On October 28, 2026, WordPress 5.3.27 was released to the public.
Installation/Update Information
To get this version, update automatically from the Dashboard > Updates menu in your site’s admin area or visit https://wordpress.org/download/releases/.
For step-by-step instructions on installing and updating WordPress:
If you are new to WordPress, we recommend that you begin with the following:
- Get Started With WordPress
- First Steps With WordPress or Upgrading WordPress Extended
- WordPress Courses
Summary
Security updates
This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.
The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:
- An Editor+ stored cross-site scripting (XSS) issue in the personal data erasure requests screen reported by Anthropic
- A Contributor+ stored cross-site scripting (XSS) issue via whitespace in block delimiters reported by Rafie Muhammad (Awesome Motive, Inc.)
- An information disclosure issue exposing unpublished Customizer changes to unauthenticated visitors reported by Antonio Lorensius Silaban
- A hardening fix for unescaped usernames on the multisite Network Users screens reported by Anthropic
- A race condition during core updates that could lead to remote code execution reported by Umut Bayram
- A Contributor+ stored cross-site scripting (XSS) issue in Customizer selective refresh reported by Rafie Muhammad (Awesome Motive, Inc.)
- An update to the bundled root certificates due to the eMudhra revocation.
Change log
List of files revised
/wp-admin/includes/ajax-actions.php
/wp-admin/includes/class-wp-ms-users-list-table.php
/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php
/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php
/wp-admin/includes/class-wp-privacy-requests-table.php
/wp-admin/includes/class-wp-upgrader.php
/wp-admin/includes/class-wp-users-list-table.php
/wp-admin/includes/ms.php
/wp-admin/includes/update-core.php
/wp-admin/user-edit.php
/wp-admin/users.php
/wp-content/themes/twentytwenty/assets/js/customize-preview.js
/wp-includes/admin-bar.php
/wp-includes/class-wp-block-parser.php
/wp-includes/class-wp-customize-manager.php
/wp-includes/js/customize-preview-widgets.js
/wp-includes/js/customize-selective-refresh.js
/wp-signup.php
List of packages revised
@wordpress/block-serialization-default-parser - 3.4.2