Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWordPress 5.4.1 was a historical security and maintenance release published on April 29, 2020. It addressed issues affecting WordPress 5.4 and earlier, including problems involving password-reset tokens, private posts, and cross-site scripting (XSS). WordPress’s release announcement reports seven security fixes, while its version documentation says six security issues affected those versions; the two official sources use different counts, and the published material does not reconcile them.
What WordPress 5.4.1 fixed
WordPress.org’s 5.4.1 version documentation names these issue areas and credits the people who reported them:
- Password-reset tokens: Tokens were not properly invalidated. The documentation credits Muaz Bin Abdus Sattar and Jannes.
- Private posts: Certain private posts could be viewed without authentication. The documentation credits ka1n4t.
- Customizer XSS: An XSS issue in the Customizer was reported by Evan Ricafort.
- Search block XSS: The documentation credits Ben Bidner of the WordPress Security Team.
wp-object-cacheXSS: The documentation credits Nick Daugherty of WPVIP.com and the WordPress Security Team.- File-upload XSS: The documentation credits Ronnie Goodrich (Kahoots) and Jason Medeiros. A WordPress/wordpress-develop advisory explains that specially crafted filenames uploaded through Media could lead to script execution when the file was accessed.
The WordPress News announcement separately describes a stored Customizer XSS vulnerability and credits Weston Ruter with the fix. Its wording and credits do not line up exactly with the version documentation’s Customizer entry; the sources do not explain whether these refer to the same issue.
Why the official security-fix counts differ
The WordPress News announcement says 5.4.1 included 17 bug fixes and 7 security fixes. By contrast, the version documentation says six security issues affected WordPress 5.4 and earlier. “Fixes” and “issues” are the terms used by the respective sources. Neither source explains the difference, so it is most accurate to retain both attributed figures rather than treat them as a single reconciled count.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
The announcement also discusses an authenticated block-editor XSS issue discovered by Nguyen The Duc in WordPress 5.4 release candidates RC1 and RC2 and fixed in RC5. That places its fix before the public 5.4 release. Wordfence’s contemporaneous technical account says the issue affected release candidates and does not appear to have been present in an official release. It should not be confused with an additional vulnerability in the publicly released 5.4 version patched by 5.4.1.
How to update from WordPress 5.4
At the time of release, WordPress directed users to update through the Dashboard or download the release from its official archive. The announcement said supported automatic background updates had begun, but administrators could also check manually:
Rank #2
- Sign in to the WordPress administration area.
- Open Dashboard → Updates.
- If WordPress 5.4.1 is offered, select the update option and allow the process to complete.
- Confirm the installed version on the Updates page or in the WordPress administration footer.
The official WordPress release archive provides archived releases. WordPress.org’s announcement recommended updating sites immediately because 5.4.1 was a security release. That is historical guidance for the 2020 release, not a recommendation to install 5.4.1 today.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why 5.4.1 is not current-version guidance
WordPress 5.4.1 was followed by later releases in the same branch. WordPress announced WordPress 5.4.2 on June 10, 2020, describing fixes for issues affecting 5.4.1 and earlier. The version documentation also records WordPress 5.4.14, released October 12, 2023. These dates show that 5.4.1 is an old, superseded release; they do not establish which WordPress release is current now.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
