-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 29 Oct 2026 20:21:19 +1100
Source: wordpress
Binary: wordpress wordpress-l10n wordpress-theme-twentytwentyfive wordpress-theme-twentytwentyfour wordpress-theme-twentytwentythree
Architecture: all
Version: 6.8.12+dfsg1-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Craig Small <csmall@debian.org>
Description:
 wordpress  - weblog manager
 wordpress-l10n - weblog manager - language files
 wordpress-theme-twentytwentyfive - weblog manager - twentytwentyfive theme files
 wordpress-theme-twentytwentyfour - weblog manager - twentytwentyfour theme files
 wordpress-theme-twentytwentythree - weblog manager - twentytwentythree theme files
Closes: 1150336 1152426
Changes:
 wordpress (6.8.12+dfsg1-0+deb13u1) trixie-security; urgency=medium
 .
   * 6.8.12 backport of security release 7.1.4 Closes: #1152426
      Stored XSS with specially crafted block markup.
      Privacy Data Removal Requests can be created in a way that leads to
       stored XSS.
      Multiple stored XSS issues in the Interactivity API.
      Stored DoS issue in the Interactivity API.
      Stored XSS in Customizer selective refresh.
      Stored XSS in the Categories block.
      Specially crafted User Logins can lead to a stored XSS.
      Unpublished customizer changesets can be discovered by unauthenticated
       users.
      Stored XSS in Playlist and image blocks.
      Stored XSS in core/comments-pagination-next and
       core/comments-pagination-previous blocks.
      Notes can be read by privileged users that lack access to edit the post
       the note is attached to.
    * Possibly not applicable but updated anyway:
      An update to the bundled root certificates due to the eMudhra revocation.
      A weakness in the WordPress upgrade process which can lead to remote code
       execution during the upgrade window.
 .
   * 6.8.11 backport of security release 7.1.3
     Unauthenticated disclosure of comments on private & unpublished posts
     CVE-2026-66666 Closes: #1150336
Checksums-Sha1:
 17c63321c6c8a319d92082f2bfdc0ea1451fac8d 4371256 wordpress-l10n_6.8.12+dfsg1-0+deb13u1_all.deb
 1070419bd1b64f64c1c8eea9c619a81595dba970 7905764 wordpress-theme-twentytwentyfive_6.8.12+dfsg1-0+deb13u1_all.deb
 2b3a35f90d06a8bba8c9da82ddad3aea505a453e 2918108 wordpress-theme-twentytwentyfour_6.8.12+dfsg1-0+deb13u1_all.deb
 51166782238fbefa0307cacfe8c02e8edeacce09 2115000 wordpress-theme-twentytwentythree_6.8.12+dfsg1-0+deb13u1_all.deb
 1c524e49035bc02325abd8ebab946162296e1988 7703 wordpress_6.8.12+dfsg1-0+deb13u1_all-buildd.buildinfo
 594ae023dba5a0e99a5edcbd87a31d207f1eaef7 8943956 wordpress_6.8.12+dfsg1-0+deb13u1_all.deb
Checksums-Sha256:
 a4dc2a992dbab9c0f062fe7eab30786277a9e209c4487e22f0b2084a6c228779 4371256 wordpress-l10n_6.8.12+dfsg1-0+deb13u1_all.deb
 2e0676de0a4c075c41e7947ac645b3683bed0ef00f48f7d2af98876efa6b2eb8 7905764 wordpress-theme-twentytwentyfive_6.8.12+dfsg1-0+deb13u1_all.deb
 4eab39ddb45e1a0067b6860b32d79bf5bb8bf36bc143f7bf3b876b89dbb27c21 2918108 wordpress-theme-twentytwentyfour_6.8.12+dfsg1-0+deb13u1_all.deb
 afe85de20e2e161b3c69779578de49549c643fa8b3bf85d6bf277df14b1983f0 2115000 wordpress-theme-twentytwentythree_6.8.12+dfsg1-0+deb13u1_all.deb
 9d3a1bdbfef0e61e6cd101a68083f0dd16119e838cca3c803cb90d14d47b0ac9 7703 wordpress_6.8.12+dfsg1-0+deb13u1_all-buildd.buildinfo
 d398d413b9f95695a9bf57a6a5830cc6f8c5ac42b4151015ffbd6d6756266a8d 8943956 wordpress_6.8.12+dfsg1-0+deb13u1_all.deb
Files:
 d43830ca2ca92546512a4b39ac52235a 4371256 localization optional wordpress-l10n_6.8.12+dfsg1-0+deb13u1_all.deb
 2da939b7998e4d2b7917b8c397b07261 7905764 web optional wordpress-theme-twentytwentyfive_6.8.12+dfsg1-0+deb13u1_all.deb
 ddc4c81e209eb07a135c52a4d5c2795a 2918108 web optional wordpress-theme-twentytwentyfour_6.8.12+dfsg1-0+deb13u1_all.deb
 59c1b81bff87e739c74faaa04ebd50ed 2115000 web optional wordpress-theme-twentytwentythree_6.8.12+dfsg1-0+deb13u1_all.deb
 64e69a45c81a45dce4214078c33804f7 7703 web optional wordpress_6.8.12+dfsg1-0+deb13u1_all-buildd.buildinfo
 e02ed1104e65db1b9d12715599ceefec 8943956 web optional wordpress_6.8.12+dfsg1-0+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmrjJHMACgkQaBVi67oX
tfkjTRAAzjFt2NWklHfTEuYoIcHr7SKJqUZ3VhPz+CxzMwrs6y9LPgKx5KKCd29L
Dj5Fw+7PFRj2vhTPEFdKqhkyuX46YxV28Zqad8NM6JYvwM5dIm6LtFEde/jdj9Sn
suDa/wlxUyBjqbZxqwXPWxL0kq8Kj+Zuyz5YT4ZAgdQ4yvCBBGitiYC6WKsxYkYy
vcpa3h8hCp/eKeaDn9sVSyK/4Y0PwQEkLuFZH9e/pcUpL+N1GLdf8Uu819CQypQ7
2BOrXp21oyLtsTy1fNaO98bFzMXUvqAq/pD6LHir1Lroz91NymUvIzOodP35+4e5
R6d7GjBi02P6Oo82TRThQ80FeC2qlsa3titQlKzY4NtFRl0KYyrOU0F+KQ4NhxWm
EuPl8Qjs1En9Pr/jdy5NafOtqsxfEBZzBGnP6K67xSbxKbrX/B3dngpZAo8mFw78
zcfyOXQ//I/Js2xdIOgBmjuIpvH6CokmK3zsZ039ysNo2lqReEmEQSfH+7iE2E5c
X+kH2J3GWaMDbT4jDeMj0HKV8TpBL3JE3/3ZKYWFkDQh4v5AfIIIjK8N7G1WkA7s
LxlNXUvmMd3lz4gfIDrpYWjrI+sDCL+YGBiiCd/ob0NMckApyF3PU/MJQJ+JUliX
laM0XpYwF8OLnt1ZAAewq7iWZTGvcdjVfz4DfKNGdiVGFIvph5E=
=JzwF
-----END PGP SIGNATURE-----