The release addresses a number of issues and provides two additional enhancements:
Two moderate security issues were fixed that could have allowed a Contributor- or Author-level user to gain further access to the site. The issues are Cross Site Scripting (XSS) flaws which can be consider to be serious. WordPress considers the issues to be *moderate*. In general an XSS flaw that can be triggered by non-admins is a serious issue.
One information disclosure issue was addressed that could have allowed an Author-level user to view contents of posts they should not be able to see, such as draft or private posts.
Two security enhancements were added. One improved the security of any plugins which were not properly leveraging our security API. The other offers additional defense in depth against a vulnerability that was fixed in previous release.
Summary
- Fix XSS bug: Properly encode title used in Quick/Bulk Edit, and offer additional sanitization to various fields. Affects users of the Author or Contributor role.
- Fix XSS bug: Preserve tag escaping in the tags meta box. Affects users of the Author or Contributor role.
- Fix potential information disclosure of posts through the media uploader. Affects users of the Author role.
- Enhancement: Force HTML filtering on comment text in the admin
- Enhancement: Harden check_admin_referer() when called without arguments, which plugins should avoid.
- Update the license to GPLv2 (or later) and update copyright information for the KSES library.
List of Files Revised
wp-includes/default-filters.php wp-includes/version.php wp-includes/pluggable.php wp-includes/kses.php wp-includes/script-loader.php readme.html wp-admin/includes/post.php wp-admin/includes/update-core.php wp-admin/includes/template.php wp-admin/js/post.dev.js wp-admin/js/post.js wp-admin/async-upload.php