Three external libraries included in WordPress received security updates:

• Plupload (version 1.5.4), which WordPress uses for uploading media.
• SWFUpload, which WordPress previously used for uploading media, and may still be in use by plugins.
• SWFObject, which WordPress previously used to embed Flash content, and may still be in use by plugins and themes.

Thanks to Neal Poole and Nathan Partlan for responsibly disclosing the bugs in Plupload and SWFUpload, and Szymon Gruszecki for a separate bug in SWFUpload.

WordPress 3.3.2 also addresses:

• Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances, disclosed by Jon Cave of our WordPress core security team, and Adam Backstrom.
• Cross-site scripting vulnerability when making URLs clickable, by Jon Cave.
• Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs. Thanks to Mauro Gentile for responsibly disclosing these issues to the security team.

These issues were fixed by the WordPress core security team. Five other bugs were also fixed in version 3.3.2. Consult the change log for more details.

Download WordPress 3.3.2 or update now from the Dashboard → Updates menu in your site’s admin area.

WordPress 3.4 Beta 3 also available

Our development of WordPress 3.4 development continues. Today we are proud to release Beta 3 for testing. Nearly 90 changes have been made since Beta 2, released 9 days ago. (We are aiming for a beta every week.)

This is still beta software, so we don’t recommend that you use it on production sites. But if you’re a plugin developer, a theme developer, or a site administrator, you should be running this on your test environments and reporting any bugs you find. (See the known issues here.) If you’re a WordPress user who wants to open your presents early, take advantage of WordPress’s famous 5-minute install and spin up a secondary test site. Let us know what you think!

Version 3.4 Beta 3 includes all of the fixes included in version 3.3.2. Download WordPress 3.4 Beta 3 or use the WordPress Beta Tester plugin.

Download WordPress 3.4 Beta 2

As always, this is software still in development and we don’t recommend that you run it on a production site — set up a test site just to play with the new version. If you break it (find a bug), please report it, and if you’re a developer, try to help us fix it.

If all goes well, we hope to release WordPress 3.4 in May. The more help we get with testing and fixing bugs, the sooner we will be able to release the final version. If you want to be a beta tester, you should check out the Codex article on how to report bugs.

Here’s some of what’s new:

• Theme Customizer with Previewer
• Flexible Custom Header Sizes
• Selecting Custom Header and Background Images from Media Library
• Better experience searching for and choosing a theme

And some of the under-the-hood changes:

• New XML-RPC API for external and mobile applications
• New API for registering theme support for custom headers and backgrounds
• Performance improvements to WP_Query by splitting the query (Please test!)
• Internationalization improvements (improved performance and locale support)
• Performance and API improvements when working with lists of installed themes
• Support for installing child themes from the WordPress Themes Directory

Remember, if you find something you think is a bug, report it! You can bring it up in the alpha/beta forum, you can email it to the wp-testers list, or if you’ve confirmed that other people are experiencing the same bug, you can report it on the WordPress Core Trac. (We recommend starting in the forum or on the mailing list.)

Theme and plugin authors, if you haven’t been following the 3.4 development cycle, please start now so that you can update your themes and plugins to be compatible with the newest version of WordPress.

Download WordPress 3.4 Beta 1

Download 3.3.1 or visit Dashboard → Updates in your site admin.

WordPress has had over 65 million downloads since version 3.0 was released, and in this third major iteration we’ve added significant polish around the new user experience, navigation, uploading, and imports. Check out this short video that summarizes the things we think you’ll find are the cat’s pajamas:

For Users

Experienced users will appreciate the new drag-and-drop uploader, hover menus for the navigation, the new toolbar, improved co-editing support, and the new Tumblr importer. We’ve also been thinking a ton about what the WordPress experience is like for people completely new to the software. Version 3.3 has significant improvements there with pointer tips for new features included in each update, a friendly welcome message for first-time users, and revamped help tabs throughout the interface. Finally we’ve improved the dashboard experience on the iPad and other tablets with better touch support.

For Developers

There is a ton of candy for developers as well. I’d recommend starting your exploration with the new editor API, new jQuery version, better ways to hook into the help screens, more performant post-slug-only permalinks, and of course the entire list of improvements on the Codex and in Trac.

Roll the Credits

The Credits tab on the new About WordPress screen in the WordPress dashboard provides recognition for contributors to each release, but we like to thank them here as well.

Aaron D. Campbell, Aaron Jorbin, Adam Backstrom, Adam Harley, Alex Concha, Alex King, Alex Mills (Viper007Bond), amereservant, ampt, Andrei Freeman, Andre Renaut, andrewfrazier, Andrew Nacin, Andrew Ozz, Andrew Ryno, Andy Skelton, Anthony Atkinson, Austin Matzko, Bartosz Kaszubowski, Benjamin J. Balter, Brandon Dove, carlospaulino, Caspie, cebradesign, Chelsea Otakan, Chip Bennett, Chris Jean, Coen Jacobs, Curtiss Grymala, Daniel Bachhuber, Daryl Koopersmith, Daryl L. L. Houston, David, David Cowgill, David Gwyer, Da^MsT, deltafactory, demetris, Derek Herman, Devin Reams, Digital Raindrops, Dion Hulse (@dd32), Dominik Schilling (ocean90), Doug Provencio, dragoonis, DrewAPicture, Dylan Kuhn, eduplessis, Eightamrock, eko-fr, Elpie, elyobo, Empireoflight, Erick Hitter, Eric Mann, Evan Anderson, Evan Solomon, fonglh, garyc40, Gary Jones, Gaurav Aggarwal, George Stephanis, goldenapples, goto10, hakre, Helen Hou-Sandi, Ian Stewart, Ipstenu, Jackson, Jacob Gillespie, Jake Goldman, James Collins, Jane Wells, jeremyclarke, Jesper Johansen (Jayjdk), jgadbois, Jick, Joe Hoyle, John Blackbourn, John Hawkins, John James Jacoby, JohnONolan, John P. Bloch, Jon Cave, Jorge Bernal, Joseph Scott, jtclarke, Jurica Zuanovic, Justin Givens, Justin Sainton, Kailey Lampert (trepmal), kevinB, kitchin, Konstantin Kovshenin, Kuraishi, Kurt Payne, Lance Willett, Latz, linuxologos, Lloyd Budd, Luc De Brouwer, lukeschlather, Mako, Mantas Malcius, MarcusPope, mark-k, Mark Jaquith, Mark McWilliams, Marko Heijnen, Martin Lormes, masonjames, Matias Ventura, Matt Mullenweg, Matt Thomas, Matt Wiebe, MattyRob, Mert Yazicioglu, Michael Adams (mdawaffe), Michael Fields, Michal “Mau” Pliska, Mike Bijon, Mike Schroder, Milan Dinic, mitchoyoshitaka, Mohammad Jangda, Morten Hauan, Mr Papa, mrtorrent, Naoko McCracken, natebedortha, Nikolay Bachiyski, olivM, olleicua, Otto, pagesimplify, paulhastings0, pavelevap, pete.mall, Peter Westwood, peterwilsoncc, ppaire, Ptah Dunbar, r-a-y, Rami Y, Rasheed Bydousi, Robert Chapin (miqrogroove), Ron Rennick, Ross Hanney, ruslany, Ryan Boren, ryanhellyer, Ryan Imel, Safirul Alredha, Samir Shah, Sam Margulies, saracannon, Scott Basgaard, Scott Bressler, Scott Cariss, scottconnerly, Scott Reilly, Scott Taylor, scribu, Sergey Biryukov, Sheri Bigelow, Simon Wheatley, sirzooro, Stephanie Leary, tech163, TheDeadMedic, Tim Moore, Tom Auger, Travis Ballard, Ulrich Sossou, vnsavage, wpweaver, WraithKenny, Yoav Farhi, and Ze Fontainhas.

As well, we’d like to give a shout out to these users who have been particularly active on the support forums since the release of 3.2:

alchymyth, Andrea_r, ClaytonJames, cubecolour, Eran Miller, esmi, Frederick Townes, govpatel, Ipstenu, keesiemeijer, kmessinger, Marcus, Otto, peredur, Rev. Voodoo, Samuel B, Tobias, vtxyzzy, and zoonini.

Our goal is to release version 3.3 early next week, so plugin and theme authors, this is your last pre-release chance to  test your plugins and themes  to find any compatibility issues before the final release. We’ve published a number of posts on the development blog that explain important things you need to know as you prepare for WordPress 3.3. Please review this information immediately if you have not done so already.

If you think you’ve found a bug, you can post to the Alpha/Beta area in the support forums. Or, if you’re comfortable writing a reproducible bug report, file one on WordPress Trac. Known issues that crop up will be listed here, but let’s all keep our fingers crossed for a quiet Sunday so we can get these new features into your hands early next week!

To test WordPress 3.3, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the release candidate here (zip).

As the first release candidate was well-received, we think we’re really close to a final release. Primarily, we’ve ensured that new toolbar (the admin bar in 3.2) has a consistent appearance across all browsers, and the API for developers is now final. You can check our bug tracker for the complete list of changes.

Plugin and theme authors, please test your plugins and themes now, so that if there is a compatibility issue, we can figure it out before the final release. On our development blog, we’ve published a number of posts that explain important things you need to know as you prepare for WordPress 3.3.

If you haven’t tested WordPress 3.3 yet, now is the time — please though, not on your live site unless you’re adventurous. Once you install RC2, you can visit About WordPress page (hover over the WordPress logo in the top left) to see an overview of what’s to come in WordPress 3.3 (and what to test, of course).

If you think you’ve found a bug, you can post to the Alpha/Beta area in the support forums. Or, if you’re comfortable writing a reproducible bug report, file one on WordPress Trac. Known issues that crop up will be listed here.

Enjoy!

To test WordPress 3.3, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the release candidate here (zip).

Sometimes time slows down
between releases – like now
This is RC2

Stayed up late tonight,
Hammering toward RC1.
Now with more icons!

Download WordPress 3.3 Release Candidate 1.

With all our major tickets closed, we are very close to a release candidate. In Beta 4 we’ve fixed a bunch of bugs, cleaned up the UI, added real text in some of the screens that still had placeholder text in Beta 3 (post-update screen, the Dashboard welcome area, new feature pointers), and generally tightened things up. We updated to jQuery 1.7.1 and addressed a LOT of bugs.

If you are a plugin or theme developer (or distributor), please test against Beta 4 to ensure there are no issues.

If you find any problems, please report them as usual. Many thanks!

Thought 3 was the last?
Ha ha! Beta 4 is here –
Better get testing!

Download WordPress 3.3 Beta 4