This security and maintenance release features one bug fix in addition to three security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.

WordPress 5.9.2 is a security and maintenance release. The next major release will be version 6.0.

You can download WordPress 5.9.2 from WordPress.org, or by visiting your Dashboard → Updates and clicking “Update Now”.

If you have sites that support automatic background updates, they’ve already started the update process.

For more information, browse the full list of changes on Trac, or check out the version 5.9.2 HelpHub documentation page.

Thanks and props!

The 5.9.2 release was led by Jb Audras, with the help of Jorge Costa on package updates, Sergey Biryukov on mission control, and David Baumwald on backport commits.

In addition to the release squad members mentioned above, thank you to everyone who helped make WordPress 5.9.2 happen:

Alan Jacob Mathew, Alex Concha, André, Anton Vlasenko, David Baumwald, ehtis, Jb Audras, Jorge Costa, Peter Wilson, Sergey Biryukov, Tonya Mork, and ironprogrammer.

Props @davidbaumwald and @sergeybiryukov for peer reviewing.

This maintenance release features 82 bug fixes in both Core and the block editor.

WordPress 5.9.1 is a short-cycle maintenance release. The next major release will be version 6.0.

You can download WordPress 5.9.1 from WordPress.org, or by visiting your Dashboard → Updates and clicking “Update Now”.

If you have sites that support automatic background updates, they’ve already started the update process.

For more information, browse the full list of both Trac and GitHub changes in the release candidate post, or check out the version 5.9.1 HelpHub documentation page.

Thanks and props!

The 5.9.1 release was led by Jb Audras and George Mamadashvili.

Special props to @sergeybiryukov for running mission control.

Thank you to everyone who helped make WordPress 5.9.1 happen:

Albert Juhé Lluveras, Alex Lende, alexstine, André, Anton Vlasenko, Ari Stathopoulos, ArteMa, Ben Dwyer, BlogAid, Carolina Nymark, Channing Ritter, Chris Van Patten, Colin Stewart, Daniel Richards, David Biňovec, David Smith, Dion Hulse, Dominik Schilling, Eddy, Ella van Durpe, Erik, Fabian Kägy, Flinim Asso, gadhiyaravi, George Hotelling, George Mamadashvili, glendaviesnz, Greg Ziółkowski, ianatkins, Ian Belanger, ironprogrammer, itsamoreh, Jb Audras, Jeff Ong, Jeremy Herve, Joe Dolson, Joen A., John Blackbourn, Jonathan Desrosiers, Jorge Costa, Juliette Reinders Folmer, KafleG, Kapil Paul, Kjell Reigstad, linux4me2, Lukman Nakib, manfcarlo, Marius L. J., mgol, nidhidhandhukiya, Nik Tsekouras, Omar Alshaker, Paolo L. Scala, Pascal Birchler, Paul Bearne, Pavlo, Petar Ratković, Peter Wilson, Petter Walbø Johnsgård, Phil Johnston, Piotrek Boniu, ravipatel, Riad Benguella, Robert Anderson, Rolf Siebers, Sergey Biryukov, stacimc, Stephen Bernhardt, Sven Wagener, Team Staatic, Tim Nolte, Tonya Mork, webcommsat AbhaNonStopNewsUK, WebMan Design | Oliver Juhas, wpcharged, wpsoul, Yunus Ertuğrul, and Rafi Ahmed.

Thanks to @estelaris, @pbiron, @ironprogrammer, @bph, @abhanonstopnewsuk, and @threadi for their help to test the release package.

Welcome to Joséphine!

Introducing 5.9, Joséphine. Named in honour of acclaimed international jazz singer Joséphine Baker, this latest, most versatile WordPress release is here: download it or update it directly from your dashboard. 

As a lifelong civil rights campaigner, Joséphine Baker believed that all people could live in harmony together, just as different instruments in a jazz band blend together to make a whole piece. Turn on a playlist from your favourite music service and enjoy her famous renditions of “You are the greatest love”, “Sans Amour”, and “Love is a Dreamer”, as you discover all the features of this brand-new WordPress release. 

Full site editing is here

It puts you in control of your whole site, right in the WordPress Admin.

Say hello to Twenty Twenty-Two

And say hello to the first default block theme in the history of WordPress. This is more than just a new default theme. It’s a brand-new way to work with WordPress themes.

Block themes put a wide array of visual choices directly in your hands, from colour schemes and font combinations to page templates and image filters, all from the Site Editor. So in one place, you can give Twenty Twenty-Two the same look and feel as your organisation’s other materials – or take your site’s look in another direction.

You already have the Twenty Twenty-Two theme – it came installed with WordPress 5.9. You will find it with your other installed themes.

Your personal paintbox awaits

Twenty Twenty-Two is not the only theme built for full site editing. More block themes are in the Themes directory, and the number will grow. 

When you use any of those new themes, you no longer need the Customiser. Instead, you have all the power of the Styles interface inside the Site Editor. Just as in Twenty Twenty-Two, you build your site’s look and feel there, with the tools you need for the job in a fluid interface that practically comes alive in your hands.

The Navigation block

Blocks come to site navigation, the heart of user experience.

The new Navigation block gives you the power to choose: an always-on responsive menu or one that adapts to your user’s screen size. And your choices are remembered! In 5.9, the block saves menus as custom post types, which get saved to the database.

More improvements and updates

Do you love to blog? New tweaks to the publishing flow help you say more, faster.

Better block controls

WordPress 5.9 features new typography tools, flexible layout controls, and finer control of details like spacing, borders, and more – to help you get not just the look, but the polish that says you care about details.

The power of patterns

The WordPress Pattern Directory is the home of a wide range of block patterns built to save you time and add to your site’s functionality. And you can edit them as you see fit. Need something different in the header or footer for your theme? Swap it out with a new one in a few clicks.

With a nearly full-screen view that draws you in to see fine details, the Pattern Explorer makes it easy to compare patterns and choose the one your users need.

A revamped List View

In 5.9, the List View lets you drag and drop your content exactly where you want it. Managing complex documents is easier, too: simple controls let you expand and collapse sections as you build your site – and add HTML anchors to your blocks to help users get around the page.

A better Gallery block

Treat every image in a Gallery Block the same way you would treat it in the Image Block.

Style every image in your gallery differently, or make them all the same, except for one or two. Or change the layout with drag-and-drop.

WordPress 5.9 for developers

Theme.json for child themes

In 5.9, theme.json supports child themes. That means your users can build a child theme right in the WordPress Admin, without writing a single line of code. 

This dev note has all the details. Take a look!

Block-level locking

Now you can lock any block (or a few of them) in a pattern, just by adding a lock attribute to its settings in block.json – leaving the rest of the pattern free for users to adapt to their content. 

Multiple style sheets in a block

Now you can register more than one style sheet per block, which lets a given block load only the styles its markup requests, and not a whole sheet. Read the details in this dev note.

A refactored Gallery Block

The changes to the Gallery Block listed above are the result of a near-complete refactoring. Have you built a plugin or theme on the Gallery Block functionality? Be sure you read this dev note. It tells you what you need to do for compatibility.

Learn more about the new features in 5.9

Want to dive into 5.9 but don’t know where to start? Check out this free course about Simple Site Design from Learn WordPress. There are a variety of learning materials including short how-to video tutorials and resources on new features in WordPress 5.9, with much more planned.

Check out the Field Guide for more!

Check out the latest version of the WordPress Field Guide. It has lots of useful information with links to detailed developer notes to support you building in WordPress for everyone you serve. WordPress 5.9 Field Guide.

The Squad

The WordPress 5.9 release was led by Matt Mullenweg, and supported by this highly enthusiastic release squad:

• Release Lead: Matt Mullenweg
• Core Tech and Release Coordinator: Tonya Mork
• Triage Leads: Jb Audras and Ahmed Chaion
• Editor Tech: Robert Anderson and George Mamadashvili
• Theme Leads: Kjell Reigstad and Jeff Ong
• Technical Writer: Jonathan Bossenger
• Documentation Leads: Marcus Kazmierczak and Milana Cap
• Marketing and Communications Leads: Mary Baum, Abha Thakor, and Josepha Haden Chomphosy
• Test Leads: Piotrek Boniu and Anne McCarthy

WordPress 5.9 also reflects the hard work of 624 generous volunteer contributors. Collaboration occurred on 370 tickets on Trac and more than 1900 pull requests on GitHub.

2linctools, Aaron D. Campbell, Aaron Jorbin, Aaron Robertshaw, abesell132, Abha Thakor, acosmin, Adam – WPMU DEV Support, Adam Bosco, Adam Morgan, Adam Silverstein, Adam Zielinski, Addie, Adil Ali, aduth, Aezaz Shekh, Ahmed Chaion, ajotka, Akash Soni, Akira Tachibana, Alain Schlesser, Alan Jacob Mathew, Alex Concha, Alex Lende, Alexandru Vornicescu, alexeydemidov, Alexis Lloyd, alexstine, AlGala, allilevine, almendron, Amanda Riu, Anand Upadhyay, André, Andrea Fercia, Andrei Draganescu, Andrew Nacin, Andrew Nevins, Andrew Ozz, Andrew Serong, André, Andy Fragen, Andy Peatling, Andy Schmidt, andynick, Angelika Reisiger, Anjana Vasan, Ankit K Gupta, Ankit Panchal, Anne McCarthy, Anthony Burchell, Anthony Eden, Anthony Ledesma, Anton Vlasenko, Antonis Lilis, arena, Ari Stathopoulos, Arthur Chu, Ashfame, Ayesh Karunaratne, baelx, Bartlomiej, Beatriz Fialho, Beau Lebens, Beda, Benachi, benitolopez, Benjamin Denis, Benjamin Gosset, benjamin.anakena, Bernhard Reiter, bgardner, Bijay Yadav, BinaryKitten, Birgir Erlendsson (birgire), bobbingwide, Boone Gorges, Brad Jorsch, Brad Parbs, Bradley Taylor, Brandon Kraft, bravokeyl, Brennan Goewert, Brian Richards, bronsonquick, Bruno Ribaric, Brylie Christopher Oxley, Caleb Burks, calebwoodbridge, carepsules, Carike, Carlos Bravo, Carlos Garcia, Carolina Nymark, cdyerkes, Ceyhun Ozugur, Chad, Chiaki, Chintan hingrajiya, Chip Snyder, Chloe Bringmann, Chouby, Chris Klosowski, Chris Van Patten, chriscct7, Christian Tamayo, Christina Workman, Christopher Churchill, clucasrowlands, Colin Stewart, Collieth Clarke, Collins Agbonghama, Copons, Corey, Cory Hughart, Courtney Robertson, craigfrancis, Crisoforo Gaspar, critterverse, Csaba (LittleBigThings), Dávid Szabó, Daisy Olsen, Damon Cook, Dan Farrow, Dan Soschin, Daniel Bachhuber, Daniel Post, Daniel Richards, Daniel Shaw, danieldudzic, Daniele Scasciafratte, darerodz, Daria, Daschmi, datagutten, datainterlock, Dave Page, David Anderson, David Baumwald, David Biňovec, David Calhoun, David Gwyer, David Herrera, David Kryzaniak, David Mosterd, David Rozando, David Ryan, David Smith, davidwebca, Deb Nath Utpol, Debabrata Karfa, Deepak Lalwani, Denis Yanchevskiy, Denis Žoljom, Dennis Snell, Dhanendran, dhusakovic, DiedeExterkate, Dilip Bheda, Dion Hulse, dlt101, Dominik Schilling, donmhico, Donna Botti, dontgo2sleep, Doug Wollison, dpegasusm, Dr. Ronny Harbich, dratwas, Drew Jaynes, drosmog, dustinrue, ecotechie, ehtis, EkoJR, Ella van Durpe, Emmanuel Hesry, empatogen, Enchiridion, Enej Bajgorić, Enrique Sánchez, erayalakese, Eric Malalel, Erick Hitter, Erik, etoledo, Evan Mullins, Fabian Kägy, Fabian Todt, Faisal Alvi, fedepia, Felipe Elia, Felipe Santos, Felix Arntz, Florian TIAR, FPCSJames, fperdaan, Francesca Marano, Francesco, fullofcaffeine, Gal Baras, Garrett Hyder, Gary Jones, Gary Pendergast, gazchap, generosus, Gennady Kovshenin, George Hotelling, George Mamadashvili, George Stephanis, Gerardo Pacheco, Gilbert Pellegrom, Glen Davies, goldsounds, Govind, Grant M. Kinney, Greg Rickaby, Greg Ziółkowski, Guillaume TURPIN, Héctor Prieto, Hans-Christiaan Braun, haosun, Hareesh, Hasanuzzaman, Hauwa Abashiya, Haz, Henry Wright, herbmiller, Herm Martini, Herre Groen, hilayt24, hirofumi2012, Hitendra Chopda, Hossein Farahani, htmgarcia, Hudson Atwell, Hugh Lashbrooke, hugod, Ian Dunn, ianhayes94, ianmjones, Ignat Georgiev, Igor Benic, ilovecats7, infected, Ipstenu (Mika Epstein), Isaac, Isabel Brison, ismaeld, J.D. Grimes, Jack Reichert, Jake Spurlock, jakub.tyrcha, Jam Viet, James Huff, James Koster, Jan Thiel, janw.oostendorp, Jason Johnston, Jason R. Johnston, Javier Arce, Javier Casares, Jay Upadhyay, Jean-Baptiste Audras, Jean-Philippe, Jeff Bowen, Jeff Ong, Jeffrey Paul, Jenny Dupuy, Jeremy Felt, Jeremy Herve, Jeremy Scott, Jeremy Yip, Jesús Amieiro, Jesper van Engelen, Jessica Lyschik, Jignesh Nakrani, Joe Dolson, Joe McGill, joegasper, Joel James, Joen Asmussen, John Blackbourn, John Espiritu, John Godley, John James Jacoby, john zenith, JohnRDOrazio (CLPTE), Jonathan Bossenger, Jonathan Desrosiers, Jonny Harris, Jono Alderson, Joost de Valk, Jorge Costa, Jos Klever, Joseph Dickson, Josepha Haden, Joy, jsnajdr, Juan Ruitiña, JuanMa Garrido, Juhi Saxena, Juliette Reinders Folmer, Junaid Bhura, Junko Nukaga, Justin Ahinon, Justin DoCanto, Justin Tadlock, K. Adam White, KafleG, Kai Hao, kallookoo, Kalpesh Akabari, kaneva, Kapil Paul, Kelly Choyce-Dwan, Kelly Hoffman, keoshi, Keramot UL Islam, kero, Kerry Liu, Kevin Fodness, keyur5, Kharis Sulistiyono, Kjell Reigstad, Knut Sparhell, Koen Van den Wijngaert, Konstantin Obenland, Konstantinos Xenos, kurudrive, kwisatz, Kyle Nel, KZeni, lalitjalandhar, laurelfulford, Laxman Prajapati, leemon, leogermani, Liam Gladdy, liammitchell, Linkon Miyan, linux4me2, Loïc Antignac, Loran A. Rendel, Lucas Karpiuk, lucasw89, lucatume, Luis Felipe Zaguini, Luke Carbis, Luke Cavanagh, luovalabs, lynk, M Asif Rahman, Madalin Gorbanescu, Madison, Maggie Cabrera, Mai, Malae, malthert, manfcarlo, Manisha Makhija, Manzoor Wani, Marco Ciampini, Marcus Kazmierczak, Marek Hrabe, Marin Atanasov, Marius L. J., Mark-k, Mary Baum, Mateus Machado Luna, Matias Ventura, Matt, Matt Chowning, Matt Mullenweg, Matt Wiebe, mattoakley, Max, MaxD, Maxime Culea, mclaurent, MEDUSOR, Meg Phillips, Meher Bala, Mel Choyce-Dwan, mgol, Micah Wood, Michael Adams (mdawaffe), Michael Beckwith, Michael Burridge, Michael Nelson, Michal Czaplinski, Michel – xiligroup dev, Miguel Fonseca, mikaelmayer, Mike Jolley (a11n), Mike Schroder, Milan Dinić, Milana Cap, Minal Diwan, mirka, mjaschen, mjulian7, mmxxi, moch11, Mohammad Rockeybul Alam, moto hachi, mqudsi, mreishus, mrjoeldean, mtoensing, Muhammad Arslan, Muhammad Faizan Haidar, Mukesh Panchal, Musab Shakeel, Mustaque Ahmed, Nadir Seghir, Nalini Thakor, Namith Jawahar, Naoko Takano, NateWr, Ned Zimmerman, NettSite, Nicholas Garofalo, Nick Diego, Nick Halsey, nickcernis, Nico, Nidhi Jain, Niels Lange, Nik Tsekouras, Nikhil Chavan, nlpro, ockham, Olga Gleckler, Oliver Campion, Omar Alshaker, Omar Reiss, opr18, Outzen Larkin, Ov3rfly, ovann86, ovidiul, Paal Joachim Romdahl, Pablo Honey, page-carbajal, palmiak, Pankaj Mohale, Pascal Birchler, Patrick B, Paul Bearne, Paul Biron, Paul Bunkham, Paul Kevin, Paul Schreiber, Paul Von Schrottky, Paulo Pinto, pbking, Pedro Mendonça, pepe, Peter Wilson, Petter Walbø Johnsgård, Phil Johnston, Philip Jackson, Pierre Gordon, Pieterjan Deneys, Piotrek Boniu, Pooja Derashri, powerbuoy, praem90, Pramod Jodhani, Presskopp, presstoke, procodewp, psealock, psufan, pwtyler, Rachel Baker, Radixweb, Rahul Mehta, ralucastn, Ramon Ahnert, ramonopoly, ravipatel, Rehan Ali, Renatho (a11n), retrofox, Riad Benguella, Rian Rietveld, Rich Tabor, Richard Foley, richards1052, Rick Curran, Rishabh Budhiraja, Riyadh Ahmed, rmartinezduque, Robert Anderson, robertght, robtarr, Rodrigo Arias, Rohan Rawat, Rohan Sharma, Ronak Ganatra, Roxy Kohilakis, Ruslan, rviscomi, Ryan Welcher, S Page, Sébastien SERRE, Sören Wrede, Sabbir Hasan, Sabri Bouchaala, Safirul Alredha, Samir Shah, Samuel Wood (Otto), Sandip Mondal – a11n, Sanket Chodavadiya, Sarah Norris, sarayourfriend, Sathiyamoorthy V, savicmarko1985, Sayedul Sayem, Scott Buscemi, scribu, scruffian, Sean McMillan, Sebastian Pisula, Segayuu, Sergey Biryukov, Sergio Cinos, SergioEstevao, Shaharyar Afzal, shaunandrews, Shazahanul Islam Shohag, shimon246, Shital Marakana, Shiva Poudel, siddharth, Siddharth Thevaril, siliconforks, simonhammes, Siobhan, Siobhan, sirreal, sjlevy, skunkbad, Smit Rathod, snapfractalpop, Sourov Roy, spytzo, ssergei, stacimc, Stefano Minoia, Stefanos Togoulidis, Stephen Bernhardt, Stephen Edgar, Stephen Rider, Steve Dufresne, Steve Henty, stevegs, Storm Rockwell, Sybre Waaijer, Synchro, szaqal21, Taco Verdonschot, Takahashi Fumiki, Tammie Lister, Tara King, Tarei King, Tellyworth, terraling, Terri Ann, Tetsuaki Hamano, theMikeD, Thierry Muller, Thijs Hulshof, Thimal Wickremage, thisiswilliam, Thomas Patrick Levy, timlappe, Timothy Jacobs, titsmaker, tjcafferkey, tmatsuur, TobiasBg, tobifjellner (Tor-Bjorn Fjellner), Tomek, Tomoki Shimomura, Tony G, Tony Tahmouch, Tonya Mork, Toro_Unit (Hiroshi Urabe), Torsten Landsiedel, Tracy, Travis Northcutt, tubys, Tung Du, twstokes, Udit Desai, umesh84, Venkat Raj, versusbassz, verybg, Vicente Canales, Viktor Szépe, Vishit Shah, Vlad T, Vondelphia.com, vortfu, wb1234, WebMan Design | Oliver Juhas, Wes Theron, Weston Ruter, WFMattR, Will Skora, William Earnhardt, williampatton, wojsmol, woodyhayday, wp_kc, wpnomad a11n, wpweaver, Yagnik Sangani, Yui, Yvette Sonneveld, Zebulan Stanphill, and zoiec.

By release day, 71 locales had translated 90 percent or more of WordPress 5.9 into their language. Community translators are hard at work ensuring more translations are on their way. Thank you to everyone who helps to make WordPress available in 205 languages.

Many thanks to all of the community volunteers who contribute in the support forums. They help to answer questions from people across the world. The success of releases, from the first one in 2003, owes much to the efforts of the support contributors. 

If contributing to WordPress appeals to you, it’s easy to learn more and get involved. Discover the different teams that come together on the Make WordPress website and find out the latest plans on the core development blog.

WordPress 5.8.3 is a short-cycle security release. The next major release will be version 5.9, which is already in the Release Candidate stage.

You can update to WordPress 5.8.3 by downloading from WordPress.org or by visiting your Dashboard → Updates and clicking “Update Now”.

If you have sites that support automatic background updates, they’ve already started the update process.

Security Updates

Four security issues affect WordPress versions between 3.7 and 5.8. If you haven’t yet updated to 5.8, all WordPress versions since 3.7 have also been updated to fix the following security issues (except where noted otherwise):

• Props to Karim El Ouerghemmi and Simon Scannell of SonarSource for disclosing an issue with stored XSS through post slugs.
• Props to Simon Scannell of SonarSource for reporting an issue with Object injection in some multisite installations.
• Props to ngocnb and khuyenn from GiaoHangTietKiem JSC for working with Trend Micro Zero Day Initiative on reporting a SQL injection vulnerability in WP_Query.
• Props to Ben Bidner from the WordPress security team for reporting a SQL injection vulnerability in WP_Meta_Query (only relevant to versions 4.1-5.8). 

Thank you to all of the reporters above for privately disclosing the vulnerabilities. This gave the security team time to fix the vulnerabilities before WordPress sites could be attacked. Thank you to the members of the WordPress security team for implementing these fixes in WordPress.

For more information, check out the 5.8.3 HelpHub documentation page.

Thanks and props!

The 5.8.3 release was led by @desrosj and @circlecube.

In addition to the security researchers and release squad members mentioned above, thank you to everyone who helped make WordPress 5.8.3 happen:

Alex Concha, Dion Hulse, Dominik Schilling, ehtis, Evan Mullins, Jake Spurlock, Jb Audras, Jonathan Desrosiers, Ian Dunn, Peter Wilson, Sergey Biryukov, vortfu, and zieladam.

This security and maintenance release features 2 bug fixes in addition to 1 security fix. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 5.2 have also been updated.

WordPress 5.8.2 is a small focus security and maintenance release. The next major release will be version 5.9.

You can download WordPress 5.8.2 by downloading from WordPress.org, or by visiting your Dashboard → Updates and clicking “Update Now”. If you have sites that support automatic background updates, they’ve already started the update process.

For more information, browse the full list of changes on Trac, or check out the version 5.8.2 HelpHub documentation page.

Thanks and props!

The 5.8.2 release was led by Jonathan Desrosiers and Evan Mullins.

In addition to the release squad members mentioned above, thank you to everyone who helped make WordPress 5.8.2 happen: Ari Stathopoulos, Bradley Taylor, davidwebca, Evan Mullins, Greg Ziółkowski, Jonathan Desrosiers, Juliette Reinders Folmer, Mukesh Panchal, Sergey Biryukov, shimon246, and Yui.

WordPress 5.9 will launch with a new default theme: Twenty Twenty-Two.

Find out more in the official announcement post.

This security and maintenance release features 60 bug fixes in addition to 3 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 5.4 have also been updated.

WordPress 5.8.1 is a short-cycle security and maintenance release. The next major release will be version 5.9.

You can download WordPress 5.8.1 by downloading from WordPress.org, or by visiting your Dashboard → Updates and clicking “Update Now”.

If you have sites that support automatic background updates, they’ve already started the update process.

Security Updates

Three security issues affect WordPress versions between 5.4 and 5.8. If you haven’t yet updated to 5.8, all WordPress versions since 5.4 have also been updated to fix the following security issues:

• Props to @mdawaffe, a member of the WordPress Security Team, for their work fixing a data exposure vulnerability within the REST API.
• Props to Michał Bentkowski of Securitum for reporting a XSS vulnerability in the block editor.
• The Lodash library has been updated to version 4.17.21 in each branch to incorporate upstream security fixes.

In addition to these issues, the security team would like to thank the following people for reporting vulnerabilities during the WordPress 5.8 beta testing period, allowing them to be fixed prior to release:

• Props to Evan Ricafort for reporting a XSS vulnerability in the block editor discovered during the 5.8 release’s beta period.
• Props to Steve Henty for reporting a privilege escalation issue in the block editor.

Thank you to all of the reporters for privately disclosing the vulnerabilities. This gave the WordPress security team time to fix the vulnerabilities before WordPress sites could be attacked.

For more information, browse the full list of changes on Trac, or check out the version 5.8.1 HelpHub documentation page.

Thanks and props!

The 5.8.1 release was led by Jonathan Desrosiers and Evan Mullins.

In addition to the security researchers and release squad members mentioned above, thank you to everyone who helped make WordPress 5.8.1 happen: 2linctools, Adam Zielinski, Alain Schlesser, Alex Lende, alexstine, AlGala, André, Andrei Draganescu, Andrew Ozz, Ankit Panchal, Anthony Burchell, Anton Vlasenko, Ari Stathopoulos, Bruno Ribaric, Carolina Nymark, Daisy Olsen, Daniel Richards, Daria, David Anderson, David Biňovec, David Herrera, Dominik Schilling, Ella van Durpe, Enchiridion, Evan Mullins, Gary Jones, George Mamadashvili, Greg Ziółkowski, Héctor Prieto, ianmjones, Jb Audras, Jeff Bowen, Joe Dolson, Joen A., John Blackbourn, Jonathan Desrosiers, JuanMa Garrido, Juliette Reinders Folmer, Kai Hao, Kapil Paul, Kerry Liu, Kevin Fodness, Marcus Kazmierczak, Mark-k, Matt, Michael Adams (mdawaffe), Mike Schroder, moch11, Mukesh Panchal, Nik Tsekouras, Paal Joachim Romdahl, Pascal Birchler, Paul Bearne, Paul Biron, Peter Wilson, Petter Walbø Johnsgård, Radixweb, Rahul Mehta, ramonopoly, ravipatel, Riad Benguella, Robert Anderson, Rodrigo Arias, Sanket Chodavadiya, Sergey Biryukov, Stephen Bernhardt, Stephen Edgar, Steve Henty, terraling, Timothy Jacobs, tmatsuur, TobiasBg, Tonya Mork, Toro_Unit (Hiroshi Urabe), Vlad T, wb1234, and WFMattR.

Introducing 5.8 “Tatum”, our latest and greatest release. Named in honour of Art Tatum, the legendary jazz pianist. His formidable technique and willingness to push boundaries inspired musicians and changed what people thought could be done. 

So fire up your music service of choice and enjoy Tatum’s famous recordings of ‘Tea for Two’, ‘Tiger Rag’, ‘Begin the Beguine’, and ‘Night and Day’ as you read about what the latest WordPress version brings to you.

Three Essential Powerhouses

Manage Widgets with Blocks

After months of hard work, the power of blocks has come to both the Block Widgets Editor and the Customiser. Now you can add blocks both in widget areas across your site and with live preview through the Customiser. This opens up new possibilities to create content: from no-code mini layouts to the vast library of core and third-party blocks. For our developers, you can find more details in the Widgets dev note.

Display Posts with New Blocks and Patterns

The Query Loop Block makes it possible to display posts based on specified parameters; like a PHP loop without the code. Easily display posts from a specific category, to do things like create a portfolio or a page full of your favourite recipes. Think of it as a more complex and powerful Latest Posts Block! Plus, pattern suggestions make it easier than ever to create a list of posts with the design you want.

Edit the Templates Around Posts

You can use the familiar block editor to edit templates that hold your content – simply activate a block theme or a theme that has opted in for this feature. Switch from editing your posts to editing your pages and back again, all while using a familiar block editor. There are more than 20 new blocks available within compatible themes. Read more about this feature and how to experiment with it in the release notes.

Three Workflow Helpers

Overview of the Page Structure

Sometimes you need a simple landing page, but sometimes you need something a little more robust. As blocks increase, patterns emerge, and content creation gets easier, new solutions are needed to make complex content easy to navigate. List View is the best way to jump between layers of content and nested blocks. Since the List View gives you an overview of all the blocks in your content, you can now navigate quickly to the precise block you need. Ready to focus completely on your content? Toggle it on or off to suit your workflow.

Suggested Patterns for Blocks

Starting in this release, the Pattern Transformations tool will suggest block patterns based on the block you are using. Right now, you can give it a try in the Query Block and Social Icon Block. As more patterns are added, you will be able to get inspiration for how to style your site without ever leaving the editor!

Style and Colourise Images

Colourise your image and cover blocks with duotone filters! Duotone can add a pop of colour to your designs and style your images (or videos in the cover block) to integrate well with your themes. You can think of the duotone effect as a black and white filter, but instead of the shadows being black and the highlights being white, you pick your own colours for the shadows and highlights. There’s more to learn about how it works in the documentation.

For Developers to Explore

Theme.json

Introducing the Global Styles and Global Settings APIs: control the editor settings, available customisation tools, and style blocks using a theme.json file in the active theme. This configuration file enables or disables features and sets default styles for both a website and blocks. If you build themes, you can experiment with this early iteration of a useful new feature. For more about what is currently available and how it works, check out this dev note.

Adding Additional Block Supports

Expanding on previously implemented block supports in WordPress 5.6 and 5.7, WordPress 5.8 introduces several new block support flags and new options to customise your registered blocks. More information is available in the block supports dev note.

Check out the Field Guide for more!

Check out the latest version of the WordPress Field Guide. It highlights developer notes for each change of which you may want to be aware: WordPress 5.8 Field Guide.

The Squad

The WordPress 5.8 release was lead by Matt Mullenweg, and supported by this highly enthusiastic release squad:

• Release Co-Coordinator: Jeffrey Paul (@jeffpaul)
• Release Co-Coordinator: Jonathan Desrosiers (@desrosj)
• Editor Tech Lead: Riad Benguella (@youknowriad)
• Marketing and Communications Lead: Josepha Haden Chomphosy (@chanthaboune)
• Documentation Lead: Milana Cap (@milana_cap)
• Test Lead: Piotrek Boniu (@boniu91)
• Support Lead: Mary Job (@mariaojob)

This release is the reflection of the hard work of 530 generous volunteer contributors. Collaboration occurred on over 320 tickets on Trac and over 1,500 pull requests on GitHub.

5ubliminal, 99w, 9primus, Aaron Jorbin, aaronrobertshaw, abderrahman, Abha Thakor, Abhijit Rakas, achbed, Adam Silverstein, Adam Zielinski, Addie, aduth, Ahmed Chaion, Ahmed Saeed, Ajit Bohra, Alain Schlesser, alanjacobmathew, Albert Juhé Lluveras, Alejandro Perez, Alex Concha, Alex Kirk, Alex Lende, alexstine, allilevine, Amanda Riu, amarinediary, Amogh Harish, Andrea Fercia, Andrei Draganescu, Andrew Ozz, Andrew Serong, Andrey “Rarst” Savchenko, André Maneiro, Andy Fragen, Andy Peatling, Andy Skelton, Ankit Gade, annalamprou, Anne McCarthy, anotherdave, anotia, Anthony Burchell, Anton Lukin, Anton Vanyukov, Antonis Lilis, apedog, apokalyptik, arena, Argyris Margaritis, Ari Stathopoulos, ariskataoka, arkrs, Armand, ArnaudBan, Arthur Chu, Arun a11n, Aspexi, atjn, Aurooba Ahmed, Austin Matzko, Ayesh Karunaratne, Barry, bartkalisz, Beatriz Fialho, Bego Mario Garde, Benachi, Benoit Chantre, Bernhard Reiter, Bernhard Reiter, Birgir Erlendsson (birgire), Birgit Pauli-Haack, Blobfolio, bmcculley, Bob Linthorst, bobbingwide, Bogdan Preda, bonger, Boone Gorges, Brad Touesnard, Brandon Kraft, Brecht, Brent Swisher, Brett Shumaker, Bruno Ribaric, Burhan Nasir, Cameron Jones, Cameron Voell, Carike, Carl Alexander, carlomanf, carlosgprim, Carolina Nymark, Casey Milne, Cenay Nailor, Ceyhun Ozugur, Chandra M, Chetan Prajapati, Chintan hingrajiya, Chip Snyder, Chloé Bringmann, Chouby, Chris Van Patten, chriscct7, Christopher Churchill, Chuck Reynolds, Clayton Collie, Code Amp, CodePoet, Colin Stewart, Collins Agbonghama, Copons, Corey McKrill, Cory Hughart, Courtney Engle Robertson, crazycoders, critterverse, czapla, Dávid Szabó, Daisy Olsen, damonganto, Dan Farrow, Daniel Llewellyn, Daniel Richards, danieldudzic, Daniele Scasciafratte, Danny, David Aguilera, David Anderson, David Artiss, David Baumwald, David Biňovec, David Calhoun, David Herrera, David Kryzaniak, David Smith, dekervit, devfle, devrekli, dhruvkb, Diane Co, dingdang, Dion Hulse, djbu, Dominik Schilling, donmhico, Donna Peplinskie, Doug Wollison, dpik, dragongate, Dreb Bits, Drew Jaynes, eatsleepcode, Ebonie Butler, Edi Amin, Eileen Violini, Ella van Durpe, Emil E, Emilio Martinez, Emmanuel Hesry, empatogen, Enej Bajgorić, Enrique Sánchez, epiqueras, Erik, etoledom, Fabian Kägy, Fabian Pimminger, Fabian Todt, Felipe Elia, Felix Arntz, felixbaumgaertner, Femy Praseeth, fijisunshine, Florian Brinkmann, Florian TIAR, Francesca Marano, Frank Bueltge, frosso1 (a11n), fullofcaffeine, gab81, Gal Baras, Garrett Hyder, Gary Jones, Gary Pendergast, GeekPress, Gennady Kovshenin, Geoffrey, George Hotelling, George Mamadashvili, George Stephanis, geriux, glendaviesnz, Grant M. Kinney, Greg Ziółkowski, gRegor Morrill, Héctor Prieto, Hannah Malcolm, happiryu, Hareesh, Haz, hedgefield, Helen Hou-Sandí, Herm Martini, Herre Groen, herrvigg, htmgarcia, Ian Dunn, ianmjones, icopydoc, Ipstenu (Mika Epstein), Isabel Brison, Ivaylo Draganov, Ivete Tecedor, J.D. Grimes, Jack Lenox, Jake Spurlock, James Bonham, James Koster, James Nylen, James Richards, James Rosado, jamil95, janak Kaneriya, janw.oostendorp, Jason Johnston, Javier Arce, Jayman Pandya, Jean-Baptiste Audras, Jeff Ong, Jeff Paul, Jeffrey Pearce, Jenny Dupuy, Jeremy Felt, Jeremy Herve, Jeremy Yip, jeremy80, JeroenReumkens, jeryj, jillebehm, Jip Moors, Joe Bailey-Roberts, Joe Dolson, Joe McGill, Joen Asmussen, Johan Jonk Stenström, Johannes Kinast, John Blackbourn, John Godley, John James Jacoby, John Sundberg, Jon Brown, Jon Surrell, Jonathan Desrosiers, Jonny Harris, Jono Alderson, Joost de Valk, Jorge Bernal, Jorge Costa, Josee Wouters, Josepha Haden, JoshuaDoshua, Joy, jsnajdr, Juan Aldasoro, Juliette Reinders Folmer, Julio Potier, Justin Ahinon, k3nsai, kaavyaiyer, Kai Hao, Kalpesh Akabari, Karolina Vyskocilova, Kelly Choyce-Dwan, Kelly Hoffman, Kerry Liu, Kishan Jasani, Kite, KittMedia, Kjell Reigstad, klevyke, Knut Sparhell, Koen Van den Wijngaert, Konstantin Obenland, Konstantinos Xenos, Kyle Nel, lakrisgubben, Lara Schenck, Larissa Murillo, Laxman Prajapati, LewisCowles, lifeforceinst, linux4me2, Lovro Hrust, Luis Sacristán, Luiz Araújo, Luke Carbis, m0ze, Maedah Batool, Maggie Cabrera, Maja Benke, Marco Ciampini, Marcus Kazmierczak, Marek Hrabe, Marin Atanasov, Marius L. J., Mark Jaquith, Mark Parnell, Marko Heijnen, Marty Helmick, Mary Baum, Mary Job, marylauc, Mathieu Viet, Matias Ventura, Matt Chowning, Matt Mullenweg, Maxime Pertici, mblach, Meet Makadia, Meher Bala, Mel Choyce-Dwan, meloniq, mensmaximus, Michael Babker, Michael Beckwith, Miguel Fonseca, Mikael Korpela, Mike Hansen, Mike Jolley, Mike Martel, Mike Schroder, Mikhail Kobzarev, Milan Dinić, Milana Cap, mkdgs, mmuyskens, mmxxi, Mohamed El Amine DADDOU, Mohammed Faragallah, Monika Rao, Morten Rand-Hendriksen, mrjoeldean, Mukesh Panchal, munyagu, Mustafa Uysal, mweichert, Nadir Seghir, Nalini Thakor, Naoki Ohashi, Naoko Takano, Nazrul Islam Nayan, nderambure, net, nicegamer7, Nicholas Garofalo, Nick Halsey, Nik Tsekouras, ninanmnm, Noah Allen, nvartolomei, oguzkocer, olafklejnstrupjensen, Olga Bulat, Olga Gleckler, Otshelnik-Fm, oxyrealm, Ozh, Paal Joachim Romdahl, palmiak, Panagiotis Angelidis, Paragon Initiative Enterprises, Pascal Birchler, Pascal Knecht, Pat, patricklindsay, Paul, Paul Biron, Paul Bunkham, Paul Schreiber, Paul Stonier, Paul Von Schrottky, Paulo Pinto, Pavel I, Paweł, Peter Wilson, Petter Walbø Johnsgård, phena109, Philip Jackson, Pinar, Piotrek Boniu, Pippin Williamson, Pirate Dunbar, Pramod Jodhani, Presskopp, presstoke, pwallner, pyronaur, Q, Rachel Baker, rafhun, Rajesh Radadiya, Rami Yushuvaev, Ramon Ahnert, ramonopoly, Ravi Vaghela, ravipatel, Refael Iliaguyev, Rene Hermenau, retrofox, reynhartono, Riad Benguella, Rian Rietveld, Rima Prajapati, Rinat, Rnaby, robdxw, Robert Anderson, Robert Chapin, Roger Theriault, rogerlos, roo2, Roy, Russell Aaron, Ryan McCue, Ryan Welcher, Sören Wrede, Saša, Sabrina Zeidan, Sahil Mepani, Samir Shah, Samuel Wood (Otto), Sandip Mondal, Sanne van der Meulen, sarahricker, sarayourfriend, SASAPIYO, satrancali, savicmarko1985, Scott Lesovic, Scott Reilly, scottconnerly, scruffian, Sean Fisher, Sean Hayes, sebbb, Sergey Biryukov, Sergey Yakimov, SergioEstevao, sergiomdgomes, shaunandrews, Shital Marakana, silb3r, Siobhan, SirStuey, snapfractalpop, spikeuk1, spytzo, stacimc, Stanislav Khromov, Stefan Hüsges, stefanjoebstl, Stefano Minoia, Stefanos Togoulidis, Stephen Bernhardt, Stephen Edgar, Steve Dufresne, Steve Grunwell, Steve Henty, Steven Word, strategio, Subrata Sarkar, Sumaiya Siddika, Suman, Sumit Singh, Sumit Singh, sushmak, Sybre Waaijer, Synchro, szaqal21, tamlyn, Tammie Lister, Tellyworth, Terri Ann, Tetsuaki Hamano, them.es, Thomas Kräftner, Thomas Patrick Levy, Thomas Vitale, tigertech, Timothy Jacobs, TimoTijhof, Tkama, tmatsuur, tmdk, Tobias Zimpel, TobiasBg, tobifjellner (Tor-Bjorn Fjellner), Tom J Nowell, Toni Viemerö, Tonya Mork, Toro_Unit (Hiroshi Urabe), torres126, Torsten Landsiedel, Toru Miki, Travis Northcutt, trejder, Udit Desai, Ulrich, Utsav tilava, Vicente Canales, Vipul Chandel, Vlad T, wangql, WebDragon, Wendy Chen, Weston Ruter, William Earnhardt, williampatton, Xavi Ivars, Xristopher Anderton, Y_Kolev, Yan Sern, Yui, yuliyan, Yvette Sonneveld, Zack Krida, Zebulan Stanphill, zkancs, and 孙锡源.

In addition to these contributors, many thanks to all of the community volunteers who contribute in the support forums. They answer questions from people across the world, whether they are using WordPress for the first time, or they’ve been around since the first release all the way back in 2003. These releases are as successful as they are because of their efforts!

Finally, thanks to all the community translators who help make WordPress available in over 200 languages for every release. 80 languages have translated 80%, or more, of WordPress 5.8 and our community translators are hard at work ensuring more languages are on their way. If contributing to WordPress appeals to you, it’s easy to learn more. Check out Make WordPress or the core development blog.

WordPress now powers 40% of the web.

To celebrate, here is a list of 40 milestones that have led to this remarkable achievement.

Grab your favourite food and drink and dive in!

This security release features one security fix. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.

WordPress 5.7.2 is a short-cycle security release. The next major release will be version 5.8.

You can update to WordPress 5.7.2 by downloading from WordPress.org, or by visiting your Dashboard → Updates and clicking “Update Now”.

If you have sites that support automatic background updates, they’ve already started the update process.

Security Updates

One security issue affecting WordPress versions between 3.7 and 5.7. If you haven’t yet updated to 5.7, all WordPress versions since 3.7 have also been updated to fix the following security issue:

• Object injection in PHPMailer, CVE-2020-36326 and CVE-2018-19296.

Thank you to the members of the WordPress security team for implementing these fixes in WordPress.

For more information refer to the version 5.7.2 HelpHub documentation page.

Thanks and props!

The 5.7.2 release was led by @peterwilsoncc and @audrasjb.

Thank you to everyone who helped make WordPress 5.7.2 happen: @audrasjb, @ayeshrajans, @desrosj, @dd32, @peterwilsoncc, @SergeyBiryukov, and @xknown.