このブログでも利用しているブログツール「WordPress」をバージョン4.8.3にアップデートしました。

～　リリースノート　～
Version 4.8.3 « WordPress Codex

Summary

From the WordPress 4.8.3 release post: WordPress versions 4.8.2 and earlier are affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Anthony Ferrara.

This release includes a change in behaviour for the esc_sql() function. Most developers will not be affected by this change, you can read more details in the developer note.

　
～　関連ニュース　～
・WordPress 4.8.3 Security Release
・Version 4.8.3 – WordPress Codex 日本語版
・WordPressが「4.8.3」にアップデート、前バージョンで不十分だったSQLインジェクションの問題を修正 -INTERNET Watch
・【お知らせ】WordPress 4.8.3 セキュリティリリース | 情報メディア教育研究部門 | 東京大学情報基盤センター
　
　
セキュリティ問題の対処版なので、WordPressご利用者は早めのアップデートをした方がよろしいと思います。
しーゆー。
　

このブログでも利用しているブログツール「WordPress」がバージョン4.8.2に自動アップデートされました。

～　リリースノート　～
Version 4.8.2 « WordPress Codex

From the WordPress 4.8.2 release post: WordPress versions 4.8.1 and earlier are affected by nine security issues:

$wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Slavco.
A cross-site scripting (XSS) vulnerability was discovered in the oEmbed discovery. Reported by xknown of the WordPress Security Team.
A cross-site scripting (XSS) vulnerability was discovered in the visual editor. Reported by Rodolfo Assis (@brutelogic) of Sucuri Security.
A path traversal vulnerability was discovered in the file unzipping code. Reported by Alex Chapman (noxrnet).
A cross-site scripting (XSS) vulnerability was discovered in the plugin editor. Reported by 陈瑞琦 (Chen Ruiqi).
An open redirect was discovered on the user and term edit screens. Reported by Yasin Soliman (ysx).
A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team.
A cross-site scripting (XSS) vulnerability was discovered in template names. Reported by Luka (sikic).
A cross-site scripting (XSS) vulnerability was discovered in the link modal. Reported by Anas Roubi (qasuar).

　
　
～　関連ニュース　～
・WordPressが「4.8.2」にアップデート、5件のXSS脆弱性、2件のパストラバーサル脆弱性などを修正 -INTERNET Watch
　
　
この後、日本語版の手動アップデートが待ってるかな。
しーゆー。
　

このブログでも利用しているブログツール「WordPress」がバージョン4.8.1に自動アップデートされました。
今回は29個のバグを修正とのことです。

リリースノート
Version 4.8.1 « WordPress Codex

Summary

From the WordPress 4.8.1 release post: WordPress 4.8.1 contains 29 maintenance fixes and enhancements to the 4.8 release series, chief among them are fixes to the rich Text widget and the introduction of the Custom HTML widget.

Administration

#40982 – Permalink Settings: custom structure field keyboard trap

Build/Test Tools

#41327 – Bump Akismet External – 4.9 Edition

Comments

#40975 – ‘Empty Spam’ and ‘Empty Trash’ comment buttons not displayed on mobile

Customize

#40978 – Customizer Panel Footer border missing
#40981 – Customizer: Menus: it is far too easy to mistakenly delete a menu because the “Delete Menu” link and the “Add Items” button are too close together
#41158 – Increase tinymce panel z-index
#41410 – Set `’filter’ => ‘content’` on starter content “business info” widget

Embeds

#41019 – oEmbed: Update VideoPress oEmbed URL
#41048 – `WP_oEmbed_Controller::get_proxy_item()` should remove `_wpnonce` from cached `$args`
#41299 – oEmbed proxy fails to forward maxwidth and maxheight params

General

#41056 – WP-API JS Client: Settings is incorrectly registered as a collection

Media

#41231 – media-views.js: Cannot read .length of undefined (this.controller.$uploaderToggler.length)

REST API

#38964 – Add filter to allow modifying response *after* embedded data is added
#40886 – REST API: PUT requests fail on Nginx servers when fancy permalinks aren’t enabled

Taxonomy

#41010 – wp_get_object_terms() returns duplicate terms if more than one taxonomy is given in args

TinyMCE

#41408 – TinyMCE: Images with link and caption look “broken” when selected

Widgets

#40907 – Introduce widget dedicated for HTML code
#40935 – Facebook Video Works On Preview But Not On Theme
#40951 – New Text Widget – Switching Between Visual/Text Editor Strips Out Code
#40960 – Widgets: The Text widget should respect the “Disable the visual editor when writing” setting
#40972 – TinyMCE editor in Text widget does not have RTL contents
#40974 – Updated text widget do not save text (when using paste)
#40977 – Widgets: Query param for `loop` added for non-hosted external videos
#40986 – Widgets: text widget and media widgets cannot be edited in accessibility mode
#41021 – Text widget does not show Title field or TinyMCE editor
#41361 – Text widget can raise JS error if customize-base is enqueued on widgets admin screen
#41386 – Text Widget – Wording – Legacy Mode 4.8.1 beta
#41392 – Theme styles for Text widget do not apply to Custom HTML widget
#41394 – Text widget: Rename legacy mode to visual mode and improve back-compat for widget_text filters

　
　
WordPressではマイナーバージョンアップは自動でアップデートされますが、この後、日本語版のバージョン4.8.1-jaには手動でアップデートすることになります。
もっとも、日本語版でなくてもまったく不便はありません。
しーゆー。