Security fixes in four plugins, plus Top 10 4.6 and AI answers
Date: 16 October 2026
Hi Reader π,
TLDR: Four plugins have had security fixes since my last email. Knowledge Base 3.2.1 and Top 10 4.6.0 fix leaks of password-protected content, so please update those two first. Top 10 4.5.3 went out on 14 October, and 4.6.0 followed on 15 October with Koko Analytics as a new data source. Beyond security, Better Search 4.5 and Knowledge Base 3.2 add optional AI answers grounded in your own content in Pro. Contextual Related Posts 4.5 can filter out weak matches. Image Optimizer 1.2 now compresses and resizes your originals, and Code Block Highlighting 1.3 stops code blocks from breaking when the plugin is deactivated.
Security fixes: please update
If you run any of these plugins, update to at least the version listed. The current release of each includes every fix.
- Knowledge Base 3.2.1 (free and Pro). Password-protected and private articles could leak. The /wzkb/v1/knowledgebase and /wzkb/v1/search REST endpoints returned the content of password-protected articles without the password, tables of contents showed their headings, and cached listings could show private articles to visitors.
- Contextual Related Posts 4.4.2. An Author-level user could store cross-site scripting through the thumbnail dimensions in block attributes. This was reported through Wordfence. It matters most if people other than you can write posts on your site.
- Top 10 4.6.0. Cached popular posts lists could share an excerpt unlocked with a post's password with other visitors, and thumbnails could expose images inside or attached to password-protected posts before the password was entered. Thumbnail URLs now reject unsafe protocols. Earlier, 4.5.1 fixed the same thumbnail dimension issue as Contextual Related Posts, and 4.5.3 hardened the escaping of the popular posts wrapper classes.
- Better Search 4.5.0. Thumbnail dimensions are now hardened to prevent markup injection through custom image sizes.
Knowledge Base 3.2, Better Search 4.5, and Contextual Related Posts 4.5 need WordPress 6.9, and Top 10 needs 6.8. If your site runs an older version, WordPress won't offer you these updates, so update WordPress first.
Better Search 4.5: AI answers from your own search results
Better Search Pro can now answer a visitor's question with AI, grounded in your Better Search results and linking to the posts it used. It's optional. Answers are cached, you can set usage limits, and a Content gaps report shows the questions your content couldn't answer. Version 4.5.1 adds Ask AI to theme search forms and lets you choose the model.
In both free and Pro, Tools has a new Status section showing database, index, and cache health, and you can restrict results to selected terms. Cached results could appear in the wrong language on WPML, Polylang, and TranslatePress sites, and searches across taxonomies, metadata, authors, or comments could time out on large sites. Both are fixed.
βRead the Better Search v4.5 post ββ
Knowledge Base 3.2: Ask the Docs
Ask the Docs, in beta in Knowledge Base Pro, adds AI answers with article sources to your Knowledge Base search boxes and the Help widget. It caches answers and has daily and per-visitor limits. It needs WordPress 7.0 and a connected AI provider. An opt-in Content gaps report collects unanswered questions and exports them as CSV. Version 3.2.1 adds model and fallback provider settings.
Free and Pro both gain Abilities API tools for article search and section discovery.
βRead the Knowledge Base v3.2 post ββ
Contextual Related Posts 4.5: fewer weak matches
A new minimum relevance setting excludes weak matches. It's off by default and unavailable on SQLite. Related lists now refresh when you edit or publish a post, including through Quick Edit, Bulk Edit, and scheduled publishing, which previously left them stale. Tools gets the same Status section as Better Search.
Pro adds optional recency weighting and a standalone Advanced block with six patterns.
βRead the Contextual Related Posts v4.5 post ββ
Top 10 4.6: Koko Analytics as a data source
Released on 15 October, Top 10 4.6 can use Koko Analytics as the data source for popular posts, including a mode that switches off Top 10's own tracking. It adds WordPress Abilities API support for popular posts and view counts on WordPress 6.9 and later. Cached lists now refresh when view counts or posts change instead of waiting for the cache to expire, and daily popular posts queries are faster on large sites.
Pro adds an Advanced Popular Posts block with editable cards and six layout patterns, and a new tab on the Top 10 dashboard that compares feed and web views.
One change to note: popular posts lists that span multiple network sites are now Pro only.
βRead the Top 10 v4.6 post ββ
Image Optimizer 1.2: compress and resize your originals
Until now, Image Optimizer only created WebP and AVIF copies. Version 1.2 can also compress your original JPEGs, compress PNGs with oxipng or pngquant if they're installed on your server, and resize oversized originals. All three are optional. The plugin keeps verified backups, and you can restore originals from the Media Library or with wp wzio restore-originals.
βRead the Image Optimizer v1.2 post ββ
Code Block Highlighting 1.3
Code blocks with a language, file name, or highlighted lines showed "This block contains unexpected or invalid content" after the plugin was deactivated. Version 1.3 fixes this. A new Convert Code Blocks screen and the wp wzcbh migrate-code-blocks command convert blocks saved by earlier versions in bulk. You also get a per-block color scheme and optional language detection in server-side mode.
βRead the Code Block Highlighting v1.3 post ββ
Also out
Snippetz, Auto Close, and Link Warnings had smaller maintenance releases with accessibility and compatibility fixes.
Keep on publishing!
P.S. Have questions? I am always happy to help!
β