WordPress 2.6.5 is immediately available & fixes one security problem and three bugs. We recommend everyone upgrade to this release.

• The security issue is an XSS exploit discovered by Jeremias Reith that fortunately only affects IP-based virtual servers running on Apache 2.x. If you are interested only for security fix, copy wp-includes/feed.php & wp-includes/version.php from the 2.6.5 release package.

WordPress 2.6.5 contains three other small fixes in addition to the XSS fix.

1. The first prevents accidentally saving post meta information to a revision.
2. The second prevents XML-RPC from fetching incorrect post types.
3. The third adds some user ID sanitization during bulk delete requests.

Note that we are skipping version 2.6.4 & jumping from 2.6.3 to 2.6.5 to avoid confusion with a fake 2.6.4 release that made the rounds. There is not & never will be a version 2.6.4.

Get WordPress 2.6.5.