On September 17, 2026, WordPress 5.5.21 was released to the public.
Installation/Update Information
To get this version, update automatically from the Dashboard > Updates menu in your site’s admin area or visit https://wordpress.org/download/releases/.
For step-by-step instructions on installing and updating WordPress:
If you are new to WordPress, we recommend that you begin with the following:
- Get Started With WordPress
- First Steps With WordPress or Upgrading WordPress Extended
- WordPress Courses
Summary
Security updates
This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.
The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:
- An issue allowing a crafted URL to install and preview a theme from WordPress.org reported by Paulos Yibelo and pwn.ai
- A stored cross-site scripting (XSS) issue in custom header images on some themes reported by Jeremy Felt of the WordPress Security Team
- A multisite issue allowing a site administrator to network-activate a network-only plugin reported by Jesse McNeil
- A Contributor+ arbitrary post overwrite issue reported by Anthropic
- An authorization issue allowing any authenticated user to reparent comments, including notes, reported by viridis
- An XML-RPC issue allowing changeset posts to bypass the custom CSS capability check reported by Ben Bidner of the WordPress Security Team
- A Contributor+ disclosure of draft and pending post slugs reported by hermanhms
- An unauthenticated stored cross-site scripting (XSS) issue via paragraph formatting, subject to comment approval, reported by Rafie Muhammad (Awesome Motive, Inc.)
Change log
List of files revised
/wp-admin/includes/ajax-actions.php
/wp-admin/includes/class-custom-image-header.php
/wp-admin/includes/plugin.php
/wp-admin/includes/post.php
/wp-admin/js/theme.js
/wp-includes/class-wp-xmlrpc-server.php
/wp-includes/customize/class-wp-customize-header-image-setting.php
/wp-includes/formatting.php
/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
/wp-includes/theme.php
List of packages revised
No package was revised.