CVS commit: [pkgsrc-2026Q3] pkgsrc/www/wordpress

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 09:35:24 UTC 2026

Modified Files:
        pkgsrc/www/wordpress [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7345 - requested by taca
www/wordpress: Security fix

Revisions pulled up:
- www/wordpress/Makefile                                        1.126
- www/wordpress/distinfo                                        1.106

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Wed Nov  4 15:54:18 UTC 2026

   Modified Files:
        pkgsrc/www/wordpress: Makefile distinfo

   Log Message:
   www/wordpress: update to 7.0.8

   7.0.8 (2026-10-28)

   * An Editor+ stored cross-site scripting (XSS) issue in the personal data
     erasure requests screen reported by Anthropic

   * A Contributor+ stored cross-site scripting (XSS) issue via whitespace in
     block delimiters reported by Rafie Muhammad (Awesome Motive, Inc.)

   * An information disclosure issue exposing unpublished Customizer changes to
     unauthenticated visitors reported by Antonio Lorensius Silaban

   * A hardening fix for unescaped usernames on the multisite Network Users
     screens reported by Anthropic

   * A permissions issue letting custom roles that moderate comments read, edit
     and delete notes on posts they can’t edit reported by Ramon of the
     WordPress Security Team

   * A race condition during core updates that could lead to remote code
     execution reported by Umut Bayram

   * A Contributor+ issue in Interactivity API bindings that lets object
     elements load admin pages reported by rekter0

   * A Contributor+ stored cross-site scripting (XSS) issue in Customizer
     selective refresh reported by Rafie Muhammad (Awesome Motive, Inc.)

   * A Contributor+ stored cross-site scripting (XSS) issue via javascript:
     URLs in Interactivity API bindings reported by Luis Herranz and multiple
     independent reporters

   * A Contributor+ stored cross-site scripting (XSS) issue in the labels of
     the Comments Pagination and Post Navigation Link blocks reported by Alex
     Concha of the WordPress Security Team

   * An issue allowing post content to shadow Script Module data with a
     matching element ID reported by Weston Ruter

   * A cross-site scripting (XSS) issue in the Categories block via format
     string injection reported by Ben Bidner

   * A hardening fix for unsafe preg_replace() replacements in the Image and
     Playlist blocks reported by Ben Bidner of the WordPress Security Team

   * A Contributor+ stored cross-site scripting (XSS) issue via Interactivity
     API event handler bindings reported by Jon Surrell

   * An Author+ stored cross-site scripting (XSS) issue in the Interactivity
     Router via uploaded text files reported by Anas cherni

   * A Contributor+ stored cross-site scripting (XSS) issue via prototype
     pollution in Interactivity API context namespaces reported by rekter0

   * Contributor+ stored cross-site scripting (XSS) and denial of service
     issues in Interactivity API bindings reported by rekter0, Marcel Karlsson
     (whoismarcel), Jon Surrell and Alex Concha of the WordPress Security Team

   * An update to the bundled root certificates due to the eMudhra revocation.


To generate a diff of this commit:
cvs rdiff -u -r1.122.2.2 -r1.122.2.3 pkgsrc/www/wordpress/Makefile
cvs rdiff -u -r1.103.2.2 -r1.103.2.3 pkgsrc/www/wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/wordpress/Makefile
diff -u pkgsrc/www/wordpress/Makefile:1.122.2.2 pkgsrc/www/wordpress/Makefile:1.122.2.3
--- pkgsrc/www/wordpress/Makefile:1.122.2.2     Wed Oct 21 00:22:08 2026
+++ pkgsrc/www/wordpress/Makefile       Wed Nov 11 09:35:24 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.122.2.2 2026/10/21 00:22:08 maya Exp $
+# $NetBSD: Makefile,v 1.122.2.3 2026/11/11 09:35:24 maya Exp $
 
 DISTNAME=              wordpress-${VERSION}
 PKGNAME=               ${PHP_PKG_PREFIX}-${DISTNAME}
-VERSION=               7.0.7
+VERSION=               7.0.8
 CATEGORIES=            www
 MASTER_SITES=          https://wordpress.org/
 

Index: pkgsrc/www/wordpress/distinfo
diff -u pkgsrc/www/wordpress/distinfo:1.103.2.2 pkgsrc/www/wordpress/distinfo:1.103.2.3
--- pkgsrc/www/wordpress/distinfo:1.103.2.2     Wed Oct 21 00:22:08 2026
+++ pkgsrc/www/wordpress/distinfo       Wed Nov 11 09:35:24 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.103.2.2 2026/10/21 00:22:08 maya Exp $
+$NetBSD: distinfo,v 1.103.2.3 2026/11/11 09:35:24 maya Exp $
 
-BLAKE2s (wordpress-7.0.7.tar.gz) = 7f522b768f11ddec8f7436de99602b0e8689a5945ac8cfecd544bf715186d9a8
-SHA512 (wordpress-7.0.7.tar.gz) = d14a33ceb5b2a7fcfe1d2db6e2becac4395664965051903a0819fd1923c6b78e397e96c9246fca2815207950a288fc4ab125316e8c7b3b140aca7d4119cef4e0
-Size (wordpress-7.0.7.tar.gz) = 29557971 bytes
+BLAKE2s (wordpress-7.0.8.tar.gz) = def10c1e1a33658037515972ae482754201f8ab885b98c7f8d57534601199e25
+SHA512 (wordpress-7.0.8.tar.gz) = 501ffb6f81c714c3c0adc4eff40f827b7691965ec320ab627179c743fe348d0a5f2c985763915bab032be4b0fb15f0301a1315bab39886d1d1a00a05ae742447
+Size (wordpress-7.0.8.tar.gz) = 29548324 bytes