Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• A stored XSS on the Comments administration page, exploitable via pending comments, reported by Trail of Bits in collaboration with OpenAI.
• A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic
• A second-Order SQL injection in WordPress WXR export, reported by Anthropic
• A weakness allowing Author role users to sticky posts, reported by Anthropic
• Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack
• Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong
• Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team

Thank you to these WordPress contributors

This release was led by Jake Spurlock.

WordPress 7.1.3 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, Adam Silverstein, Adi Moldovan, Adrian Duffell, Alex Concha, Arkaprabha Chowdhury, Deepak Kumar, donniam, Ehtisham Siddiqui, Jake Spurlock, Jb Audras, Jeremy Felt, Joe Dolson, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Ken Gagne, Khokan Sardar, Lance Willett, lucatume, marcs0h, Peter Wilson, Paul Kevan, RS Software, Rudy Faile, Sergey Biryukov, siliconforks, smerriman, Stephen Bernhardt, Suryakant Upadhyay, vortfu, webVerts, Weston Ruter, Yogesh Bhutkar

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security update included in this release

The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).

Thank you to these WordPress contributors

This release was led by John Blackbourn. WordPress 7.1.2 would not have been possible without the contributions of the following people:

Aaron Jorbin, Aki Hamano, Alex Concha, Ehtisham Siddiqui, fiocavallari, Jb Audras, Jeffrey Paul, Jeremy Felt, Joe McGill, John Blackbourn, Jon Surrell, Lance Willett, Manuel Camargo, marcs0h, martin.krcho, Mukesh Panchal, Olga Gleckler, Pascal Birchler, Peter Wilson, Rajin Sharwar, Ressl, Rudy Faile, Sergey Biryukov, Shail Mehta, Stephanie Walters, and vortfu.

CVE and GHSA references

Further details can be found in the advisory: CVE-2026-87902 / GHSA-7hp8-65ch-5whp.

Backports

As a courtesy, the security fix was backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 7.1.1 is a short-cycle release. The next major release will be version 7.2 and is currently planned for December.

For more information, please visit the WordPress 7.1.1 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by Jakub Herman.
• Comments, including notes, can be reparented by any authenticated user, reported by Justin Hart, Viridis Security.

Thank you to these WordPress contributors

This release was led by Adam Silverstein, Adrian Duffell, Andrei Draganescu, and Aaron Jorbin.

WordPress 7.1.1 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, abrahamfariaz, Adam Silverstein, Adi Moldovan, Adrian Duffell, Aki Hamano, Alex Concha, Andrea Fercia, andreasca, Andrei Draganescu, Andrew Duthie, Andrew Serong, André Maneiro, annezazu, Anthony White, Arkaprabha Chowdhury, Ashar Fuadi, Azragh, Barry, buffer1024, Chunhui Ouyang, Courtney Robertson, Dagan, Daniel Richards, Daniel Rodriguez, Darshit Rajyaguru, David Biňovec, Deepak Kumar, Dennis Snell, DevSaiful, Dhruvang21, Dominik Schilling, Ehtisham Siddiqui, Ella Van Durpe, Erick Wambua, FahimMurshed, Fernando Tellado, fiocavallari, George Mamadashvili, George Vasiliades, gregbenz, Harish Tewari, Hit Bhalodia, Isabel Brison, Jake Spurlock, Jamie Dąbrowiecki, Jb Audras, Jeffrey Paul, Jeremy Felt, Jiwoon Kim, Joe Dolson, Joe Hoyle, Joe McGill, Joen Asmussen, Johannes Jülg, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Josh, Kamran Abdul Aziz, Khokan Sardar, Kira Schroder, kleisauke, Kushagra Goyal, l1onofjudah, Lance Willett, luksusspokoju, Manzoor Wani, Marco Ciampini, marcs0h, Marin Atanasov, Michael, Mohammad Jangda, mrkenobi, Mukesh Panchal, Nawazkhan Pathan, Nik Tsekouras, Parth Jogi, Pascal Birchler, Paul Biron, Paul Kevan, Peter Wilson, Rafie Muhammad, ramonopoly, Rashed Hossain, Ressl, Riad Benguella, Rudy Faile, Sainath Poojary, Scott Kingsley Clark, Sergey Biryukov, Shail Mehta, Shameem – a11n, siliconforks, Slava Abakumov, Stephen Bernhardt, Sukhendu Sekhar Guria, Ugyen Dorji, Utsav Ladani, vortfu, Weston Ruter, w3bdsgn, wolf45 plus representatives from Automattic, Bluehost, GoDaddy, Pantheon, and WP Engine.

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Props to Ehtisham Siddiqui, Lance Willett, Weston Ruter, and Adam Silverstein for proofreading.

Each WordPress release celebrates an artist who has made an indelible mark on the world of music. WordPress 7.1, code-named “Mary Lou,” honors pioneering jazz pianist, arranger, and composer Mary Lou Williams.

A child prodigy who began playing publicly at six, her influence and work cut across nearly every major era of jazz, moving through swing, bebop, and sacred jazz. Through all of it, she kept reinventing her own sound. In the 1940s, she turned her Harlem apartment into a nightly workshop where Thelonious Monk, Dizzy Gillespie, and Bud Powell came to trade ideas and shape bebop itself. That combination of reinvention and collaboration inspired WordPress 7.1.

Let the range of Mary Lou’s music carry you through everything 7.1 offers.

Welcome to WordPress 7.1!

WordPress 7.1 is built around how you work: navigating the admin, controlling your designs, collaborating with others, and building what you want. The admin bar now follows you across the entire admin experience, putting the tools you need within reach, whether you’re writing a post or editing your site’s design. Built-in responsive styling, added to the current show/hide options for blocks, means you can ensure your site looks exactly how you want across screen sizes, without custom CSS. A new media editor keeps the familiar Crop button entry point, and brings freeform and aspect-ratio cropping, horizontal and vertical flipping, fine-grained and snap rotation, and metadata editing into one dedicated workflow. Leave Notes anywhere in your content—no longer limited to the block level. Rich text support and @mentions make it easier to collaborate with others as you write. Two new blocks, Playlist and Tabs, as well as a new API to register your own set of icons for the Icon block, give you even more flexibility to build what you want without additional plugins. These are just the highlights! Read on to see everything WordPress 7.1 has to offer.

What’s inside

There’s a lot packed into WordPress 7.1 across new styling tools, updated media flows, added Notes functionality, and more. Some changes add new capabilities, while others refine existing tools and workflows.

Here’s a closer look at what’s new in this release, starting with the release video:

Apply responsive styles

Style your content your way, on every screen.

WordPress 7.1 brings more responsive controls directly into the Site Editor. Style how a block looks at different screen sizes from Global Styles or in individual block settings, without custom CSS. You can also preview your changes at different viewport sizes as you work, making it straightforward to build layouts that adapt to the way people browse the web.

Admin bar, now in every editor

Consistent navigation, from dashboard to editor.

The WordPress admin bar now stays with you as you move across all editors, so you always know where you are and have easy access to familiar tools. The admin bar also features some small visual updates to more fully polish the experience. 

A new way to crop

One dedicated workflow for editing your images.

A new media editor modal replaces the previous inline cropping tool, bringing together freeform and aspect-ratio cropping, horizontal and vertical flipping, precise rotation control, and metadata editing together in one place. The familiar Crop button still gets you there.

Inline notes with mentions and rich text

More ways to leave feedback.

Notes now support rich text and mentions, making it easier to leave clear feedback and loop in the right people. Format your Notes with bold, italic, and code, add links, or type @ to mention a collaborator and notify them.

You can also leave a note on a specific piece of text instead of just an entire block, keep multiple conversations going on the same block, and collapse longer notes to keep the margin tidy. It’s built for the back-and-forth that happens when people review content together.

Improved media handling

Faster, more flexible image processing.

Image compression, resizing, and thumbnail generation now happen in the browser, reducing server load and producing smaller files — without hitting PHP memory limits or upload timeouts.

Media handling in 7.1 also includes native support for AVIF, HEIC, and HDR gain maps, adding native support for the image formats modern cameras and phones already produce.

Enhanced details and new blocks

WordPress 7.1 also adds two new blocks, along with more ways to customize how content looks and behaves.

Create playlists

Bring multiple audio tracks together in one playlist, with an optional waveform that gives listeners a visual sense of each track as it plays.

Customize responsive breakpoints

Block themes can now define their own mobile and tablet breakpoints in theme.json, overriding the defaults for responsive styles and block visibility.

Organize with tabs

Organize content into tabbed panels instead of showing everything at once—a cleaner way to present related information without crowding your content.

Add custom icons

Developers can extend WordPress’s icon library with their own collections, making custom icons available throughout the editor alongside the built-in library.

Set interactive styles

Give Button blocks distinct styles for hover, focus, and active states directly in the editor’s style controls. Set the styles for just one button or all buttons.

A more consistent editing experience

The post editor is now fully iframed for all themes, matching the Site Editor.

The editing canvas runs separately from the WordPress admin interface, so admin styles don’t interfere with your content. Viewport-relative units and media queries now target the editing canvas directly, so responsive layouts behave more predictably as you build. The change is mostly invisible, but the result is a more reliable and consistent editor.

Developer’s toolbox

Advanced tools for building your way.

WordPress 7.1 expands several of the APIs and tools developers use to build on WordPress, with new options for icons, automation, admin interfaces, and responsive styling.

The SVG Icon API is now a public API, allowing developers to register their own icon collections and icons and use them throughout the editor with functions such as wp_register_icon_collection(), wp_register_icon(), and wp_get_icon().

The Abilities API builds on the infrastructure introduced in WordPress 6.9 with a filterable execution lifecycle, custom validation, and shared discovery. These additions make it easier to build integrations and automation on top of WordPress, including AI-powered tooling.

A new Design System provides foundational support for theming WordPress admin interfaces, including color, roundness, and cursor styles. Developers can use semantic design tokens and the ThemeProvider React component to bring more consistency to custom admin interfaces while still feeling at home in WordPress.

Theme authors also get responsive styling and pseudo-state styling for hover, focus, focus-visible, and active states through theme.json, along with new filters for configuring the DataViews and DataForm screens that power Pages, Templates, Parts, and Patterns in the Site Editor.

Accessibility

WordPress 7.1 continues to improve accessibility across WordPress Core and the editor. New wp_get_tooltip() and wp_get_toggletip() functions bring accessible tooltips to more areas of the WordPress admin, including post meta boxes and the login screen.

Screen reader support also improves across admin interfaces, with clearer labeling and more predictable navigation in post list tables. The new Tab and Playlist blocks, along with improvements to editor navigation and interaction, add to the broader accessibility work included in this release.

Together, these changes continue to make WordPress easier to navigate and use for more people.

Performance improvements

Image compression, resizing, and thumbnail generation now run in the browser (via a WebAssembly build of libvips), reducing the processing load on your server and helping avoid memory limits and timeouts with larger uploads.

Opt-in GIF-to-video conversion produces typically smaller files, while upload progress indicators and automatic retries make uploads more resilient when connections drop.

The Media Library now uses infinite scrolling by default, with a per-user option to return to pagination. Speculative loading defaults can now be set through environment variables or constants, so hosts and site owners can configure how WordPress prefetches pages without writing a plugin.

And much more!

For a comprehensive overview of everything new and improved in WordPress 7.1, visit the feature showcase website.

Learn more about WordPress 7.1

Learn WordPress is a free resource for new and experienced WordPress users.  Learn is stocked with how-to videos on using various features in WordPress, interactive workshops for exploring topics in-depth, and lesson plans for diving deep into specific areas of WordPress.

Read the WordPress 7.1 Release Notes for information on installation, enhancements, fixed issues, release contributors, learning resources, and the list of file changes.

Explore the WordPress 7.1 Field Guide.  Learn about the changes in this release with detailed developer notes to help you build with WordPress.

The 7.1 release squad

Every release comes to you from a dedicated team of enthusiastic contributors who help keep things on track and moving smoothly. The team that has led 7.1 is a cross-functional group of contributors who are always ready to champion ideas, remove blockers, and resolve issues.

• Release Lead: Anne McCarthy
• Release Coordination: Benjamin Zekavica, Krupa Nanda
• Tech Leads: Aki Hamano, Joe Dolson
• Triage Leads: Adrian Duffell, Sajjad Hossain Sagor, Sergey Biryukov
• Test Leads: Huzaifa Al Mesbah, Nikunj Hatkar

Thank you, contributors

The mission of WordPress is to democratize publishing and embody the freedoms that come with open source.  A global and diverse community of people collaborating to strengthen the software supports this effort.

WordPress 7.1 reflects the tireless efforts and passion of more than 800 contributors from all over the world. This release also welcomed over 170 first-time contributors! 

Together, their work delivered more than 1500 enhancements and fixes, helping make WordPress 7.1 a stable and polished release for everyone. It’s another great example of what the WordPress open source community can accomplish when people come together to build, test, and improve the software

1shiharaT · Aagam Shah · Aakash Verma · Aaron D. Campbell · Aaron Jorbin · Aaron Robertshaw · Abdalsalaam Halawa · Abdullah Ramzan · Abdur Rahman Emon · Abhishek Kumar · abrahamfariaz · Achal Jain · AcrossAI · Adam Silverstein · Adam Wood · Adam Zieliński · Adi Moldovan · adithyanaik · Aditya Singh · Adrian Duffell · adrmf25 · agulbra · Ahmed · Ahmed Kabir Chaion · ahuseyn · Aki Hamano · Akshat Kakkad · Alain Schlesser · Alan Jacob Mathew · Albert Juhé Lluveras · Alec Geatches · Alex Concha · Alex Cuadra · Alex Kirk · Alex Stine · alhrath · allilevine · Alvaro Gómez · Amber Hinds · Aminul Islam Alvi · Amit Joel · Amit Raj · Amjad Ali · Amy Kamala · Anastis Sourgoutsidis · Anders Norén · Andrea Fercia · Andrea Grassi · Andrea Roenning · andreasca · Andrei Draganescu · Andrej Mernik · Andrew Duthie · Andrew Matia · Andrew Ozz · Andrew Serong · André Maneiro · Andy Fragen · Andy Meerwaldt · Anh Tran · Ankit K Gupta · Ankit Kumar Shah · Ankit Panchal · Ankit Patel · Anne McCarthy · Anne-Mieke Bovelett · Anthony Hortin · Anthony White · Anukasha Singh · Anup Kankale · Anveshika Srivastava · aperto · arcangelini · Ari Stathopoulos · Arischvaran Puvanesvaran · Arkaprabha Chowdhury · Armand MD · Arshid · Arthur Chu · Artur Piszek · Ashar Fuadi · aslushnikov · aswasif007 · atomiks · Aurooba Ahmed · avcascade · ayaz ahmed · ayushhoff · Azhar Ali · Azhar Deraiya · Azragh · BackuPs · Baikare Sandip · Barry · Bart Kalisz · Bayejid Ahmed · Ben Dwyer · Benedikt Ledl · Benjamin Grolleau · Benjamin Zekavica · Benoit Chantre · Bernie Reiter · Bero · bigdigital · Bigul Malayi · Birgir Erlendsson (birgire) · Birgit Pauli-Haack · Blake Bertuccelli-Booth · bluefuton · bobbingwide · Boro Sitnikovski · brad hogan · Brad Jorsch · bradshawtm · brajdas0022 · Brandon Hubbard · Brandon Kraft · Brandon Payton · brbrr · Brian Alexander · Brian Coords · Brian Gardner · Brian Haas · Brian Henry · Brian Hogg · Bridget Willard · brnhrst · buffer1024 · Burhan Nasir · burnuser · Béryl de La Grandière · C83 · Camila Rayza Mendoza Vargas · Carlos Bravo · Carolina Nymark · CAT the Tech · cbirdsong · ccprog · cgastrell · Chad Chadbourne · Charalampos Papazoglou · Chillifish · Chouby · Chris David Miles · Chris Gresham-Britt · Chris Huber · Chris Lilitsas · Chris M. - a11n · Chris Zarate · chriscct7 · Christoph Daum · Chuck Grimmett · Chunhui Ouyang · Ciprian Popescu · Clément Polito · Code Amp · codesmith32 · Cody · cogdesign · ColinD · collinr3 · Corey Worrell · Courtney Robertson · Cris Busquets · csabarakasz · cweiske · Dagan · Dakota Chichester · Damianne P (a11n) · Damon Cook · Dan Luu · Dan Zakirov · Dani Guardiola · Daniel Bachhuber · Daniel Richards · Daniel Rodriguez · dannyreaktiv · Darin Kotter · Darren Ethier (nerrad) · Darshit Rajyaguru · Dave Whitley · David Aguilera · David Arenas · David Baumwald · David Biňovec · David Bowman · David Cavins · David Levine · David Shanske · David Smith · David Stone · Dean Sas · Deepak Kumar · Deepak Prajapati · Deepak Rohilla · Denis Žoljom · Dennis Heiden · Dennis Ploetner · Dennis Snell · deoladev · Deryck · Devanshi Joshi · Devasheesh Kaul · Dharmesh Patel · Dhaval Kapadane · Dhrumil Kumbhani · Dhruvang21 · Dhruvik Malaviya · diegogarciarodrigues · Dion Hulse · dlind1 · Dominik Schilling · Douglas Henri · Drew Jaynes · Drivingralle · Dávid Szabó · eclev91 · Edith Allison · efc · Ehtisham Siddiqui · eishanoor · ekaterina92 · elfu98 · Eliot Akira · elizaan36 · Ella van Durpe · Ellen Bauer · Emmanuel Atsé · Enej Bajgorić · Eoin Savage · Eric · Eric Michel · Erick Wambua · Eshaan Dabasiya · Esteban Cairol · Estela Rueda · eurello · Evan Herman · Fabian Kaegy · FahimMurshed · Faisal Ahammad · Fakhri Azzouz · Felipe Velzani · Felix Arntz · Fernando Perrella · Fernando Tellado · Filippo Di Trapani · fiocavallari · firdaus666 · Florence ANDROLUS · Francisco Leiton · Francisco Vera · Ga Satrya · Gabor Lippert · Gajendra Singh · galaxor · galois44 · Gareth Elwell · Garrett Hyder · Gary Jones · Gary Pendergast · Gaurang Sondagar · Gautam Garg · Gautam Mehta · Gaël Bonithon · Generosus · George Mamadashvili · George Vasiliades · Germán · gierand · gilmoursa · Glen Davies · Gopal Krishnan · Greg Ziółkowski · gregbenz · griffithchen · gschoppe · gubser · Guillaume G. · Gulamdastgir Momin · gusgomezpg · Gustavo Hilario · H. Adam Lenz · Habibur Rahman · hanneslsm · Hans-Gerd Gerhards · Hareesh S · Harish Tewari · harshbhonsle08 · Hasmukh Khemchandbhai Mistry · Hasnain Ashfaq · Haz · Henrique Iamarino · Hidekazu Ishikawa · Hilay Trivedi · Himanshu Pathak · Hit Bhalodia · Hrohh · Hugo · humanify · Huzaifa Al Mesbah · Héctor Prieto · iamchughmayank · iamraju · ianmjones · Ibrahim Riaz · iflairwebtechnologies · Indira Biswas · Iqbal Hossain · irozum · Isabel Brison · Ishika Bansal · Ishita · itsdavidmorgan · Jacob Smith · Jacopo Marrone (@tresorama) · Jadav Sanjay · Jake Spurlock · jakeparis · jakub300 · James · James Giroux · James Koster · James LePage · James Monroe · Jamie Burchell · Jamie Dąbrowiecki · janpaulkleijn · Jarda Snajdr · jarekmorawski · jarodortegaaraya · Jason Adams · Jason Kenison · Jason Kytros · Jason LeMahieu (MadtownLems) · Javier Arce · Javier Casares · javorszky · Jay McPartland · Jaydip · Jean-Baptiste Audras · Jean-Sébastien Mansart · Jeff Chi · Jeffrey Carandang · Jeffrey de Wit · Jeffrey Paul · jeflopo · Jenny Dupuy · Jeremy Felt · Jeremy Herve · Jeremy Ward · jeryj · Jessica Lyschik · jigangz · Jigar Bhanushali · Jigar Kahar · Jigar Panchal · Jignesh Bhavani · jillq · jimgrey · Jina Parekh · JiveDig · Jiwoon Kim · jjlmoya · jnbg · Job a11n · Joe Dolson · Joe Fusco · Joe Hoyle · Joe Maller · Joe McGill · Joen Asmussen · Johannes Jülg · John · John Blackbourn · John Hooks · John James Jacoby · John Parris · John Watkins · Jon Surrell · Jonathan Bossenger · Jonathan Desrosiers · Jonny Harris · Joost de Valk · jordesign · Jorge Costa · Jos Velasco · Jose Varghese · Joseph Scott · Josh · Joshua Dwire · Joshua Wold · joshualipstone · Juanfra Aldasoro · JuanMa Garrido · Julie Moynat · Juliette Reinders Folmer · Justin Tadlock · K. Adam White · Kamran Abdul Aziz · Kamrul Hasan · kannanravi · Kapil Paul · Karan Makani · Karin Christen · Karthick · Karthikeya Bethu · katag9k · Kathryn Presner · Kausar Alam · Kaushik Domadiya · Kavit Trivedi · Kavya Gokul · Kelly Choyce-Dwan · Kelly Hoffman · keoshi · Kerry Liu · Kevin Fodness · Kevin Robles Gamboa · Khokan Sardar · Khokan Sardar · Khushal Sain S · Khushi Patel · Kim Coleman · Kira Schroder · KJ Roelke · Kjell Reigstad · Kleis Auke Wolthuizen · Knut Sparhell · Koen Van den Wijngaert · KokkieH · Konstantin Obenland · Kostas Vrouvas · Krupa Nanda · Krystian · kuber · kubiq · Kushagra Goyal · Kyle Mott · l1onofjudah · Lakshyajeet Singh Goyal · Lance Willett · landwire · leemon · Lena Morita · levinmedia · Liaison · Lisa Canini · Lisa Schuyler · LOOS · Louis Wolmarans · Lucas Mendes · lucasbustamante · Lucian R. · Ludwig You · Luigi Teschio · Luis Martins · luisdavid01 · luisherranz · luismulinari · Luke Carbis · luksusspokoju · Madhavi Shah · madhazelnut · Madhu Dollu · Maggie Cabrera · Mahammad Darvishov · MahdiAli Khanusiya · Mahesh Patel · Mainul Hassan · Mainul Kabir Aion · Makarand Mane · maksymmamontov · Malay Ladu · manfcarlo · Manhar Barot · Manish Dhorepatil · Manuel Camargo · Manzoor Wani · Marc · Marcin Dudek · Marco Ciampini · marcs0h · Marcus · Marcus Kazmierczak · Marin Atanasov · Mario Santos · Marius L. J. · Mariusz Szatkowski · Mark Howells-Mead · Mark Uraine · Marko Ivanovic · martin.krcho · Marty Helmick · Mary Hubbard · Maryam Sultana · Mateus Machado Luna · mathijsvdbeek · Matias Benedetto · Matias Ventura · Matt Galdino · Matt Mullenweg · Matt Shaw · mattbolt · Matthew Boynes · Max Schmeling · maximebj · Mayank Tripathi · Md Abul Bashar · MD ISMAIL · Md Rashedul Islam Chowdhury (Ric) · Md. Aminul Islam · mdviralsampat · Mehraz Morshed · mehtadev · Mehul Gohil · mgol · Micha? Dudak · Michael · Michael Adams (mdawaffe) · Michael Etokakpan · Michael Iseard · Michael James Ilett · Michal Iwanow · Miguel Fonseca · Miguel Lezama · Miguel Torres · Mikael Korpela · Mike Jolley · Mike Selander · Mikey Binns · Mikin Chauhan · Milana Cap · Milind More · mimi · Minal Diwan · Mir Monoarul Alam · Miroku · Mitchell Austin · Mohammad Jangda · Mohammad Risad · Mohammad Rockeybul Alam · Mohammed Kateregga · Mohammed Noumaan Ahamed · Mohd Salman · Mohit Sharma · Moksha Shah · Monzur Alam · Moses Cursor Ssebunya · Mostafa Abdelbari · mrkenobi · mrwweb · Mukesh Panchal · Mukesh Parihar · Mustafa Bharmal · mutuajose · Nabhishek Singh · nadabulija · Naman Khare · NANI SAMIREDDY · Naresh Bheda · Nate Finch · Nathan Rodrigues · Nawazkhan Pathan · Nazmul Asif · Nazmul Hosen · Nebojša Jurčić · Ned Zimmerman · nendeb · Nick Diego · Nick Halsey · Nick Murray · nickpagz · nickthegeek · nicolasalarconrapela · nicsevic · Nik Tsekouras · Nikul Valani · Nikunj Hatkar · Nilambar Sharma · Nilesh Shiragave · Niluthpal Purkayastha · Nimesh · Nirav Sherasiya · Noah Allen · Noelle Ackermann · Noruzzaman · notnownikki · obliviousharmony · oldenwilde · Olga Gleckler · OllieJones · Omar Alshaker · onetrev · Ov3rfly · Ozgur Sar · Paal Joachim Romdahl · Pablo Honey · Pamela Ribeiro · pankaj.sakaria · Parin Panjari · Parth Jogi · Parth vataliya · Pascal Birchler · Patrick Lumumba · patrickwclanden · Paul Bearne · Paul Biron · Paul Kevan · paulgibbs · Paulo Trentin · Pavan Patil · pavelevap · pavloborysenko · Pedro Figueroa · Peter Wilson · petermolnar · petitphp · Phil Johnston · philhoyt · physalis · Pieterjan Deneys · Piyush Patel · poligilad · pontocinza · Pooja Kakkad · porg · postphotos · Prachi Garg · Pradeep Pasam · Praful Patel · prajapatvishnu · Pranjal Pratap Singh · pranjal4804 · Prasad Karmalkar · Prashant Baldha · Prathamesh Bhagat · Pratik Jain · Pratik Nawkar · Pravin Karmur · Prem Tiwari · Presskopp · Priyanka Gusani · ProjektIsle · Q · Rachel · Rafael Della · Rafael Funchal · Rafał Gazda · Rafie Muhammad · Rahul Kumar · Rahul Tank · Rajdip Tank · Rajesh C · Rajin Sharwar · Rakeesh Falke · Rami Yushuvaev · Ramon Corrales · Ramon James · Rashed Hossain · Ravi Chudasama · Ravi Gadhiya · Ravi Khadka · Rejaul Alom Khan · Renatho · reneyap · Ressl · retrofox · Rezwan Shiblu · Riad Benguella · Rian Rietveld · Rich Tabor · Rinkal Pagdar · Rishabh Gupta · Rishit Gupta · RITHESH S · Ritoban · Robeen · Robert Anderson · Robert Ghetau · Robert Jolly · robertabela · Roberto Aranda · Rodrigo Primo · Rohit Mathur · Rolf Allard van Hagen · Rolle Laukkarinen · Rolly Bueno · ronakganatra9 · Roshni Ahuja · Rudy Faile · Rushikesh More · Rutvik Savsani · Ruud · Ryan · Ryan Welcher · Saad Ur Rehman · Sabbir Ahmed · Sabbir Hossain · SACHINRAJ CP · Sagar Deshmukh · Sagar Jadhav · SAHIL NAZIR · Saiful Islam · Sainath Poojary · Sajjad Hossain Sagor · Saksham Sharma · Sam · Sampat Viral · Sana Yasir · Sandip Sinh · sandipmaurya2611 · SAndrew · Sanket Parmar · Sanyogg Shelar · Sarah Norris · Sarath E · Sarosh Aga · Sarthak Nagoshe · Saul Fougnier · saulirajala · Saulius Vikerta · Saulo Padilha · Saxon Fletcher · Scott Kingsley Clark · Scott Reilly · Sergey Biryukov · Seth Rubenstein · Shail Mehta · Shailesh Gajare · Shameem - a11n · Shane Muirhead · Shashank Shekhar · Shatrughan Myatra · shaunandrews · Shazzad Hossain Khan · shekharnwagh · Sheri Grey · Shreya Shrivastava · Shreyas Ikhar · Sidhant Tomar · siliconforks · Simon Duduica · Simon Wämmerfors · simonhammes · slackticus · Slava Abakumov · slywy · smerriman · Sneha Patil · Snehal Kashid · Soham Patel · Sonali Prajapati · Sorin · Sourav Pahwa · Soyeb Salar · spacergif · speedwheel · Sphere Plugins · sruthi89 · SteelWagstaff · Stefan Pasch · Stefan Velthuys · Stephanie Walters · Stephen Bernhardt · Steve Dufresne · Steve Jones · Steven Lin · Steven Ryan · strarsis · styankov · Sukhendu Sekhar Guria · Sumit Bagthariya · Sumit Singh · Suryakant Upadhyay · Swanand M · swapnil1010 · Sybre Waaijer · Synchro · szandman · Sérgio Gomes · Sören Wünsch · Taco Verdonschot · tainacan · Taisa - Raquel García Arévalo · Takashi Irie · Takashi Kitajima · Takshil Kunadia · Tammie Lister · tbclark3 · Terence Eden · Tetsuya Imamura · thelmachido a11n · thinkaquamarine · This Is My URL · threadi · Thrive Engine · tibi.buzdugan · Tim Nicholson · Timi Wahalahti · Timothy Jacobs · Tobias Bäthge · Tobias Zimpel · tobifjellner (Tor-Bjorn “Tobi” Fjellner) · Tom Rhodes · Tomoki Shimomura · Tonya Mork · Toro_Unit (Hiroshi Urabe) · TorontoDigits · tpaw · tratnikm · Troy Chaplin · Tung Du · Tushar Bharti · Tushar Patel · Ugyen Dorji · Umesh Nevase · up1512001 · upadalavipul · Utsav Ladani · Vara Rahul Rajana · Vedansh Mishra · Vedant Ere · Vedant Gandhi · Velda · vgnavada · Vicente Canales · Viktor Szépe · Vincent Bodart · Vinit · Vishit Shah · vishnu prajapat · vivekawsm · vortfu · Vraja Das · Vrishabh Jasani · w3bdsgn · WebMan Design | Oliver Juhas · webVerts · Weston Ruter · whaze · Will Skora · williampatton · wolf45 · wongjn · WPExplorer · wpsoul · xate · Xavier Borderie · xavilc · xerpa43 · Xristopher Anderton · Yan · Yash Jawale · Yogesh Bhutkar · Yui · Yuliyan Slavchev · Yusuf Mudagal · Zebulan Stanphill · Znuff

More than 20 locales have fully translated WordPress 7.1 into their language making this one of the most translated releases ever on day one. Community translators are working hard to ensure more translations are on their way. Thank you to everyone who helps make WordPress available in 200+ languages.

Last but not least, thanks to the volunteers who contribute to the support forums by answering questions from WordPress users worldwide.

Get involved

Participation in WordPress goes far beyond coding. And learning more and getting involved is easy. Discover the teams that come together to Make WordPress and use this interactive tool to help you decide which is right for you.

WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately.

You can update to WordPress 7.0.4 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support automatic background updates will begin updating shortly.

For more information, please visit the WordPress 7.0.4 HelpHub site.

Security update included in this release

The security team would like to thank the team at pwn.ai for responsibly reporting the following vulnerability and allowing it to be fixed in this release:

• Authenticated Author+ remote code execution via malicious file upload on sites that use Imagick and Ghostscript.

Backports

As a courtesy, these fixes are being backported through to the 4.7 branch and the 7.1 RC3 release that’s due later today. As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

CVE and GHSA references

Further details can be found in the advisory: CVE-2026-65640 / GHSA-8vr3-7mxf-gx8w.

Thank you to these WordPress contributors

This release was led by John Blackbourn, with significant input from Dennis Snell and Jeremy Felt. In addition, WordPress 7.0.4 and its backports would not have been possible without the valuable contributions of the following people:

Aaron D. Campbell, Aaron Jorbin, Adam Silverstein, Aki Hamano, Alex Concha, Barry, Dennis Snell, Ehtisham Siddiqui, Jeremy Felt, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Lance Willett, Marin Atanasov, Mohammad Jangda, Sergey Biryukov, vortfu, Weston Ruter, and representatives from WP Engine.

WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.

You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support automatic background updates will begin updating shortly.

For more information, please visit the WordPress 7.0.3 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release:

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai.
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by N05ec@LZU
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by Omar Hasan
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

Backports

As a courtesy, these fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

WordPress 7.1 RC2 has also been released, containing all applicable fixes.

CVE and GHSA references

Details of the login screen XSS vulnerability can be found in the advisory: CVE-2026-64638 / GHSA-52p2-r8wf-jcrf.

Thank you to these WordPress contributors

This release was led by John Blackbourn. In addition to the security researchers mentioned above, WordPress 7.0.3 and its backports would not have been possible without the significant contributions of the following people:
Aaron D. Campbell, Aaron Jorbin, Adam Silverstein, adrianmoldovanwp, Aki Hamano, Alex Concha, Andrew Duthie, Andrew Serong, annezazu, Barry, Bernie Reiter, Daniel, Daniel Richards, David Biňovec, Dennis Snell, Ehtisham Siddiqui, Erwan Le Rousseau, Fabian Kaegy, fiocavallari, George Mamadashvili, gubser, Isabel Brison, Jarda Snajdr, Jb Audras, Jeremy Felt, Joe Dolson, Joe Hoyle, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Khokan Sardar, Lance Willett, lucasbustamante, lucatume, Marco Ciampini, Marin Atanasov, Mohammad Jangda, Mukesh Panchal, Paul Kevan, Peter Wilson, ramonopoly, SergeyBiryukov, vortfu, Weston Ruter

This version of the WordPress software is still under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it’s recommended to evaluate RC1 on a test server and site.

WordPress 7.1 RC1 can be tested using any of the following methods:

The scheduled final release date for WordPress 7.1 is August 19, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

Please continue checking the Make WordPress Core blog for 7.1-related posts in the coming weeks for more information.

What’s in WordPress 7.1 RC1?

WordPress 7.1 RC1 contains more than 145 updates and fixes since the Beta 4 release, including 57 in the Editor and 88 in Core.

For an overview of what’s new in WordPress 7.1, read the Beta 1 announcement and the WordPress 7.1 Dev Notes. For a comprehensive summary, see the WordPress 7.1 Field Guide.

You can also explore the technical details of all issues addressed since Beta 4 using the links below:

• GitHub commits for 7.1 since July 29, 2026
• Closed Trac tickets for 7.1 since July 29, 2026

New Features since Beta 1

• Icons API: New APIs for registering icons and icon collections in Core, ready for plugins to extend.
• Speculative loading configuration: Speculative loading defaults can now be configured via environment variables and constants.
• Email notifications for @mentions: Email notifications have been introduced when mentioned in a Note.
• Shareable Revisions: Share links to specific revisions for faster collaboration.

Want to look deeper into the details and technical notes for this release? These tickets and pull requests are just some of the latest updates:

• #GB-79839: Apply globally: choose which modified block styles to apply
• #GB-80814: New responsiveEditingEnabled editor setting to hide responsive styles
• #GB-80107: Tabs: toolbar buttons to reorder tabs
• #GB-80046: DataViews: shift-click range selection
• #65636: Preload REST API requests fetched on editor load
• #65613: Notes are excluded from comment feed queries
• #65491: KSES allows the autofocus attribute on dialog elements
• #65517: Multisite upload limits are enforced when sideloading media from a URL
• #62757: Update the jQuery UI library to version 1.14.2

How you can contribute

WordPress is open source software made possible by a passionate community of people collaborating on and contributing to its development. The resources below outline various ways you can help the world’s most popular open source web platform, regardless of your technical expertise.

Get involved in testing

Testing for issues is crucial to the development of any software. It’s also a meaningful way for anyone to contribute. 

Your help testing the WordPress 7.1 RC1 version is key to ensuring that the final release is the best it can be. While testing the upgrade process is essential, trying out new features is equally important. This detailed guide will walk you through testing features in WordPress 7.1.

Update your theme or plugin

For plugin and theme authors, your products play an integral role in extending the functionality and value of WordPress for all users.

Thanks for continuing to test your themes and plugins with the WordPress 7.1 beta releases. With RC1, you’ll want to conclude your testing and update the “Tested up to” version in your plugin’s readme file to 7.1.

If you find compatibility issues, please post detailed information to the support forum.

Test on your hosting platforms

Web hosts provide vital infrastructure for supporting WordPress and its users. Testing on hosting systems helps inform the development process while ensuring that WordPress and hosting platforms are fully compatible, free of errors, optimized for the best possible user experience, and that updates roll out to customer sites without issue.

Want to test WordPress on your hosting system? Get started with configuring distributed hosting tests here. Thank you to all web hosts who help test WordPress!

Curious about testing releases in general? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

An RC1 haiku

A candidate stands
the desert sun tests its strength
Arizona waits

Props to @krupajnanda, @annezazu,
@amykamala, @wildworks and @masteradhoc for collaboration and review

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

How to Test WordPress 7.1 Beta 4

You can test WordPress 7.1 Beta 4 in any of the following ways:

The scheduled final release date for WordPress 7.1 is August 19, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

Find out what’s new in WordPress 7.1: Read the Beta 1 announcement for details and highlights.

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.1 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

What’s in WordPress 7.1 Beta 4?

WordPress 7.1 Beta 4 contains more than 114 updates and fixes since the Beta 3 release, including 51 in the Editor and 63 in Core. 

Each beta cycle focuses on bug fixes, and more are on the way with your help through testing. You can browse the technical details for all issues addressed since Beta 3 using these links:

• GitHub commits for 7.1  since July 22, 2026
• Closed Trac tickets for 7.1 since July 22, 2026

Beta 4 brings a round of fixes that make the editor smoother to work with. Notes now stay reliably tied to the passage they refer to, and tagged people are displayed cleanly and clearly.

A Beta 4 haiku

Testers lend their eyes,
edge cases hide in plain sight—
Patch, rebuild, refine.

Props to @krupajnanda for preparing this post and @annezazu, @wildworks, @amykamala for proofreading and review.

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

How to Test WordPress 7.1 Beta 3

You can test WordPress 7.1 Beta 3 in any of the following ways:

The scheduled final release date for WordPress 7.1 is August 19, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

Find out what’s new in WordPress 7.1: Read the Beta 1 announcement for details and highlights.

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.1 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

What’s in WordPress 7.1 Beta 3?

For technical details on the more than 71 issues addressed since Beta 1, see the following links:

• Closed 7.1 WordPress Core Trac tickets since July 15, 2026
• 7.1 Gutenberg commits since July 15, 2026

Note: Beta 2 was released on July 17, 2026, as part of the WordPress 7.0.2 release and includes important security fixes.

Beta 3 introduces two improvements to styling.

Applying local style changes globally is no longer an all-or-nothing action. The Apply globally option in the block inspector now opens a quick review step, allowing you to choose which modified styles to apply globally while keeping the rest as local overrides.

Other notable fixes include improvements to media uploads: long animated GIF uploads no longer hang, images rotated using EXIF metadata are processed correctly, and uploading a single HEIC image in Safari no longer creates two entries.

The editor also includes additional fixes for Notes, responsive styling, and custom CSS. For developers, WordPress Coding Standards has been updated to version 3.4.0.

Unicode email address support will not be included in WordPress 7.1. The work will continue in a community plugin, allowing broader testing of compatibility, security, and data-handling considerations.

A Beta 3 haiku

Fresh bugs surface now,
click by click, we chase them down—
codebase grows steady.

Props to @krupajnanda, @annezazu,
@wildworks, @amykamala for proofreading and review.

The 7.0.2 security release addresses one critical and one high severity security issue.

Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.

To manually update you can visit your WordPress Dashboard, click “Updates”, and then click “Update Now”, or you can download WordPress 7.0.2 from WordPress.org. On sites that support automatic background updates, the update process will begin automatically.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release:

• A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber

For more information on this release, please visit the HelpHub site.

Backports

• WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released containing fixes for both.
• WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released containing a fix.
• The beta release of WordPress 7.1 is affected by both vulnerabilities. Version 7.1 beta2 has been released containing fixes for both.
• Versions of WordPress prior to 6.8 are not affected.

CVE and GHSA references

• CVE-2026-60137 / GHSA-fpp7-x2x2-2mjf
• CVE-2026-63030 / GHSA-ff9f-jf42-662q

Thank you to these WordPress contributors

This release was led by John Blackbourn and Barry Abrahamson. In addition to the security researchers mentioned above, WordPress 7.0.2 would not have been possible without the significant contributions of the following people: Aaron Jorbin, Alex Concha, annezazu, Barry, David Baumwald, Dominik Schilling, Ehtisham Siddiqui, Joe Dolson, Joe Hoyle, John Blackbourn, Jonathan Desrosiers, Marius L. J., Matt Mullenweg, Mohammad Jangda, Peter Wilson, Sergey Biryukov, vortfu, Weston Ruter, plus representatives from Altis, Automattic, Bluehost, Cloudflare, GoDaddy, Hostinger, and WP Engine.