This release brings a major platform upgrade alongside a security fix that we strongly encourage all self-hosted, open source users to apply as soon as possible.
WordPress 7 Support
Pressbooks now supports WordPress 7.x. As part of this update, the minimum supported WordPress version is now 7.0.3. If you’re running an older version of WordPress, please upgrade before updating Pressbooks. (#4541)
Security Fix: Stored XSS in Built-in Shortcodes
This release also includes a fix for a stored cross-site scripting (XSS) vulnerability affecting several of Pressbooks’ built-in shortcodes, including [anchor], [heading], [textbox], [media_attributions], and [pb_glossary].
What was the issue? Certain shortcode attributes were inserted into the page’s HTML without being properly escaped. This meant that a user with Author-level access or higher could craft a shortcode attribute containing malicious JavaScript, which would then execute in the browser of anyone viewing the affected page — including higher-privileged users — without requiring any additional action beyond normal page interaction.
Who is affected? Any Pressbooks install using the affected shortcodes, including publicly accessible books, is at risk.
We strongly encourage all open source, self-hosted Pressbooks users to update as soon as possible. If you’re unable to update immediately, consider restricting Author-level access to trusted users until you can.
All hosted instances on our infrastructure have already been upgraded to WordPress 7.0.3 with this security patch applied — no action is needed if you’re on Pressbooks-hosted infrastructure.
We’d like to thank Ashok Chapagai for responsibly disclosing this issue to us and working with our team to get it resolved. We’re grateful to researchers like Ashok who help keep the Pressbooks community safe. (#4550)
Other Changes
- Updated the underlying WordPress version to address additional security issues (#4547)
- Bumped coding standards tooling (#4549)
As always, thank you to our community for your continued support. If you have any questions about this release or the security fix, please reach out to our team.