Software security updates issued for WordPress, Microsoft Exchange, and LibreOffice

Multiple major software platforms have issued urgent security updates to address critical vulnerabilities.

WordPress has released version 7.1.3, its third security update in 19 days, to patch seven vulnerabilities. These include a second-order SQL injection in the WXR export tool and a cross-site scripting (XSS) flaw in comment management that could allow malicious code to execute in an administrator's browser. Several flaws were reported by Anthropic.

Microsoft has issued an out-of-band security update for on-premises Exchange Server to address CVE-2026-96940. This privilege escalation vulnerability, rated 8.8/10 by CVSS, could allow an authenticated attacker to access other users' mailboxes and attachments within the same organization. Exchange Online is already protected.

Additionally, vulnerabilities in LibreOffice (CVE-2026-63277) and Apache OpenOffice (CVE-2026-59265) have been identified. These flaws allow for remote code execution via manipulated spreadsheet documents that leverage Java database connectivity (JDBC). LibreOffice has released a fix, while OpenOffice users are advised to disable Java support until a patch is available.