Good news for everyone running a self-hosted website: WordPress 7.1.4 landed on October 28, 2026, and it is an update you should not put off. As usual, this new version is available for “download” directly from wordpress.org and not through the Synology Package Center. If you want to get WordPress 7.1.4 up and running on your Synology NAS, just follow my step-by-step Docker guide on How to Install WordPress on Your Synology NAS with Docker. Running an UGREEN NAS instead? No problem, my UGREEN NAS GUIDE to Install WordPress has you covered. Either way, my recommendation stays the same: go with the Docker version below.
My WordPress guides for Synology and UGREEN are up to date for 2026 and use the latest technologies to ensure a fast, secure, and modern website:
- Latest PHP 8.5.12
- Latest phpMyAdmin 5.2.3
- Latest MariaDB 11.8 LTS (Long Term Support until October 15, 2033)
- Latest Redis to significantly improve site speed
- Latest Apache 2.4.69
Unlike many others who create guides (especially video guides on YouTube), often presented in a superficial way and with no real attention to technical details and security, mariushosting has always focused on security and speed, using only the latest available technologies to keep your WordPress healthy, performant, and protected in 2026. And who could know better than Marius who has been hosting his own website from home on a NAS for more than 7 years?
This time, WordPress 7.1.4 is a security release that patches 22 vulnerabilities, including the following fixes:
- Race condition during core updates that could lead to remote code execution
- Stored XSS in the personal data erasure requests screen (Editor+)
- Stored XSS via whitespace in block delimiters (Contributor+)
- Unpublished Customizer changes exposed to unauthenticated visitors
- Unescaped usernames on the multisite Network Users screens (hardening)
- Custom roles that moderate comments being able to read, edit and delete notes on posts they can’t edit
- Interactivity API bindings letting object elements load admin pages (Contributor+)
- Stored XSS in Customizer selective refresh (Contributor+)
- Stored XSS via javascript: URLs in Interactivity API bindings (Contributor+)
- Stored XSS in the labels of the Comments Pagination and Post Navigation Link blocks (Contributor+)
- Post content able to shadow Script Module data with a matching element ID
- XSS in the Categories block via format string injection
- Unsafe preg_replace() replacements in the Image and Playlist blocks (hardening)
- Stored XSS via Interactivity API event handler bindings (Contributor+)
- Stored XSS in the Interactivity Router via uploaded text files (Author+)
- Stored XSS via prototype pollution in Interactivity API context namespaces (Contributor+)
- Stored XSS and denial of service issues in Interactivity API bindings (Contributor+)
- Updated bundled root certificates due to the eMudhra revocation
Because this is a security release, you should update your sites immediately. For every detail and the complete list of revised files, take a look at the WordPress 7.1.4 documentation page.
These bugs affect WordPress version 7.1 and older versions, with security fixes backported to every branch still eligible for them (down to 4.7), so updating is a must. WordPress 7.1.4 is a short-cycle security release, and WordPress 7.1.4 is THE BEST version of WordPress to ever ship out. Looking ahead, the next major release will be WordPress 7.2, currently planned to reach the general public on December 8, 2026.
Note: If you have any questions regarding the WordPress official version, WordPress Docker version or WordPress Synology Package, Contact me.
Note: mariushosting has been hosted from home on a Synology NAS device since January 9, 2019.
This post was updated on Wednesday / October 28th, 2026 at 10:45 PM