Version 6.9.11

On October 28, 2026, WordPress 6.9.11 was released to the public.

Installation/Update Information

To get this version, update automatically from the Dashboard > Updates menu in your site’s admin area or visit https://wordpress.org/download/releases/.
For step-by-step instructions on installing and updating WordPress:

Updating WordPress

If you are new to WordPress, we recommend that you begin with the following:

Summary

Security updates

This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.
The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

An Editor+ stored cross-site scripting (XSS) issue in the personal data erasure requests screen reported by Anthropic
A Contributor+ stored cross-site scripting (XSS) issue via whitespace in block delimiters reported by Rafie Muhammad (Awesome Motive, Inc.)
An information disclosure issue exposing unpublished Customizer changes to unauthenticated visitors reported by Antonio Lorensius Silaban
A hardening fix for unescaped usernames on the multisite Network Users screens reported by Anthropic
A permissions issue letting custom roles that moderate comments read, edit and delete notes on posts they can’t edit reported by Ramon of the WordPress Security Team
A race condition during core updates that could lead to remote code execution reported by Umut Bayram
A Contributor+ issue in Interactivity API bindings that lets object elements load admin pages reported by rekter0
A Contributor+ stored cross-site scripting (XSS) issue in Customizer selective refresh reported by Rafie Muhammad (Awesome Motive, Inc.)
A Contributor+ stored cross-site scripting (XSS) issue via javascript: URLs in Interactivity API bindings reported by Luis Herranz and multiple independent reporters
A Contributor+ stored cross-site scripting (XSS) issue in the labels of the Comments Pagination and Post Navigation Link blocks reported by Alex Concha of the WordPress Security Team
An issue allowing post content to shadow Script Module data with a matching element ID reported by Weston Ruter
A cross-site scripting (XSS) issue in the Categories block via format string injection reported by Ben Bidner
A hardening fix for unsafe preg_replace() replacements in the Image and Playlist blocks reported by Ben Bidner of the WordPress Security Team
A Contributor+ stored cross-site scripting (XSS) issue via Interactivity API event handler bindings reported by Jon Surrell
An Author+ stored cross-site scripting (XSS) issue in the Interactivity Router via uploaded text files reported by Anas cherni
A Contributor+ stored cross-site scripting (XSS) issue via prototype pollution in Interactivity API context namespaces reported by rekter0
Contributor+ stored cross-site scripting (XSS) and denial of service issues in Interactivity API bindings reported by rekter0, Marcel Karlsson (whoismarcel), Jon Surrell and Alex Concha of the WordPress Security Team
An update to the bundled root certificates due to the eMudhra revocation.

Change log

List of files revised

/wp-admin/includes/ajax-actions.php
/wp-admin/includes/class-wp-ms-users-list-table.php
/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php
/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php
/wp-admin/includes/class-wp-privacy-requests-table.php
/wp-admin/includes/class-wp-upgrader.php
/wp-admin/includes/class-wp-users-list-table.php
/wp-admin/includes/ms.php
/wp-admin/includes/update-core.php
/wp-admin/user-edit.php
/wp-admin/users.php
/wp-content/themes/twentytwenty/assets/js/customize-preview.js
/wp-includes/admin-bar.php
/wp-includes/assets/script-loader-packages.min.php
/wp-includes/assets/script-modules-packages.min.php
/wp-includes/blocks/categories.php
/wp-includes/blocks/comments-pagination-next.php
/wp-includes/blocks/comments-pagination-previous.php
/wp-includes/blocks/image.php
/wp-includes/blocks/post-navigation-link.php
/wp-includes/class-wp-block-parser.php
/wp-includes/class-wp-customize-manager.php
/wp-includes/interactivity-api/class-wp-interactivity-api.php
/wp-includes/js/customize-preview-widgets.js
/wp-includes/js/customize-selective-refresh.js
/wp-includes/kses.php
/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
/wp-signup.php

List of packages revised

@wordpress/block-library - 9.33.12
@wordpress/block-serialization-default-parser - 5.33.2
@wordpress/interactivity - 6.33.4
@wordpress/interactivity-router - 2.33.4