# Pressbooks Release: WordPress 7 Support + Important Security Fix

**URL:** <https://pressbooks.community/t/pressbooks-release-wordpress-7-support-important-security-fix/4659>\
**Category:** Pressbooks Announcements\
**Created:** [August 12, 2026, 5:27pm UTC](https://pressbooks.community/t/pressbooks-release-wordpress-7-support-important-security-fix/4659 "2026-08-12T17:27:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christopher\_Murtagh](https://pressbooks.community/user_avatar/pressbooks.community/christopher_murtagh/32/1507_2.png) [@Christopher\_Murtagh](https://pressbooks.community/u/Christopher_Murtagh)\
**Post date:** [August 12, 2026, 5:27pm UTC](https://pressbooks.community/t/pressbooks-release-wordpress-7-support-important-security-fix/4659/1 "2026-08-12T17:27:52Z")

</div>

This release brings a major platform upgrade alongside a security fix that we strongly encourage all self-hosted, open source users to apply as soon as possible.

### **WordPress 7 Support**

Pressbooks now supports WordPress 7.x. As part of this update, **the minimum supported WordPress version is now 7.0.3**. If you’re running an older version of WordPress, please upgrade before updating Pressbooks. ([#4541](https://github.com/pressbooks/pressbooks/issues/4541))

### **Security Fix: Stored XSS in Built-in Shortcodes**

This release also includes a fix for a **stored cross-site scripting (XSS) vulnerability** affecting several of Pressbooks’ built-in shortcodes, including `[anchor]`, `[heading]`, `[textbox]`, `[media_attributions]`, and `[pb_glossary]`.

**What was the issue?** Certain shortcode attributes were inserted into the page’s HTML without being properly escaped. This meant that a user with Author-level access or higher could craft a shortcode attribute containing malicious JavaScript, which would then execute in the browser of anyone viewing the affected page — including higher-privileged users — without requiring any additional action beyond normal page interaction.

**Who is affected?** Any Pressbooks install using the affected shortcodes, including publicly accessible books, is at risk.

**We strongly encourage all open source, self-hosted Pressbooks users to update as soon as possible.** If you’re unable to update immediately, consider restricting Author-level access to trusted users until you can.

**All hosted instances on our infrastructure have already been upgraded to WordPress 7.0.3 with this security patch applied** — no action is needed if you’re on Pressbooks-hosted infrastructure.

We’d like to thank **Ashok Chapagai** for responsibly disclosing this issue to us and working with our team to get it resolved. We’re grateful to researchers like Ashok who help keep the Pressbooks community safe. ([#4550](https://github.com/pressbooks/pressbooks/issues/4550))

### **Other Changes**

- Updated the underlying WordPress version to address additional security issues ([#4547](https://github.com/pressbooks/pressbooks/issues/4547))
- Bumped coding standards tooling ([#4549](https://github.com/pressbooks/pressbooks/issues/4549))

As always, thank you to our community for your continued support. If you have any questions about this release or the security fix, please reach out to our team.