|
#45008
|
Inconsistent use of 'script_loader_src' and 'style_loader_src' filters when performing concatenation
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
09/27/2018
|
|
#13078
|
Make wp_register_style and wp_enqueue_style consistent
|
|
has-patch
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
|
#39991
|
jQuery UI Datepicker Localization Error with PHP date 'S'
|
|
has-patch
|
normal
|
normal
|
Future Release
|
defect (bug)
|
10/25/2018
|
|
#63043
|
script-loader 'colors' src true invalid argument
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
03/03/2025
|
|
#52465
|
Allow a relation type in resource hints to be used multiple times
|
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
11/10/2021
|
|
#54018
|
Allow scripts registered via block.json to be enqueued in the footer
|
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
10/16/2025
|
|
#58302
|
Deprecate and disable the unused compression_test() and wp_ajax_wp_compression_test()
|
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
10/19/2025
|
|
#63805
|
Extend the existing conditional loading optimization for block-specific global styles from core blocks to include third-party blocks, improving performance by only loading styles for blocks actually present on the page.
|
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
10/14/2025
|
|
#40602
|
Implement immutable cache headers
|
pbearne
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
02/12/2025
|
|
#63793
|
Parser-blocking scripts should render last in all cases to speed up page load
|
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
08/18/2025
|
|
#60597
|
Script Modules API: Allow list of enqueued module data to be exposed
|
westonruter
|
has-patch
|
normal
|
normal
|
Future Release
|
enhancement
|
10/27/2025
|
|
#36791
|
Set load order when enqueuing scripts and styles
|
|
has-patch
|
normal
|
normal
|
|
enhancement
|
06/04/2019
|
|
#55184
|
Custom style handle attached to a custom block style is never load even if the block is in the page.
|
|
needs-unit-tests
|
normal
|
normal
|
7.0
|
defect (bug)
|
02/12/2026
|
|
#46089
|
Memory exhaustion when setting script translations on `wp-i18n`
|
|
needs-unit-tests
|
normal
|
normal
|
Future Release
|
defect (bug)
|
02/04/2021
|
|
#35963
|
Only remove item from WP_Dependencies::to_do if it was successfully processed
|
|
needs-unit-tests
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
|
#54956
|
[5.9] wp_block_type args - "style" and "script" are always loaded on Frontend
|
|
needs-unit-tests
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
07/19/2022
|
|
#51124
|
Can we get an additional parameter in wp_add_inline_script to set the script type?
|
audrasjb*
|
needs-unit-tests
|
normal
|
normal
|
Future Release
|
feature request
|
08/13/2025
|
|
#64592
|
WP 6.9.1still have issue with load block styles on demand in classic themes
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
02/04/2026
|
|
#55695
|
error on script_loader.php
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
05/07/2022
|
|
#59132
|
Create two filters in wp_scripts() and wp_styles().
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
11/27/2023
|
|
#38054
|
class.wp-scripts.php - add_action when init is already doing
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
04/09/2019
|
|
#41391
|
Links to media in password protected pages
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
07/24/2017
|
|
#63940
|
Prevent POST flood cache bypass attacks
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
09/06/2025
|
|
#53994
|
REST API requests with session cookies but an invalid/missing nonce are considered authenticated for most of the request
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
08/24/2021
|
|
#63259
|
Replace zxcvbn with zxcvbn-ts
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
04/11/2025
|
|
#62134
|
Security Issue in WordPress Core
|
|
|
normal
|
normal
|
|
defect (bug)
|
10/14/2024
|
|
#56860
|
Sodium Compat library is improperly loaded
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
11/19/2024
|
|
#62693
|
check if chmod is available to prevent Fatal Errors
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
12/14/2024
|
|
#58679
|
meta key field in usermeta table should NOT use accent insensitive collations
|
|
|
normal
|
major
|
Awaiting Review
|
defect (bug)
|
08/19/2025
|
|
#57447
|
wp_ajax_inline_save function does not check if post has "public" or "show_ui" enabled
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
01/11/2023
|
|
#62384
|
.htaccess lacks
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
12/09/2024
|
|
#58636
|
Automatic Sanitization of Nonces in wp_verify_nonce
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
06/26/2023
|
|
#40237
|
Educate users about modern password best-practices
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
06/06/2022
|
|
#51611
|
Escape echoing Core functions
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
10/24/2020
|
|
#64481
|
Explore Sec-Fetch Headers as a Core-Supported CSRF Mitigation Mechanism
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
01/08/2026
|
|
#28521
|
FORCE_SSL constant for really forcing SSL
|
adamsilverstein
|
|
normal
|
normal
|
Future Release
|
enhancement
|
11/19/2024
|
|
#43320
|
Harden API requests against man-in-the-middle attacks
|
|
|
low
|
minor
|
Awaiting Review
|
enhancement
|
02/18/2018
|
|
#44058
|
Include security sniffs in PHPCS ruleset
|
|
|
normal
|
normal
|
Future Release
|
enhancement
|
05/16/2018
|
|
#51159
|
Let's expand our context specific escaping methods for wp_json_encode().
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
01/15/2026
|
|
#36087
|
Migration plan from insecure RNG fallback
|
|
|
normal
|
normal
|
Future Release
|
enhancement
|
09/30/2020
|
|
#57424
|
Specific hook for Content Security Policy
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
01/05/2023
|
|
#60470
|
Use `filter_input` instead of superglobals where possible
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
02/09/2024
|
|
#36177
|
default htaccess should include security measures
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
12/24/2024
|
|
#55514
|
2FA by default for WordPress
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
03/06/2023
|
|
#43215
|
Allow wp_kses to pass allowed CSS properties
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
11/19/2025
|
|
#53902
|
Automating the creation of inline javascript and inline stylesheet nonces or hashes
|
|
|
normal
|
normal
|
Awaiting Review
|
feature request
|
07/03/2024
|
|
#32067
|
Remove inline javascript from WP-Core to allow CSP protection
|
|
|
normal
|
normal
|
Future Release
|
feature request
|
10/21/2025
|
|
#64245
|
Update bundled root certificates for 7.0
|
|
|
normal
|
normal
|
7.0
|
task (blessed)
|
11/13/2025
|
|
#62202
|
allow plugin versions to be flagged as security updates
|
|
close
|
normal
|
normal
|
Awaiting Review
|
feature request
|
10/10/2024
|
|
#63727
|
A new function to sanitize an array
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
07/28/2025
|
|
#37757
|
Add `allowed_classes` to `maybe_unserialize` When WordPress is running on PHP 7+
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
04/24/2025
|
|
#56141
|
Enhance installer security
|
|
dev-feedback
|
high
|
major
|
Future Release
|
enhancement
|
08/30/2025
|
|
#62949
|
HttpOnly flag for the post password cookie
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
02/12/2025
|
|
#51407
|
Remove inline event handlers and JavaScript URIs for Strict CSP-compatibility
|
adamsilverstein
|
dev-feedback
|
normal
|
normal
|
Future Release
|
enhancement
|
12/26/2023
|
|
#61706
|
Support for storing and getting encrypted options
|
|
dev-feedback
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
02/18/2025
|
|
#37000
|
Support for the SameSite cookie attribute
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
enhancement
|
06/06/2024
|
|
#38474
|
wp_signups.activation_key stores activation keys in plain text
|
SergeyBiryukov
|
dev-feedback
|
normal
|
normal
|
Future Release
|
enhancement
|
06/20/2025
|
|
#20140
|
Ask old password to change user password
|
|
dev-feedback
|
normal
|
major
|
Future Release
|
feature request
|
07/28/2024
|
|
#30465
|
Dashboard alert if a plugin/theme was removed from WordPress repo
|
|
dev-feedback
|
normal
|
normal
|
Future Release
|
feature request
|
06/11/2025
|
|
#43936
|
Settings: Warn when open registration and new user default is privileged
|
audrasjb*
|
dev-feedback
|
normal
|
normal
|
7.0
|
feature request
|
01/28/2026
|
|
#52333
|
Lack of the : entity on the list of allowed entity names in kses.php
|
|
has-patch
|
normal
|
minor
|
Awaiting Review
|
defect (bug)
|
01/20/2021
|
|
#37264
|
Please do not chmod 666 the wp-config.php file on installation.
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
03/22/2019
|
|
#53869
|
Post type / Taxonomy Label Hardening: Prevent Raw HTML tags in output / Media Library eval of HTML entities in label
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
08/04/2021
|
|
#60864
|
URL sanitizing strips valid characters instead of encoding, documented use is invalid
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
01/04/2026
|
|
#53973
|
WordPress <= 5.8 - Authenticated Persistent XSS (User role name)
|
|
has-patch
|
normal
|
normal
|
Future Release
|
defect (bug)
|
03/12/2025
|
|
#56391
|
safecss_filter_attr(): support rgba background-color
|
|
has-patch
|
normal
|
normal
|
|
defect (bug)
|
07/31/2025
|
|
#56521
|
wp_kses wp_kses_hair fails to allow a valueless attribute when is follwed by /
|
|
has-patch
|
normal
|
major
|
Awaiting Review
|
defect (bug)
|
09/06/2022
|
|
#23165
|
Admin validation errors on form nonce element IDs (_wpnonce)
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
02/08/2021
|
|
#63329
|
Use check_ajax_referer() instead of check_admin_referer() for AJAX requests in media form handling.
|
|
has-patch
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
04/22/2025
|
|
#64063
|
Remove bundled 1024-bit certificates from bundled root certificates
|
|
has-patch
|
normal
|
major
|
7.0
|
task (blessed)
|
02/04/2026
|
|
#51438
|
Use CSP directive upgrade-insecure-requests when using HTTPS
|
|
needs-unit-tests
|
normal
|
normal
|
Future Release
|
enhancement
|
11/09/2021
|
|
#63457
|
WordPress 6.8 will fail creating bcrypt when entropy sources are not available
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
05/18/2025
|
|
#31686
|
wp_authenticate_username_password() should check for a WP_Error object
|
|
reporter-feedback
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
08/06/2019
|
|
#58174
|
A shortcode block that evaluates to nothing, renders as a space in the HTML
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
10/26/2023
|
|
#60887
|
After upgrade to WordPress 6.4.3, do_shortcode no longer works in page templates
|
|
|
normal
|
critical
|
Awaiting Review
|
defect (bug)
|
04/02/2024
|
|
#58469
|
Changeset 55832 broke shortcodes saved in block attributes and rendered serverside
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
06/07/2023
|
|
#33134
|
Complex Nested Shortcodes Inside of Attributes Are Not Processed Left-to-Right
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
|
#43725
|
Multiple instances of opening / closing shortcode only works when closing tag is provided
|
|
|
normal
|
normal
|
Future Release
|
defect (bug)
|
07/16/2020
|
|
#34814
|
Presence of "Less than sign" < adds additional closing shortcode tag.
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
|
#37238
|
Right-aligned captions with embedded iframes get removed in Visual mode
|
|
|
normal
|
normal
|
|
defect (bug)
|
04/19/2019
|
|
#61007
|
Shortcode aren't paste inline in paragraphs
|
|
|
normal
|
major
|
Awaiting Review
|
defect (bug)
|
08/24/2024
|
|
#49955
|
Shortcode escaping not correctly handled when followed by enclosing shortcodes
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
07/16/2020
|
|
#58386
|
Shortcode generated by a block element is not executed in templates
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
06/09/2023
|
|
#38713
|
Shortcodes and utf-8 no-break whitespace (\xc2\xa0)
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
03/25/2019
|
|
#55406
|
Shortcodes don't work inside srcset attribute
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
04/08/2022
|
|
#58397
|
Shortcodes in patterns are not rendered in templates
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
05/24/2023
|
|
#52567
|
Shortcodes in separate <p> tags appear on same line in browser
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
05/25/2023
|
|
#35545
|
Unexpected behavior of wp.shortcode.regexp
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
|
#45377
|
Video Shortcode Ajax Issue
|
|
|
normal
|
minor
|
Future Release
|
defect (bug)
|
12/06/2018
|
|
#25820
|
[embed] shortcode can't be escaped like others
|
|
|
normal
|
minor
|
|
defect (bug)
|
06/04/2019
|
|
#43456
|
`wp_html_split` <script>
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
03/02/2018
|
|
#44571
|
force_balance_tags breaks JavaScript
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
09/22/2024
|
|
#40958
|
force_balance_tags breaks Ninjaforms and probably other plugins that output html within js.
|
|
|
normal
|
normal
|
Awaiting Review
|
defect (bug)
|
02/21/2025
|
|
#33213
|
has_shortcode spec in 4.3
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
|
#34983
|
shortcodes not working in input fields
|
|
|
normal
|
normal
|
|
defect (bug)
|
06/04/2019
|
|
#6984
|
wpautop() formats the the contents of shortcodes
|
|
|
normal
|
normal
|
Future Release
|
defect (bug)
|
04/01/2019
|
|
#46412
|
Make shortcode attributes case-insensitive? shortcode_parse_atts
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
03/04/2019
|
|
#60200
|
Search functionality does not search shortcodes
|
|
|
normal
|
normal
|
Awaiting Review
|
enhancement
|
01/06/2024
|
|
#29661
|
Should Shortcode Attributes Allow HTML Special Characters?
|
|
|
normal
|
normal
|
|
enhancement
|
06/04/2019
|
|
#36958
|
extending has_shortcode to allow searching in custom fields
|
|
|
normal
|
normal
|
|
enhancement
|
06/04/2019
|