www/wordpress 7.0.6 NetBSD

They usually fail to download in the distfile mirror job

7.0.7 (2026-10-06) Security updates This release features one security fix. Because this is a security release, it is recommended that you update your sites immediately. The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release: * A stored XSS on the Comments administration page, exploitable via pending comments, reported by Thomas Chauchefoin at Trail of Bits * A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic * A second-Order SQL injection in WordPress WXR export, reported by Anthropic * A weakness allowing Author role users to sticky posts, reported by Anthropic * Unauthenticated disclosure of comments on private & unpublished posts, …

7.0.5 (2026-09-17) Security Updates * An issue allowing a crafted URL to install and preview a theme from WordPress.org reported by Paulos Yibelo and pwn.ai * A stored cross-site scripting (XSS) issue in custom header images on some themes reported by Jeremy Felt of the WordPress Security Team * An information disclosure issue exposing the title of a private parent post reported by HDWSec * An HTML API issue allowing modified text to break out of an HTML comment reported by Jeremy Felt of the WordPress Security Team * A multisite issue allowing a site administrator to network-activate a network-only plugin reported by Jesse McNeil * A Contributor+ arbitrary post overwrite issue reported by Anthropic …

7.0.4 (2026-08-12) Security updates This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release: * An authenticated Author+ remote code execution issue via malicious file upload on sites that use Imagick and Ghostscript reported by the team at pwn.ai

7.0.3 (2026-08-06) Security updates This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release: * A Contributor+ stored cross-site scripting (XSS) issue in the Post Date block reported by Alex Concha of the WordPress Security Team * A Contributor+ stored cross-site scripting (XSS) issue in the Post Content block reported by n05ec * An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team …