leaks when leaving empty playlists, empty folders, the Files screen and the Add to Playlist sheet #5284

Reduce the memory the app uses for artwork #5291

Fix Auto Download not downloading episodes added to a manual playlist until the next sync #5080

Fix a possible crash with Voice Boost on when switching episodes #5296

Ask for confirmation before Close and Clear Up Next in the mini player menu clears the queue #5261

Fix a possible crash with Voice Boost on when switching episodes #5296 #5280

Make it easier to watch a video full screen: a button over the video in the player zooms it into the full screen player, rotating to landscape for landscape videos on iPhone, and a matching button brings it back #4988

Fix the in-app support form failing with "Oops something went wrong" for some customers #5266

Fix a bookmark disappearing from the list before the deletion confirmation appears when you swipe to delete it #5273

Fix the app never compacting its database, so storage freed by removing podcasts and episodes is now reclaimed #5233

The network header artwork now extends under the navigation bar on iOS 26 #5066

Fix a crash when resuming some downloaded episodes partway through #5279

Fix the message on the empty Podcasts tab being cut off after one line #5176

Fix long episode titles running past the edges of the Now Playing row on the Apple Watch #5139

Fix VoiceOver reading image names instead of labels for the podcast Follow button, the Cast button, the player's chapter and Effects buttons, the Profile banner's close button, and the notifications permission checkbox #5178

Fix episode downloads still using the old file link after the podcast replaced it with a new one, which could make the download fail #5274

Add a What's New feed with announcements from the Pocket Casts team, opened from the Profile tab #5077 #5294 #5300

Fix memory leaks when leaving empty playlists, empty folders, the Files screen and the Add to Playlist sheet #5284

Reduce the memory the app uses for artwork #5291

Fix Auto Download not downloading episodes added to a manual playlist until the next sync #5080

Fix a possible crash with Voice Boost on when switching episodes #5296

Ask for confirmation before Close and Clear Up Next in the mini player menu clears the queue #5261

Fix a possible crash with Voice Boost on when switching episodes #5296 #5280

Fix New Episodes push notifications still arriving after turning off Profile → Settings → Notifications → New Episodes #5039

Fix portrait video episodes overflowing the player artwork area, overlapping the controls and episode title #5058

Fix transcripts not showing for podcasts whose feeds serve them as plain text, such as those hosted on Transistor #5055

Playback failures caused by a full disk now report a storage error instead of asking you to check your internet connection #5056

Fix the Chromecast button being invisible in the fullscreen video player #5060

Fix a memory leak that kept the episode details screen, its views and artwork in memory after it was closed #5067

Fix the controls in the fullscreen video player being too small to tap reliably #5059

Add podcast networks to Discover: a "Networks" row on the Discover tab, the full grid of networks behind "Show All", and a page for each network listing the podcasts it carries #5026 #5064 #5065

Add networks to search: a matching network now shows up in Top Results, and a "Networks" filter appears when the term matches one #5036

Open a podcast's network from the podcast page, either from the author in the header or from the author row in the details below it #5040 #5075

[tvOS] Add networks to search, in Combined Results and in a tab of their own #5037

Fix a Smart Bookmark's captured passage not syncing when signing in on a new device #5103

Fix a crash when tapping the link in a Discover collection or network header #5160

This security release features a fix for a critical severity security vulnerability.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security update included in this release

The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).

Thank you to these WordPress contributors

This release was led by John Blackbourn. WordPress 7.1.2 would not have been possible without the contributions of the following people:

Aaron Jorbin, Aki Hamano, Alex Concha, Ehtisham Siddiqui, fiocavallari, Jb Audras, Jeffrey Paul, Jeremy Felt, Joe McGill, John Blackbourn, Lance Willett, Manuel Camargo, marcs0h, martin.krcho, Mukesh Panchal, Olga Gleckler, Pascal Birchler, Peter Wilson, Rajin Sharwar, Ressl, Shail Mehta, Stephanie Walters, and vortfu.

CVE and GHSA references

Further details can be found in the advisory: CVE-2026-87902 / GHSA-7hp8-65ch-5whp.

Backports

As a courtesy, the security fix is being backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

New Features

• Log in to the Wear OS app by scanning a QR code with your phone or entering a code on the web (#5964)
• Smart Bookmarks (#6038)
• Switch accounts from the screen that appears when you pair a device by scanning its QR code (#6019)
• Swipe a bookmark to share or delete it (#6041)

Bug Fixes

• Show the podcast grid and playlists in Android Auto again, instead of only a short list of recent episodes (#6098)
• Show every matching folder in search results instead of only the last one (#5953)
• Show the correct play or pause button for User Files (#5963)
• Remove the bookmark icon from an episode as soon as its last bookmark is deleted, instead of waiting for the next sync (#6005)
• Keep a newly uploaded file in view instead of letting the Files list jump past it (#6005)
• Confirm playlist removals and mixed changes after adding episodes to playlists, not only additions (#5632)
• Fix Profile tab refresh button from being hidden behind the bottom nav after a cold start (#6033)
• Show a single launcher icon after choosing a custom app icon (#5609)
• Enable the transcript button on the full-screen player without playing the episode or opening the details page (#6034)
• Stay in Pocket Casts after changing the app icon instead of closing to the home screen (#6017)
• Resume playback immediately when a headphone or car play button is pressed (#5645)
• Prevent Cast connection failures from interrupting local playback or removing playback controls (#5656)
• Keep the Automotive account screens usable at large font sizes by not opening the keyboard over them (#6030)

This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 7.1.1 is a short-cycle release. The next major release will be version 7.2 and is currently planned for December.

For more information, please visit the WordPress 7.1.1 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by Jakub Herman.
• Comments, including notes, can be reparented by any authenticated user, reported by Justin Hart, Viridis Security.

Thank you to these WordPress contributors

This release was led by Adam Silverstein, Adrian Duffell, Andrei Draganescu, and Aaron Jorbin.

WordPress 7.1.1 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, abrahamfariaz, Adam Silverstein, Adi Moldovan, Adrian Duffell, Aki Hamano, Alex Concha, Andrea Fercia, andreasca, Andrei Draganescu, Andrew Duthie, Andrew Serong, André Maneiro, annezazu, Anthony White, Arkaprabha Chowdhury, Ashar Fuadi, Azragh, Barry, buffer1024, Chunhui Ouyang, Courtney Robertson, Dagan, Daniel Richards, Daniel Rodriguez, Darshit Rajyaguru, David Biňovec, Deepak Kumar, Dennis Snell, DevSaiful, Dhruvang21, Dominik Schilling, Ehtisham Siddiqui, Ella Van Durpe, Erick Wambua, FahimMurshed, Fernando Tellado, fiocavallari, George Mamadashvili, George Vasiliades, gregbenz, Harish Tewari, Hit Bhalodia, Isabel Brison, Jake Spurlock, Jamie Dąbrowiecki, Jb Audras, Jeffrey Paul, Jeremy Felt, Jiwoon Kim, Joe Dolson, Joe Hoyle, Joe McGill, Joen Asmussen, Johannes Jülg, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Josh, Kamran Abdul Aziz, Khokan Sardar, Kira Schroder, kleisauke, Kushagra Goyal, l1onofjudah, Lance Willett, luksusspokoju, Manzoor Wani, Marco Ciampini, marcs0h, Marin Atanasov, Michael, Mohammad Jangda, mrkenobi, Mukesh Panchal, Nawazkhan Pathan, Nik Tsekouras, Parth Jogi, Pascal Birchler, Paul Biron, Paul Kevan, Peter Wilson, Rafie Muhammad, ramonopoly, Rashed Hossain, Ressl, Riad Benguella, Rudy Faile, Sainath Poojary, Scott Kingsley Clark, Sergey Biryukov, Shail Mehta, Shameem – a11n, siliconforks, Slava Abakumov, Stephen Bernhardt, Sukhendu Sekhar Guria, Ugyen Dorji, Utsav Ladani, vortfu, Weston Ruter, w3bdsgn, wolf45 plus representatives from Automattic, Bluehost, GoDaddy, Pantheon, and WP Engine.

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Props to Ehtisham Siddiqui, Lance Willett, Weston Ruter, and Adam Silverstein for proofreading.

New Features

• Browse podcast networks from Discover, search and the podcast page (#5865)

Bug Fixes

• Fix video freezing when rotating into landscape fullscreen and stuttering when resuming from the background (#5844)
• Keep Picture-in-Picture video playing across rotation and config changes, and restore the inline video after closing PiP (#5912)
• Keep the multi-select episode selection when rotating the device on the podcast screen (#5836)
• Prevent the app from being killed in the background on low-memory devices by pausing player UI updates while playing (#5843)
• Closing the transcript search bar now keeps the transcript open at the same scroll position instead of exiting the transcript (#5835)
• Stop "Cache entire playing episode" from silently downloading oversized or video enclosures in the background (#5868)
• Keep the Playback Effects icon visible on the Now Playing screen when a podcast's colours haven't loaded yet (#5877)
• Show the bookmark details play control as a time button in the header and open the episode when its artwork or title is tapped (#5946)

Fix Listening History search showing "No episodes found" before the search had finished, and results not turning up until the query was retyped when history synced late #4984

Fix the app freezing and closing itself when creating a Smart Playlist #4993

Add a Bluesky link to the About screen alongside Website, Instagram and X #4998

Fix setting the sleep timer through Siri or Shortcuts while the device is locked #4812

Fix a rare crash when starting episode downloads #5001

Tapping a Discover collection's poster now opens the expanded collection, the same as tapping "Show All" #5028

Add support for "Networks" row in "Discover" #5026

Add networks to search, including "Combined Results" and a new dedicated tab/filter #5037

Fix the Download button doing nothing in Search and Discover episode results #4702

Fix a rare crash when the What's New screen was shown while another screen was still being dismissed #5003

Add Smart Bookmarks

bookmarks now suggest a title and capture the surrounding passage from the episode transcript, mark their spot in the transcript, and anchor their timestamp to the transcript's reference timeline so it stays accurate even when dynamic ads shift the audio #4761

Add swipe actions to bookmark rows (Share and Delete) in the Player, the podcast screen's Bookmarks tab, standalone Podcast bookmarks, Episode, and Profile bookmark lists #4900 #4912

Add a Sleep Timer Live Activity so users can see the remaining sleep timer countdown from the Lock Screen and Dynamic Island. #4949

Tapping a bookmark's artwork now opens the episode the bookmark was made in #4928

Fix animations on the podcast screen's Bookmarks tab: rows now animate as they are added, removed and filtered, and highlight when tapped #4904

Fix bookmark multi-select losing track of a selected bookmark when it was edited or updated by a sync, leaving a wrong selection count and a row that could not be deselected #4913

Fix the bookmark multi-select long press options: Select all above/below now flip to Deselect all above/below once that range is selected, and are left out for the first and last bookmark #4915

Fix the podcast screen tabs being clipped when scrolled #4918

Fix the colors on the Bookmarks screen in Profile: the list no longer shows up as a light gray slab on the dark themes, the whole screen uses one surface, and the search field is legible on every theme #5007

Fix the About and Legal & More screens not following the app's theme, the Automattic family logos being misaligned, and legal pages (Terms of Service, Privacy Policy, Acknowledgements) not expanding beyond the safe area #4887

Improve playback reliability when starting audio #4938

Optimize fingerprinting and features that depend on it, including synced transcripts and more #4846, #4847

[tvOS] Show Episode artworks on player, episode show notes and podcast episode list #4893

[tvOS] Add a Top Results tab to Search, now the default, showing a Featured row of matching video episodes followed by Episodes and Podcasts rows. The Episodes tab leads with the same Featured row whenever a search turns up video episodes #4926

Fix the Bookmarks multi-select layout: rows keep their text width instead of shrinking, the selection bar sits just above the mini player instead of floating too high, and on iOS 26 it hides the tab bar and mini player correctly #4819

Fix the day label in episode cells growing out of proportion at large text sizes #4818

[tvOS] Add audio-reactive waveform to TV now playing screen. #4853

Make the Up Next navigation bar consistent between the tab and player presentations: Select and a new "…" menu with Clear Up Next on the trailing edge, and a standard close button when opened from the player #4875

[tvOS] Add audio-reactive waveform to TV now playing screen. #4853

[tvOS] Fix VoiceOver accessibility issues across the app: unlabeled tiles, fragmented row/text reads, and missing announcements for toasts, sign-in, and pairing #4888

[tvOS] Add support for regular episode lists. #4852

[tvOS] Fix episode count on smart playlists #4905

Fix a crash when the sign in prompt was shown while another screen was still being dismissed #4903

[tvOS] Add support server driven home page layout #4854

[tvOS] Add support for HLS episodes previews in episodes video list #4921

Recognise more HLS content types in alternate enclosures #4935

Disable "Tab Bar Minimizing" by default – there is an option to opt-in in Appearance Settings #4950