#38261
|
A FORCE_SSL_SCRIPTS constant
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
06/04/2019
|
#57304
|
Add SensitiveParameter attribute to DB connection and login variables
|
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
02/28/2023
|
#37757
|
Add `allowed_classes` to `maybe_unserialize` When WordPress is running on PHP 7+
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
09/13/2017
|
#57875
|
Add password strength meter for password protected content
|
|
|
normal
|
normal
|
Future Release
|
enhancement
|
06/01/2023
|
#52639
|
Add proper Security Attributes to the Cookies set by WordPress
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
06/20/2022
|
#23165
|
Admin validation errors on form nonce element IDs (_wpnonce)
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
02/08/2021
|
#58636
|
Automatic Sanitization of Nonces in wp_verify_nonce
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
06/26/2023
|
#56785
|
Automatically catch potential security issues before release
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
10/11/2022
|
#39656
|
Create a submenu item under About admin bar for security
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
01/23/2017
|
#56160
|
Deprecate wp_sanitize_redirect
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
07/09/2022
|
#53296
|
Do trim $hook_name within add_action() and add_filter() function
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
05/29/2021
|
#40237
|
Educate users about modern password best-practices
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
06/06/2022
|
#56141
|
Enhance installer security
|
|
dev-feedback
|
high
|
major
|
Future Release
|
enhancement
|
09/09/2023
|
#51611
|
Escape echoing Core functions
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
10/24/2020
|
#43320
|
Harden API requests against man-in-the-middle attacks
|
|
|
low
|
minor
|
Awaiting Review
|
enhancement
|
02/18/2018
|
#50510
|
Improve security of wp_nonce implementation
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
07/11/2023
|
#44058
|
Include security sniffs in PHPCS ruleset
|
|
|
normal
|
normal
|
Future Release
|
enhancement
|
05/16/2018
|
#51159
|
Let's expand our context specific escaping methods for wp_json_encode().
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
08/27/2020
|
#36087
|
Migration plan from insecure RNG fallback
|
|
|
normal
|
normal
|
Future Release
|
enhancement
|
09/30/2020
|
#52544
|
Removing database tables allows anyone to take over all website files
|
|
|
normal
|
major
|
Awaiting Review
|
enhancement
|
07/05/2022
|
#57424
|
Specific hook for Content Security Policy
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
01/05/2023
|
#54512
|
Suggestion for file protection
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
11/25/2021
|
#37000
|
Support for the SameSite cookie attribute
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
enhancement
|
11/11/2022
|
#29429
|
Support frame-ancestors directive over X-Frame-Options
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
enhancement
|
07/29/2019
|
#38262
|
Task: Opt in SSL Improvements
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
02/05/2020
|
#51438
|
Use CSP directive upgrade-insecure-requests when using HTTPS
|
|
needs-unit-tests
|
normal
|
normal
|
Future Release
|
enhancement
|
11/09/2021
|
#52388
|
Use HTTPS URL already during installation if supported
|
|
needs-unit-tests
|
normal
|
normal
|
Future Release
|
enhancement
|
01/28/2021
|
#21022
|
Use bcrypt for password hashing; updating old hashes
|
|
dev-feedback
|
normal
|
major
|
Future Release
|
enhancement
|
05/08/2023
|
#55067
|
Use of undefined constant ABSPATH - assumed 'ABSPATH' as of WP5.9
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
06/12/2023
|
#47440
|
add_header X-Frame-Options
|
|
close
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
05/31/2019
|
#36177
|
default htaccess should include security measures
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
11/09/2021
|
#58765
|
the_block_template_skip_link() - XSS vulnerability - Apply FIX
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
07/08/2023
|
#56335
|
use hash_equals to check password hash
|
|
close
|
normal
|
trivial
|
Awaiting Review
|
enhancement
|
10/12/2022
|
#54280
|
wp_verify_nonce should return a filter
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
10/17/2021
|
#37604
|
'Password Lost/Changed' emails should give indication of the strength of the new password
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
feature request
|
04/09/2018
|
#55514
|
2FA by default for WordPress
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
03/06/2023
|
#43215
|
Allow wp_kses to pass allowed CSS properties
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
02/02/2018
|
#20140
|
Ask old password to change user password
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
feature request
|
06/04/2019
|
#53902
|
Automating the creation of inline javascript and inline stylesheet nonces or hashes
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
01/03/2022
|
#30465
|
Dashboard alert if a plugin/theme was removed from WordPress repo
|
|
dev-feedback
|
normal
|
normal
|
6.5
|
feature request
|
09/18/2023
|
#55950
|
FIDO passwordless authentication?
|
|
|
normal
|
minor
|
Awaiting Review
|
feature request
|
06/08/2022
|
#38536
|
Hook/Function to Set Content-Security-Policy
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
06/04/2019
|
#55228
|
Provide Option to Remove Password Visibility Button and Dashicons from WordPress' Login Form
|
|
close
|
normal
|
normal
|
Awaiting Review
|
feature request
|
02/25/2022
|
#32067
|
Remove inline javascript from WP-Core to allow CSP protection
|
|
|
normal
|
normal
|
Future Release
|
feature request
|
09/28/2020
|
#50613
|
disable update for themes e plugin
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
07/09/2020
|
#50437
|
Add leniency to the overdue check for plugin and theme auto updates
|
|
|
normal
|
normal
|
Future Release
|
task (blessed)
|
07/14/2020
|
#25435
|
Introduce alternative to do_shortcode( '[shortcode]' )
|
rmccue
|
has-patch
|
normal
|
normal
|
Future Release
|
feature request
|
09/27/2017
|
#50683
|
Parse content for shortcodes instead of using regex
|
johnbillion
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
10/07/2021
|
#45929
|
Potential assignment to empty string
|
joedolson*
|
has-patch
|
normal
|
normal
|
6.4
|
defect (bug)
|
08/24/2023
|
#47616
|
Enhancement: doing_shortcode() function similar to doing_filter()
|
audrasjb*
|
needs-unit-tests
|
normal
|
normal
|
Future Release
|
enhancement
|
11/09/2021
|
#47863
|
Fix odd, unexpected output from shortcode_parse_attts
|
SergeyBiryukov
|
dev-feedback
|
normal
|
normal
|
Future Release
|
defect (bug)
|
02/24/2020
|
#58469
|
Changeset 55832 broke shortcodes saved in block attributes and rendered serverside
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
06/07/2023
|
#33134
|
Complex Nested Shortcodes Inside of Attributes Are Not Processed Left-to-Right
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
#49877
|
Content enclosed by (content enclosing) shortcode gets stripped from excerpt
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
07/24/2020
|
#51377
|
Front End elements break after too many shortcodes
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
09/24/2020
|
#43725
|
Multiple instances of opening / closing shortcode only works when closing tag is provided
|
|
|
normal
|
normal
|
Future Release
|
defect (bug)
|
07/16/2020
|
#24990
|
Nested Shortcode Inside [caption]
|
|
needs-unit-tests
|
normal
|
normal
|
|
defect (bug)
|
05/08/2021
|
#37183
|
Nested shortcodes in new-style [caption]
|
|
dev-feedback
|
normal
|
normal
|
|
defect (bug)
|
05/08/2021
|
#57790
|
Parsing of Shortcode Attributes: bug locating a final attribute
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
02/28/2023
|
#34814
|
Presence of "Less than sign" < adds additional closing shortcode tag.
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
#35216
|
Return empty string from wp.shortcode.replace() callback is ignored
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
06/27/2018
|
#37238
|
Right-aligned captions with embedded iframes get removed in Visual mode
|
|
|
normal
|
normal
|
|
defect (bug)
|
04/19/2019
|
#35591
|
Shortcode Attributes Parsing Issue
|
|
reporter-feedback
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
#58366
|
Shortcode Support Regained but Content Filters are messing with Shortcode HTML
|
|
needs-unit-tests
|
normal
|
normal
|
6.4
|
defect (bug)
|
09/08/2023
|
#49955
|
Shortcode escaping not correctly handled when followed by enclosing shortcodes
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
07/16/2020
|
#58386
|
Shortcode generated by a block element is not executed in templates
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
06/09/2023
|
#38713
|
Shortcodes and utf-8 no-break whitespace (\xc2\xa0)
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
03/25/2019
|
#43686
|
Shortcodes containing asterisks may create invalid regex breaking the editor
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
defect (bug)
|
01/16/2019
|
#55406
|
Shortcodes don't work inside srcset attribute
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
04/08/2022
|
#58397
|
Shortcodes in patterns are not rendered in templates
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
05/24/2023
|
#52567
|
Shortcodes in separate <p> tags appear on same line in browser
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
05/25/2023
|
#35545
|
Unexpected behavior of wp.shortcode.regexp
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
#45377
|
Video Shortcode Ajax Issue
|
|
|
normal
|
minor
|
Future Release
|
defect (bug)
|
12/06/2018
|
#42718
|
Video shortcode needs muted attribute for Autoplay to work with Safari 11.0.1+
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
07/10/2020
|
#35022
|
WP allows Unicode 0x00a0 spaces in editor but shortcode parser can't handle them
|
|
has-patch
|
normal
|
normal
|
Future Release
|
defect (bug)
|
02/06/2017
|
#25820
|
[embed] shortcode can't be escaped like others
|
|
|
normal
|
minor
|
|
defect (bug)
|
06/04/2019
|
#43456
|
`wp_html_split` <script>
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
03/02/2018
|
#43457
|
`wp_html_split` valid HTML attributes issues
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
03/02/2018
|
#26649
|
escaped shortcodes should not be expanded during 'get_the_excerpt'
|
|
needs-unit-tests
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
#44571
|
force_balance_tags breaks JavaScript
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
07/14/2018
|
#40958
|
force_balance_tags breaks Ninjaforms and probably other plugins that output html within js.
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
06/13/2017
|
#33213
|
has_shortcode spec in 4.3
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
#59249
|
shortcode_parse_atts() result for no attributes does not match the documentation
|
|
dev-feedback
|
normal
|
normal
|
6.4
|
defect (bug)
|
08/30/2023
|
#34983
|
shortcodes not working in input fields
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
#57267
|
wp_enqueue_style is not working under shortcode
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
12/15/2022
|
#6984
|
wpautop() formats the the contents of shortcodes
|
|
|
normal
|
normal
|
Future Release
|
defect (bug)
|
04/01/2019
|
#54289
|
Improve get_shortcode_regex performance
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
10/19/2021
|
#29683
|
Live Preview shortcodes
|
|
|
normal
|
normal
|
|
enhancement
|
02/26/2021
|
#31093
|
Make $tag argument optional for has_shortcode()
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
enhancement
|
10/31/2017
|
#46412
|
Make shortcode attributes case-insensitive? shortcode_parse_atts
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
03/04/2019
|
#29661
|
Should Shortcode Attributes Allow HTML Special Characters?
|
|
|
normal
|
normal
|
|
enhancement
|
06/04/2019
|
#36958
|
extending has_shortcode to allow searching in custom fields
|
|
|
normal
|
normal
|
|
enhancement
|
06/04/2019
|
#35179
|
playlist shortcode needs an option to not loop
|
|
|
normal
|
normal
|
|
enhancement
|
06/04/2019
|
#25644
|
strip_shortcodes always removes text between shortcode tags, should be optional
|
|
dev-feedback
|
normal
|
normal
|
|
enhancement
|
06/04/2019
|
#41086
|
Conditional loading of CSS files from (for example) shortcodes
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
06/16/2017
|
#47984
|
Filter pre_do_shortcode
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
feature request
|
09/05/2019
|
#33593
|
Make shortcodes case insensitive
|
|
dev-feedback
|
normal
|
normal
|
|
feature request
|
06/04/2019
|