Version in base suite: 6.8.3+dfsg1-0+deb13u1 Version in overlay suite: 6.8.6+dfsg1-0+deb13u1 Base version: wordpress_6.8.6+dfsg1-0+deb13u1 Target version: wordpress_6.8.7+dfsg1-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/w/wordpress/wordpress_6.8.6+dfsg1-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/w/wordpress/wordpress_6.8.7+dfsg1-0+deb13u1.dsc debian/changelog | 8 ++++++++ wp-admin/about.php | 20 ++++++++++++++++++++ wp-admin/includes/user.php | 11 ++++++++--- wp-admin/js/inline-edit-post.js | 7 ++++++- wp-admin/js/inline-edit-post.min.js | 2 +- wp-includes/blocks/post-date.php | 4 +++- wp-includes/canonical.php | 2 +- wp-includes/http.php | 27 ++++++++++++++++++++++++--- wp-includes/kses.php | 7 ++++++- wp-includes/user.php | 24 +++++++++++++++++------- wp-includes/version.php | 2 +- wp-login.php | 4 ++-- wp-signup.php | 6 +++++- 13 files changed, 102 insertions(+), 22 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp4w0jrt4x/wordpress_6.8.6+dfsg1-0+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp4w0jrt4x/wordpress_6.8.7+dfsg1-0+deb13u1.dsc: no acceptable signature found diff -Nru wordpress-6.8.6+dfsg1/debian/changelog wordpress-6.8.7+dfsg1/debian/changelog --- wordpress-6.8.6+dfsg1/debian/changelog 2026-07-21 06:46:23.000000000 +0000 +++ wordpress-6.8.7+dfsg1/debian/changelog 2026-08-07 08:13:22.000000000 +0000 @@ -1,3 +1,11 @@ +wordpress (6.8.7+dfsg1-0+deb13u1) trixie-security; urgency=medium + + * New upstream security release + CVE-2026-64638 fix XSS in login that leads to RCE Closes: #1143843 + + + -- Craig Small Fri, 07 Aug 2026 18:13:22 +1000 + wordpress (6.8.6+dfsg1-0+deb13u1) trixie-security; urgency=medium * New upstream security release 6.8.6 diff -Nru wordpress-6.8.6+dfsg1/wp-admin/about.php wordpress-6.8.7+dfsg1/wp-admin/about.php --- wordpress-6.8.6+dfsg1/wp-admin/about.php 2026-07-17 17:55:58.000000000 +0000 +++ wordpress-6.8.7+dfsg1/wp-admin/about.php 2026-08-06 18:10:34.000000000 +0000 @@ -62,6 +62,26 @@ printf( /* translators: %s: WordPress version. */ __( 'Version %s addressed some security issues.' ), + '6.8.7' + ); + ?> + the release notes.' ), + sprintf( + /* translators: %s: WordPress version. */ + esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ), + sanitize_title( '6.8.7' ) + ) + ); + ?> +

+

+ Version %s addressed some security issues.' ), '6.8.6' ); ?> diff -Nru wordpress-6.8.6+dfsg1/wp-admin/includes/user.php wordpress-6.8.7+dfsg1/wp-admin/includes/user.php --- wordpress-6.8.6+dfsg1/wp-admin/includes/user.php 2025-03-02 00:43:23.807565000 +0000 +++ wordpress-6.8.7+dfsg1/wp-admin/includes/user.php 2026-08-06 17:35:49.211694000 +0000 @@ -44,6 +44,8 @@ $user->user_login = sanitize_user( wp_unslash( $_POST['user_login'] ), true ); } + $errors = new WP_Error(); + $pass1 = ''; $pass2 = ''; if ( isset( $_POST['pass1'] ) ) { @@ -78,7 +80,12 @@ } if ( isset( $_POST['email'] ) ) { - $user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) ); + $maybe_email = wp_unslash( $_POST['email'] ); + if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) { + $user->user_email = $maybe_email; + } else { + $errors->add( 'invalid_email', __( 'Error: The email address is not correct.' ), array( 'form-field' => 'email' ) ); + } } if ( isset( $_POST['url'] ) ) { if ( empty( $_POST['url'] ) || 'http://' === $_POST['url'] ) { @@ -145,8 +152,6 @@ $user->use_ssl = 1; } - $errors = new WP_Error(); - /* checking that username has been typed */ if ( '' === $user->user_login ) { $errors->add( 'user_login', __( 'Error: Please enter a username.' ) ); diff -Nru wordpress-6.8.6+dfsg1/wp-admin/js/inline-edit-post.js wordpress-6.8.7+dfsg1/wp-admin/js/inline-edit-post.js --- wordpress-6.8.6+dfsg1/wp-admin/js/inline-edit-post.js 2024-09-30 18:24:13.448376000 +0000 +++ wordpress-6.8.7+dfsg1/wp-admin/js/inline-edit-post.js 2026-08-06 17:35:49.211694000 +0000 @@ -359,7 +359,12 @@ if ( !$(':input[name="post_author"] option[value="' + $('.post_author', rowData).text() + '"]', editRow).val() ) { // The post author no longer has edit capabilities, so we need to add them to the list of authors. - $(':input[name="post_author"]', editRow).prepend(''); + $(':input[name="post_author"]', editRow).prepend( + new Option( + $('#post-' + id + ' .author').text(), + $('.post_author', rowData).text() + ) + ); } if ( $( ':input[name="post_author"] option', editRow ).length === 1 ) { $('label.inline-edit-author', editRow).hide(); diff -Nru wordpress-6.8.6+dfsg1/wp-admin/js/inline-edit-post.min.js wordpress-6.8.7+dfsg1/wp-admin/js/inline-edit-post.min.js --- wordpress-6.8.6+dfsg1/wp-admin/js/inline-edit-post.min.js 2025-02-06 17:27:26.356615000 +0000 +++ wordpress-6.8.7+dfsg1/wp-admin/js/inline-edit-post.min.js 2026-08-06 17:35:49.211694000 +0000 @@ -1,2 +1,2 @@ /*! This file is auto-generated */ -window.wp=window.wp||{},function(u,h){window.inlineEditPost={init:function(){var i=this,t=u("#inline-edit"),e=u("#bulk-edit"),t=(i.type=u("table.widefat").hasClass("pages")?"page":"post",i.what="#post-",t.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),e.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),u(".cancel",t).on("click",function(){return inlineEditPost.revert()}),u(".save",t).on("click",function(){return inlineEditPost.save(this)}),u("td",t).on("keydown",function(t){if(13===t.which&&!u(t.target).hasClass("cancel"))return inlineEditPost.save(this)}),u(".cancel",e).on("click",function(){return inlineEditPost.revert()}),u('#inline-edit .inline-edit-private input[value="private"]').on("click",function(){var t=u("input.inline-edit-password-input");u(this).prop("checked")?t.val("").prop("disabled",!0):t.prop("disabled",!1)}),u("#the-list").on("click",".editinline",function(){u(this).attr("aria-expanded","true"),inlineEditPost.edit(this)}),u("#inline-edit fieldset.inline-edit-categories").clone());t.find("*[id]").each(function(){this.id="bulk-edit-"+this.id}),u("#bulk-edit").find("fieldset:first").after(t).siblings("fieldset:last").prepend(u("#inline-edit .inline-edit-tags-wrap").clone()),u('select[name="_status"] option[value="future"]',e).remove(),u("#doaction").on("click",function(t){var e;u('#posts-filter .check-column input[type="checkbox"]:checked').length<1||(i.whichBulkButtonId=u(this).attr("id"),e=i.whichBulkButtonId.substr(2),"edit"===u('select[name="'+e+'"]').val()?(t.preventDefault(),i.setBulk()):0

    • ")}),a)return this.revert();u("#bulk-titles").html('"),e.each(function(){var t=u(this).val();u("#category_"+t).text().split(",").map(function(t){i[t]||(i[t]=0),i[t]++})}),u('.inline-edit-categories input[name="post_category[]"]').each(function(){var t;i[u(this).val()]==e.length?u(this).prop("checked",!0):0').attr("aria-label",t.trim()+": "+h.i18n.__("Some selected posts have this category"))))}),u('.inline-edit-categories input[name="post_category[]"]:indeterminate').on("change",function(){u(this).removeAttr("aria-label").parent().find('input[name="indeterminate_post_category[]"]').remove()}),u(".inline-edit-save button").on("click",function(){u('.inline-edit-categories input[name="post_category[]"]').prop("indeterminate",!1)}),u("#bulk-titles .ntdelbutton").click(function(){var t=u(this),e=t.attr("id").substr(1),i=t.parent().prev().children(".ntdelbutton"),t=t.parent().next().children(".ntdelbutton");u("input#cb-select-all-1, input#cb-select-all-2").prop("checked",!1),u('table.widefat input[value="'+e+'"]').prop("checked",!1),u("#_"+e).parent().remove(),h.a11y.speak(h.i18n.__("Item removed."),"assertive"),t.length?t.focus():i.length?i.focus():(u("#bulk-titles-list").remove(),inlineEditPost.revert(),h.a11y.speak(h.i18n.__("All selected items have been removed. Select new items to use Bulk Actions.")))}),"post"===t&&u("tr.inline-editor textarea[data-wp-taxonomy]").each(function(t,e){u(e).autocomplete("instance")||u(e).wpTagsSuggest()}),u("#bulk-edit .inline-edit-wrapper").attr("tabindex","-1").focus(),u("html, body").animate({scrollTop:0},"fast")},edit:function(n){var t,a,e,i,s,o,r,l,d=this,c=!0;for(d.revert(),"object"==typeof n&&(n=d.getId(n)),t=["post_title","post_name","post_author","_status","jj","mm","aa","hh","mn","ss","post_password","post_format","menu_order","page_template"],"page"===d.type&&t.push("post_parent"),a=u("#inline-edit").clone(!0),u("td",a).attr("colspan",u("th:visible, td:visible",".widefat:first thead").length),u("td",a).find("#quick-edit-legend").removeAttr("id"),u("td",a).find('p[id^="quick-edit-"]').removeAttr("id"),u(d.what+n).removeClass("is-expanded").hide().after(a).after(''),e=u("#inline_"+n),u(':input[name="post_author"] option[value="'+u(".post_author",e).text()+'"]',a).val()||u(':input[name="post_author"]',a).prepend('"),1===u(':input[name="post_author"] option',a).length&&u("label.inline-edit-author",a).hide(),r=0;rd?u('select[name="_status"] option[value="future"]',a):u('select[name="_status"] option[value="publish"]',a)).remove(),d=u(".inline-edit-password-input").prop("disabled",!1),"private"===p&&(u('input[name="keep_private"]',a).prop("checked",!0),d.val("").prop("disabled",!0)),0<(i=u('select[name="post_parent"] option[value="'+n+'"]',a)).length){for(s=i[0].className.split("-")[1],o=i;c&&0!==(o=o.next("option")).length;)o[0].className.split("-")[1]<=s?c=!1:(o.remove(),o=i);i.remove()}return u(a).attr("id","edit-"+n).addClass("inline-editor").show(),u(".ptitle",a).trigger("focus"),!1},save:function(n){var t=u(".post_status_page").val()||"";return"object"==typeof n&&(n=this.getId(n)),u("table.widefat .spinner").addClass("is-active"),t={action:"inline-save",post_type:typenow,post_ID:n,edit_date:"true",post_status:t},t=u("#edit-"+n).find(":input").serialize()+"&"+u.param(t),u.post(ajaxurl,t,function(t){var e=u("#edit-"+n+" .inline-edit-save .notice-error"),i=e.find(".error");u("table.widefat .spinner").removeClass("is-active"),t?-1!==t.indexOf("]*?>/g,""),e.removeClass("hidden"),i.html(t),h.a11y.speak(i.text())):(e.removeClass("hidden"),i.text(h.i18n.__("Error while saving the changes.")),h.a11y.speak(h.i18n.__("Error while saving the changes.")))},"html"),!1},revert:function(){var t=u(".widefat"),e=u(".inline-editor",t).attr("id");return e&&(u(".spinner",t).removeClass("is-active"),("bulk-edit"===e?(u("#bulk-edit",t).removeClass("inline-editor").hide().siblings(".hidden").remove(),u("#bulk-titles").empty(),u("#inlineedit").append(u("#bulk-edit")),u("#"+inlineEditPost.whichBulkButtonId)):(u("#"+e).siblings("tr.hidden").addBack().remove(),e=e.substr(e.lastIndexOf("-")+1),u(this.what+e).show().find(".editinline").attr("aria-expanded","false"))).trigger("focus")),!1},getId:function(t){t=u(t).closest("tr").attr("id").split("-");return t[t.length-1]}},u(function(){inlineEditPost.init()}),u(function(){void 0!==h&&h.heartbeat&&h.heartbeat.interval(10)}).on("heartbeat-tick.wp-check-locked-posts",function(t,e){var n=e["wp-check-locked-posts"]||{};u("#the-list tr").each(function(t,e){var i=e.id,e=u(e);n.hasOwnProperty(i)?e.hasClass("wp-locked")||(i=n[i],e.find(".column-title .locked-text").text(i.text),e.find(".check-column checkbox").prop("checked",!1),i.avatar_src&&(i=u("",{class:"avatar avatar-18 photo",width:18,height:18,alt:"",src:i.avatar_src,srcset:i.avatar_src_2x?i.avatar_src_2x+" 2x":void 0}),e.find(".column-title .locked-avatar").empty().append(i)),e.addClass("wp-locked")):e.hasClass("wp-locked")&&e.removeClass("wp-locked").find(".locked-info span").empty()})}).on("heartbeat-send.wp-check-locked-posts",function(t,e){var i=[];u("#the-list tr").each(function(t,e){e.id&&i.push(e.id)}),i.length&&(e["wp-check-locked-posts"]=i)})}(jQuery,window.wp); \ No newline at end of file +window.wp=window.wp||{},function(u,h){window.inlineEditPost={init:function(){var i=this,t=u("#inline-edit"),e=u("#bulk-edit"),t=(i.type=u("table.widefat").hasClass("pages")?"page":"post",i.what="#post-",t.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),e.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),u(".cancel",t).on("click",function(){return inlineEditPost.revert()}),u(".save",t).on("click",function(){return inlineEditPost.save(this)}),u("td",t).on("keydown",function(t){if(13===t.which&&!u(t.target).hasClass("cancel"))return inlineEditPost.save(this)}),u(".cancel",e).on("click",function(){return inlineEditPost.revert()}),u('#inline-edit .inline-edit-private input[value="private"]').on("click",function(){var t=u("input.inline-edit-password-input");u(this).prop("checked")?t.val("").prop("disabled",!0):t.prop("disabled",!1)}),u("#the-list").on("click",".editinline",function(){u(this).attr("aria-expanded","true"),inlineEditPost.edit(this)}),u("#inline-edit fieldset.inline-edit-categories").clone());t.find("*[id]").each(function(){this.id="bulk-edit-"+this.id}),u("#bulk-edit").find("fieldset:first").after(t).siblings("fieldset:last").prepend(u("#inline-edit .inline-edit-tags-wrap").clone()),u('select[name="_status"] option[value="future"]',e).remove(),u("#doaction").on("click",function(t){var e;u('#posts-filter .check-column input[type="checkbox"]:checked').length<1||(i.whichBulkButtonId=u(this).attr("id"),e=i.whichBulkButtonId.substr(2),"edit"===u('select[name="'+e+'"]').val()?(t.preventDefault(),i.setBulk()):0