wordpress (6.7.2+dfsg1-1.1ubuntu2) resolute; urgency=medium

  * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)

 -- Sebastien Bacher <seb128@ubuntu.com>  Thu, 29 Jan 2026 22:23:01 +0100

wordpress (6.7.2+dfsg1-1.1ubuntu1) plucky; urgency=medium

  * Merge with Debian; remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 20 Feb 2025 13:31:37 +0100

wordpress (6.7.2+dfsg1-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * No change source-upload to enable testing migration.

 -- Niels Thykier <niels@thykier.net>  Sun, 16 Feb 2025 10:06:26 +0000

wordpress (6.7.2+dfsg1-1) unstable; urgency=medium

  * New upstream source
  * Declare explicit need for fakeroot due to non-root:root ownership
    Closes: #1089468

 -- Craig Small <csmall@debian.org>  Fri, 14 Feb 2025 19:35:23 +1100

wordpress (6.7.1+dfsg1-1) unstable; urgency=medium

  * New upstream maintenance release

 -- Craig Small <csmall@debian.org>  Tue, 10 Dec 2024 16:13:58 +1100

wordpress (6.7+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Unconditionally disable WP_AUTO_UPDATE_CORE instead of patching
    everywhere Closes: #987064
  * Themes 2022 removed, 2025 added and made default
  * Add patch for site health status

 -- Craig Small <csmall@debian.org>  Thu, 21 Nov 2024 21:04:09 +1100

wordpress (6.6.2+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Thu, 10 Oct 2024 21:34:15 +1100

wordpress (6.6.1+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Tue, 06 Aug 2024 21:49:12 +1000

wordpress (6.5.5+dfsg1-1) unstable; urgency=medium

  * New upstream security release Closes: #1074486
    Fixes the following CVEs
    - Stored XSS via HTMP API CVE-2024-6307
    - Stored XSS in Template Part block CVE-2024-31111
    - Relative Path traversal CVE-2024-32111

 -- Craig Small <csmall@debian.org>  Sun, 30 Jun 2024 19:28:36 +1000

wordpress (6.5.3+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Sun, 19 May 2024 20:26:03 +1000

wordpress (6.5.2+dfsg1-1) unstable; urgency=medium

  * New upstream security release
    - Fixes stored XSS in Avatar blocks Closes: #1069091

 -- Craig Small <csmall@debian.org>  Tue, 16 Apr 2024 19:24:58 +1000

wordpress (6.5+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Thu, 04 Apr 2024 21:04:22 +1100

wordpress (6.4.3+dfsg1-1ubuntu1) noble; urgency=medium

  * Merge with Debian; remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 29 Feb 2024 14:31:14 +0100

wordpress (6.4.3+dfsg1-1) unstable; urgency=medium

  * New upstream release:
    - PHP File Upload bypass via Plugin Installer (requiring admin privileges)
    - An RCE POP Chains vulnerability

 -- Craig Small <csmall@debian.org>  Thu, 08 Feb 2024 19:54:35 +1100

wordpress (6.4.2+dfsg1-1) unstable; urgency=medium

  * New upstream release
    - Fixes a RCE that could be potentially exploited with some plugins,
      especially multisite installations.

 -- Craig Small <csmall@debian.org>  Tue, 02 Jan 2024 08:30:41 +1100

wordpress (6.4.1+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Update to standards 4.6.2, no change
  * Themes: twentytwentyone removed, new twentytwentyfour
  * Update apparmor profile for jetpack-waf directory, more comments

 -- Craig Small <csmall@debian.org>  Tue, 14 Nov 2023 18:04:24 +1100

wordpress (6.3.2+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Sun, 29 Oct 2023 21:50:25 +1100

wordpress (6.3.1+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Tue, 12 Sep 2023 19:36:08 +1000

wordpress (6.3+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Thu, 10 Aug 2023 20:53:28 +1000

wordpress (6.2.2+dfsg1-1) unstable; urgency=medium

  * New upstream security release Closes: #1036689
    - Block themes parsing shortcodes in user-generated data

 -- Craig Small <csmall@debian.org>  Thu, 25 May 2023 20:41:51 +1000

wordpress (6.2+dfsg1-1ubuntu1) lunar; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 11 Apr 2023 11:56:32 -0400

wordpress (6.2.1+dfsg1-1) unstable; urgency=high

  * New upstream security release Closes: #1036296
    - CVE-2023-2745 - Directory traversal in wp_lang

 -- Craig Small <csmall@debian.org>  Fri, 19 May 2023 07:40:55 +1000

wordpress (6.2+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Removed ancient (10+ years_ news entries

 -- Craig Small <csmall@debian.org>  Tue, 11 Apr 2023 22:40:41 +1000

wordpress (6.1.1+dfsg1-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 24 Jan 2023 16:19:03 -0800

wordpress (6.1.1+dfsg1-1) unstable; urgency=medium

  * New upstream maintenance release

 -- Craig Small <csmall@debian.org>  Fri, 09 Dec 2022 21:49:35 +1100

wordpress (6.1+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Removed TwentyTwenty theme
  * Added TwentyTwentyThree theme and made it recommended

 -- Craig Small <csmall@debian.org>  Sat, 12 Nov 2022 18:01:07 +1100

wordpress (6.0.3+dfsg1-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 07 Nov 2022 19:54:18 -0800

wordpress (6.0.3+dfsg1-1) unstable; urgency=high

  * New security release Closes: #1022575
    - Stored XSS via wp-mail.php (post by email)
    - Open redirect in `wp_nonce_ays`
    - Sender’s email address is exposed in wp-mail.php
    - Media Library – Reflected XSS via SQLi
    - CSRF in wp-trackback.php
    - Stored XSS via the Customizer
    - Revert shared user instances introduced in 50790
    - Stored XSS in WordPress Core via Comment Editing
    - Data exposure via the REST Terms/Tags Endpoint
    - Content from multipart emails leaked
    - SQL Injection due to improper sanitization in `WP_Date_Query`
    - RSS Widget: Stored XSS issue
    - Stored XSS in the search block
    - Feature Image Block: XSS issue
    - RSS Block: Stored XSS issue
    - Fix widget block XSS

 -- Craig Small <csmall@debian.org>  Mon, 24 Oct 2022 21:10:11 +1100

wordpress (6.0.2+dfsg1-1) unstable; urgency=medium

  * New security release Closes: #1018863
    - Possible link SQL injection within the Link API
    - XSS in Plugins screen
    - Output escaping issue within the_meta()

 -- Craig Small <csmall@debian.org>  Thu, 01 Sep 2022 18:41:07 +1000

wordpress (6.0+dfsg1-1ubuntu1) kinetic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 03 Jun 2022 15:22:27 -0700

wordpress (6.0+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Added more suggestions for php modules
  * Update standards version to 4.6.1, no changes needed.
  * Allow WordPress config file to be defined Closes: #834842

 -- Craig Small <csmall@debian.org>  Thu, 02 Jun 2022 16:37:59 +1000

wordpress (5.9.2+dfsg1-2ubuntu1) kinetic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 02 May 2022 04:36:26 +0200

wordpress (5.9.2+dfsg1-2) unstable; urgency=high

  * Fix emoji patch Closes: #1008976

 -- Craig Small <csmall@debian.org>  Wed, 06 Apr 2022 17:20:47 +1000

wordpress (5.9.2+dfsg1-1) unstable; urgency=medium

  * New security release Closes: #1007005, #1007145
  * Themes: 2019 removed, 2022 added

 -- Craig Small <csmall@debian.org>  Sat, 12 Mar 2022 14:31:34 +1100

wordpress (5.8.3+dfsg1-1ubuntu1) jammy; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 10 Jan 2022 17:05:34 -0800

wordpress (5.8.3+dfsg1-1) unstable; urgency=high

  * Upstream security release Closes: #1003243
    - CVE-2022-21662 - Stored XSS through authenticated users
    - CVE-2022-21663 - Authenticated Object Injection in Multisites
    - CVE-2022-21661 - WordPress: SQL Injection through WP_Query
    - CVE-2022-21664 - SQL injection due to improper sanitization
      in WP_Meta_Query

 -- Craig Small <csmall@debian.org>  Fri, 07 Jan 2022 15:57:14 +1100

wordpress (5.8.2+dfsg1-1ubuntu1) jammy; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 31 Dec 2021 00:13:41 -0800

wordpress (5.8.2+dfsg1-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Trim trailing whitespace.
  * Remove 1 obsolete maintscript entry.
  * Fix day-of-week for changelog entry 2.6.2-1.
  * Update standards version to 4.6.0, no changes needed.

  [ Craig Small ]
  * New upstream release Closes: #1001462
  * Don't install ca-certificates.crt but link it Closes: #999568
  * Fix updater to complain less
  * Stop auto-updates Closes: #1001623
  * Added local/apache-wordpress for AppArmor local configs

 -- Craig Small <csmall@debian.org>  Mon, 20 Dec 2021 21:48:50 +1100

wordpress (5.8.1+dfsg1-2ubuntu1) jammy; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 18 Oct 2021 17:46:04 -0700

wordpress (5.8.1+dfsg1-2) unstable; urgency=high

  * Install AppArmor file in correct location

 -- Craig Small <csmall@debian.org>  Mon, 20 Sep 2021 18:51:00 +1000

wordpress (5.8.1+dfsg1-1) unstable; urgency=medium

  * Security release
    - CVE-2021-39200 - Disclosure in wp_die() Closes: #994060
    - CVE-2021-39201 - XSS in editor Closes: #994059
  * New upstream release Closes: #992302
  * Add direct FS_METHOD in mysql setup Closes: #988991
  * Add AppArmor profile

 -- Craig Small <csmall@debian.org>  Sat, 11 Sep 2021 10:29:52 +1000

wordpress (5.7.1+dfsg1-2ubuntu1) impish; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 27 Apr 2021 20:55:02 -0700

wordpress (5.7.1+dfsg1-2) unstable; urgency=medium

  * Fix symlink for 2021 theme Closes: #986085

 -- Craig Small <csmall@debian.org>  Tue, 20 Apr 2021 22:28:40 +1000

wordpress (5.7.1+dfsg1-1) unstable; urgency=high

  * Security release, fixes 2 bugs Closes: #987065
    - CVE-2021-29450 - Authenticated disclosure of password-protected
      posts and pages.
    - CVE-2021-29447 - Authenticated XXE attack when installation is
      running PHP 8

 -- Craig Small <csmall@debian.org>  Sat, 17 Apr 2021 08:46:05 +1000

wordpress (5.7+dfsg1-1) unstable; urgency=medium

  * New upstream release Closes: #984985

 -- Craig Small <csmall@debian.org>  Mon, 15 Mar 2021 08:11:27 +1100

wordpress (5.6.1+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Added core language directory

 -- Craig Small <csmall@debian.org>  Fri, 05 Feb 2021 18:53:39 +1100

wordpress (5.6+dfsg1-2ubuntu1) hirsute; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 08 Jan 2021 15:56:33 -0800

wordpress (5.6+dfsg1-2) unstable; urgency=medium

  * Removed php5 alternative dependencies as these are only in
    oldoldstable
  * source-only upload for Bullseye Closes: #977517

 -- Craig Small <csmall@debian.org>  Mon, 21 Dec 2020 14:39:34 +1100

wordpress (5.6+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Removed theme twentyseventeen
  * Added theme twentytwentyone
  * Update to standards version 4.5.1

 -- Craig Small <csmall@debian.org>  Thu, 17 Dec 2020 22:22:49 +1100

wordpress (5.5.3+dfsg1-1) unstable; urgency=high

  * Security release, fixes 8 bugs Closes: #973562
     - CVE-2020-28039: Protected meta that could lead to arbitrary
                       file deletion.
     - CVE-2020-28035: XML-RPC privilege escalation.
     - CVE-2020-28036: XML-RPC privilege escalation.
     - CVE-2020-28032: Hardening deserialization requests.
     - CVE-2020-28037: DoS attack could lead to RCE.
     - CVE-2020-28038: Stored XSS in post slugs.
     - CVE-2020-28033: Disable spam embeds from disabled sites
                       on a multisite network.
     - CVE-2020-28034: Cross-Site Scripting (XSS) via global variables.
     - CVE-2020-28040: CSRF attacks that change a theme's background image.
  * Removed TinyMCE build dependency as its very old
  * d/dirs: Add two more language directories

 -- Craig Small <csmall@debian.org>  Tue, 03 Nov 2020 17:23:49 +1100

wordpress (5.5.1+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Remove patch CVE-2017-8295 as it is in upstream

 -- Craig Small <csmall@debian.org>  Wed, 02 Sep 2020 16:25:35 +1000

wordpress (5.4.2+dfsg1-1) unstable; urgency=medium

  * Security release, fixes 6 security bugs Closes: #962685
    - CVE-2020-4046
      Authenticated XSS through embed block
    - CVE-2020-4047
      Authenticated XSS via media attachment page
    - CVE-2020-4048
      Open redirect in wp_validate_redirect()
    - CVE-2020-4049
      Authenticated self-XSS via theme uploads
    - CVE-2020-4050
      'set-screen-option' filter misuse by plugins leading to privilege
      escalation
  * Prevent unmoderated comments from search engine indexation

 -- Craig Small <csmall@debian.org>  Mon, 15 Jun 2020 07:53:44 +1000

wordpress (5.4.1+dfsg1-1) unstable; urgency=medium

  * Security release, fixes 6 security bugs Closes: #959391
    - CVE-2020-11025
      XSS vulnerability in the navigation section of Customizer allows
      JavaScript code to be executed.
    - CVE-2020-11026
      uploaded files to Media section to lead to script execution
    - CVE-2020-11027
      Password reset link does not expire
    - CVE-2020-11028
      Private posts can be found through searching by date
    - CVE-2020-11029
      XSS in stats() method in class-wp-object-cache
    - CVE-2020-11030
      Special payload can execute scripts in block editor
  * Add multi-arch tags
  * Update to standards 4.5.0

 -- Craig Small <csmall@debian.org>  Sat, 02 May 2020 14:21:58 +1000

wordpress (5.4+dfsg1-1) unstable; urgency=medium

  * New upstream source
  * Remove debian.cnf call for create database Closes: #884877
  * Add note for iputils-ping required for setup-mysql. Closes: #944465
  * Themes: twentysixteen removed, twentytwenty added
  * Themes: remove conflict with ancient wordpress

 -- Craig Small <csmall@debian.org>  Sun, 05 Apr 2020 12:00:08 +1000

wordpress (5.3.2+dfsg1-1ubuntu1) focal; urgency=medium

  * Fix compatibility with MySQL 8.0 (LP: #1852775)
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 27 Jan 2020 11:51:19 -0500

wordpress (5.3.2+dfsg1-1) unstable; urgency=high

  * Fixes some important but non-security bugs.
  * Thanks to Nils Radtke <debbug@think-future.com> for
    his assistance.
  * Version 5.3.1 is a security release, fixes several
    issues Closes: #946905
    - CVE-2019-20043
      an unprivileged user could make a post sticky via the REST API.
    - CVE-2019-20042
      cross-site scripting (XSS) could be stored in well-crafted links
    - CVE-2019-20041
      hardening wp_kses_bad_protocol() to ensure that it is aware
      of the named colon attribute.
    - CVE-2019-16780 and CVE-2019-16781
      stored XSS vulnerability using block editor content.
  * Fix error in CVE-2017-14990 patch where sub-sites cannot
    authenticate users. Thanks Connor for your help!

 -- Craig Small <csmall@debian.org>  Fri, 27 Dec 2019 15:18:07 +1100

wordpress (5.2.4+dfsg1-1) unstable; urgency=high

  * Security release, fixes several issues Closes: #942459
     - CVE-2019-17674
       Stored XSS in the Customizer
     - CVE-2019-17671
       Viewing unauthenticated posts
     - CVE-2019-17672
       Stored XSS to inject javascript into style tags
     - CVE-2019-17673
       Poisoning JSON GET requests
     - CVE-2019-17669
       SSRF in URL vaidation
     - CVE-2019-17675
       Referer validation in admin screens

 -- Craig Small <csmall@debian.org>  Thu, 17 Oct 2019 21:32:54 +1100

wordpress (5.2.3+dfsg1-1) unstable; urgency=medium

  * Security release, fixes several issues Closes: #939543
    - CVE-2019-16223
      XSS in post previews
    - CVE-2019-16218
      XSS in stored comments
    - CVE-2019-16220
      Open redirect due to validation and sanitization
    - CVE-2019-16217
      XSS in media uploads
    - CVE-2019-16219
      XSS in shortcode previews
    - CVE-2019-16221
      Reflected XSS in dashboard
    - CVE-2019-16222
      XSS in URL sanitization
  * Use replace for dh-linktrees for underscore-js

 -- Craig Small <csmall@debian.org>  Fri, 06 Sep 2019 18:39:10 +1000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog wordpress-theme-twentytwentyfour`.
