• WP-Polls 2.63
• WP-PostRatings 1.63
• WP-PostViews 1.61
• WP-Email 2.60

Now all AJAX requests are handled by /wp-admin/admin-ajax.php. Previously it is handled via the plugin PHP file itself by assuming that wp-load.php is always 2 levels down from the plugin file. But since you can have your WordPress in any folders, custom loading of wp-load.php is not possible as the path to wp-load.php varies from server to server.

While I am at it, I added nonce check for AJAX calls to WP-Polls, WP-PostRatings and WP-Email. Let me know if you run into problems via WordPress Support Forums, My Forums (if you are already registered) or via email (lesterchan AT gmail).

Fixes:

• Plupload (version 1.5.4), which WordPress uses for uploading media.
• SWFUpload, which WordPress previously used for uploading media, and may still be in use by plugins.

vSWFObject, which WordPress previously used to embed Flash content, and may still be in use by plugins and themes.

• Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances, disclosed by Jon Cave of our WordPress core security team, and Adam Backstrom.
• Cross-site scripting vulnerability when making URLs clickable, by Jon Cave.
• Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs. Thanks to Mauro Gentile for responsibly disclosing these issues to the security team.

Changelog: From WordPress 3.3.1
Download: WordPress 3.3.2

WordPress 3.4 Beta 3

• 90 bugs have been fixed since beta 2

Changelog: From WordPress 3.4 Beta 2
Download: >WordPress 3.4 Beta 3

What’s New

• Theme Customizer with Previewer
• Flexible Custom Header Sizes
• Selecting Custom Header and Background Images from Media Library
• Better experience searching for and choosing a theme

Under-the-hood Changes

• New XML-RPC API for external and mobile applications
• New API for registering theme support for custom headers and backgrounds
• Performance improvements to WP_Query by splitting the query (Please test!)
• Internationalization improvements (improved performance and locale support)
• Performance and API improvements when working with lists of installed themes
• Support for installing child themes from the WordPress Themes Directory

Download: WordPress 3.4 Beta 1

Changelog: WordPress 3.3.1
Download: WordPress 3.3.1
Download: Modified files since WordPress 3.3

For Users
Experienced users will appreciate the new drag-and-drop uploader, hover menus for the navigation, the new toolbar, improved co-editing support, and the new Tumblr importer. We’ve also been thinking a ton about what the WordPress experience is like for people completely new to the software. Version 3.3 has significant improvements there with pointer tips for new features included in each update, a friendly welcome message for first-time users, and revamped help tabs throughout the interface. Finally we’ve improved the dashboard experience on the iPad and other tablets with better touch support.

For Developers
There is a ton of candy for developers as well. I’d recommend starting your exploration with the new editor API, new jQuery version, better ways to hook into the help screens, more performant post-slug-only permalinks, and of course the entire list of improvements on the Codex and in Trac.

Download: WordPress 3.3

View: Full Changelog From RC2
Download: WordPress 3.3 RC3

View: Full Changelog From RC1
Download: WordPress 3.3 RC2

View: Full Changelog From Beta 4
Download: WordPress 3.3 RC1

With all our major tickets closed, we are very close to a release candidate. In Beta 4 we’ve fixed a bunch of bugs, cleaned up the UI, added real text in some of the screens that still had placeholder text in Beta 3 (post-update screen, the Dashboard welcome area, new feature pointers), and generally tightened things up. We updated to jQuery 1.7.1 and addressed a LOT of bugs.

View: Full Changelog From Beta 3
Download: WordPress 3.3 Beta 4

No new features has been added instead beta 3 has over 200 bug fixes since beta 2.

View: Full Changelog From Beta 2
Download: WordPress 3.3 Beta 3

• Updated the Blue theme
• Fixed IE7 and RTL support
• Improved flyout menu styling and fixed several glitches
• Finished the Pointers implementation
• Landed the Welcome screen
• Improved contextual help styling
• Tweaked the admin bar a little more
• Fixed a bunch of bugs

View: Full Changelog From Beta 1
Download: WordPress 3.3 Beta 2

WordPress 3.3 is ready for beta testers.

As always, this is software still in development and we don’t recommend that you run it on a production site — set up a test site just to play with the new version. If you break it (find a bug), please report it, and if you’re a developer, try to help us fix it.

If all goes well, we hope to release WordPress 3.3 by the end of November. The more help we get with testing and fixing bugs, the sooner we will be able to release the final version. If you want to be a beta tester, you should check out the Codex article on how to report bugs.

Here’s some of what’s new:

• Media uploader
• Improved admin bar
• Fly out admin menus

Remember, if you find something you think is a bug, report it! You can bring it up in the alpha/beta forum, you can email it to the wp-testers list, or if you’ve confirmed that other people are experiencing the same bug, you can report it on the WordPress Core Trac. (We recommend starting in the forum or on the mailing list.)

Theme and plugin authors, if you haven’t been following the 3.3 development cycle, please start now so that you can update your themes and plugins to be compatible with the newest version of WordPress.

Download: WordPress 3.3 Beta 1

After more than a million downloads of WordPress 3.2, we’re now releasing WordPress 3.2.1 into the wild. This maintenance release fixes a server incompatibility related to JSON that’s unfortunately affected some of you, as well as a few other fixes in the new dashboard design and the Twenty Eleven theme. If you’ve already updated to 3.2, then this update will be even faster than usual, thanks to the new feature in 3.2 that only updates files that have been changed, rather than replacing all the files in your installation.

Fixes (Ticket):

• JSON, the admin
• A little bit tidier
• Edge cases covered

Changelog: WordPress 3.2.1
Download: WordPress 3.2
Download: Modified files since WordPress 3.2

Here in the U.S. we are observing Independence Day, and I can’t think of a more fitting way to mark a day that celebrates freedom than by releasing more free software to help democratize publishing around the globe. I’m excited to announce that WordPress 3.2 is now available to the world, both as an update in your dashboard and a download on WordPress.org. Version 3.2 is our fifteenth major release of WordPress and comes just four months after 3.1 (which coincidentally just passed the 15 million download mark this morning), reflecting the growing speed of development in the WordPress community and our dedication to getting improvements in your hands as soon as possible. We’re dedicating this release to noted composer and pianist George Gershwin.

The focus for this release was making WordPress faster and lighter. The first thing you’ll notice when you log in to 3.2 is a refreshed dashboard design that tightens the typography, design, and code behind the admin. (Rhapsody in Grey?) If you’re starting a new blog, you’ll also appreciate the fully HTML5 new Twenty Eleven theme, fulfilling our plan to replace the default theme every year. Start writing your first post in our redesigned post editor and venture to the full-screen button in the editing toolbar to enter the new distraction-free writing or zen mode, my personal favorite feature of the release. All of the widgets, menus, buttons, and interface elements fade away to allow you to compose and edit your thoughts in a completely clean environment conducive to writing, but when your mouse strays to the top of the screen your most-used shortcuts are right there where you need them. (I like to press F11 to take my browser full-screen, getting rid of even the OS chrome.)

Under the hood there have been a number of improvements, not the least of which is the streamlining enabled by our previously announced plan of retiring support for PHP4, older versions of MySQL, and legacy browsers like IE6, which allows us to take advantage of more features enabled by new technologies. The admin bar has a few more shortcuts to your most commonly-used actions. On the comment moderation screen, the new approve & reply feature speeds up your conversation management. You’ll notice in your first update after 3.2 that we’ll only be updating the files that have changed with each new release instead of every file in your WordPress installation, which makes updates significantly faster on all hosting platforms. There are also some fun new theme features shown off by Twenty Eleven, like the ability to have multiple rotating header images to highlight all of your favorite photos

Download: WordPress 3.2
Codex: WordPress 3.2
Trac: WordPress 3.2

WordPress 3.1.4

WordPress 3.1.4 is available now and is a maintenance and security update for all previous versions.

This release fixes an issue that could allow a malicious Editor-level user to gain further access to the site. Thanks K. Gudinavicius of SEC Consult for bringing this to our attention. Version 3.1.4 also incorporates several other security fixes and hardening measures thanks to the work of WordPress developers Alexander Concha and Jon Cave of our security team. Consult the change log for more details.

Changelog: WordPress 3.1.4
Download: WordPress 3.1.4
Download: Modified files since WordPress 3.1.3

WordPress 3.2 RC3

This release was about all that stood in the way of a final release of WordPress 3.2. So we’re also announcing the third release candidate for 3.2, which contains all of the fixes in 3.1.4; few minor RTL, JavaScript, and user interface fixes; and ensures graceful failures if 3.2 is run on PHP4. As a reminder, we’ve bumped our minimum requirements for version 3.2 to PHP 5.2.4 and MySQL 5.0.

Download: WordPress 3.2 RC3

We’ve handled a number of issues since RC1, including additional Twenty Eleven tweaks, a new theme support option for defaulting to randomized headers, and various RTL fixes.

Download: WordPress 3.2 RC2

The first release candidate (RC1) for WordPress 3.2 is now available.

An RC comes after the beta period and before final release. We think we’re done, but with tens of millions of users, a variety of configurations, and thousands of plugins, it’s possible we’ve missed something. So if you haven’t tested WordPress 3.2 yet, now is the time! Please though, not on your live site unless you’re extra adventurous.

Things to keep in mind:

• With more than 350 tickets closed, there are plenty of changes. Plugin and theme authors, please test your plugins and themes now, so that if there is a compatibility issue, we can figure it out before the final release.
• Users are also encouraged to test things out. If you find problems, let your plugin/theme authors know so they can figure out the cause.
• Twenty Eleven isn’t quite at the release candidate stage. Contents may settle.
• If any known issues crop up, you’ll be able to find them here.

If you are testing the release candidate and think you’ve found a bug, there are a few ways to let us know:

• Post it to the Alpha/Beta area in the support forums or wp-testers
• Join the development IRC channel and tell us live at irc.freenode.net #wordpress-dev
• File a bug ticket on the WordPress Trac

To test WordPress 3.2, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the release candidate here (zip).

Happy testing!

If you’d like to know which levers to pull in your testing, check out a list of features in our Beta 1 post.

Download: WordPress 3.2 RC1

• Various security hardening by Alexander Concha.
• Taxonomy query hardening by John Lamansky.
• Prevent sniffing out user names of non-authors by using canonical redirects. Props Verónica Valeros.
• Media security fixes by Richard Lundeen of Microsoft, Jesse Ou of Microsoft, and Microsoft Vulnerability Research.
• Improves file upload security on hosts with dangerous security settings.
• Cleans up old WordPress import files if the import does not finish.
• Introduce “clickjacking” protection in modern browsers on admin and login pages.

Changelog: WordPress 3.1.3
Download: WordPress 3.1.3
Download: Modified files since WordPress 3.1.2

• Added Auto Repair functionality via WP Cron, similar to the current implementation of Backing Up & Optimizing DB
• Added nonce to all forms for added security
• Replace get_bloginfo('name') with get_option('blogname') and make it goes through wp_specialchars_decode()
• Ported the readme.html to readme.txt

Finally, Props to Joakim Jardenberg, Jonas Nordström and Andreas Viklund for finding and reporting the previous security vulnerability.

Download: WP-DBManager 2.62

However, most users are affected and it is recommended that you upgrade WP-DBManager to 2.61.

WP-DBManager 2.62 will be out on Tuesday with added nonce security and auto-repair functionality.

Sorry for any inconvenience caused.

Download: WP-DBManager 2.61