Core code isn’t the only way to contribute to the WordPress project. We have an active theme review team, support forum volunteers, people writing documentation, plugin managers, community event organizers, translators, and more. The teams have been siloed for too long, so we’ve recently begun the process of bringing them together by having teams elect representatives to facilitate more communication between the contributor groups. These reps will form the nucleus of the contributor summit now being planned for a long weekend at the end of October in Tybee Island, GA. This is completely different from a WordCamp. It will be a combination of co-working, unconference, and discussions among the project leaders, and participation will be by invitation.

In addition to bringing together the active contributor team reps to work together, I think it’s important to include community members who don’t fall into that category (at least not yet!). Successful WordPress-based business, authors of popular plugins and themes, and people using WordPress in unexpected but intriguing ways should have a place at the table, too. That said, part of the magic of the core team meetup is the small size; it allows every voice not only to be heard, but to engage. Since this is my first attempt at bringing together so many groups and points of view, I want to try and keep it small enough to retain that personal atmosphere while at the same time ensuring that the best possible mix of people and businesses in the WordPress ecosystem is represented. This is where you come in!

Taking a cue from events with limited availability like AdaCamp (attendance) and the jQuery conference (speaker roster), I want you to nominate people and/or WordPress-based businesses to participate in the summit. Yes, you can nominate yourself.* You can nominate up to 10 additional people — be prepared to provide URLs and the reason you think they should participate. You can also nominate up to 10 WordPress-based businesses without naming individual people, so if there’s a theme or hosting company (for example) that you think should be there, you don’t need to go looking for employee names. This nomination process will hopefully ensure that we don’t overlook someone who is making a difference in our community when it comes time to issue invitations.

Nominations will be open for a week, after which the survey will be closed and the process of analyzing the results** will begin. The nominations process will lead to invitations in June, confirmations in July, planning in August and September, and the summit itself in October. Hopefully we can stream and/or record some of the activity to share online at WordPress.tv. Additional invitations may be extended up until the event if there are people/businesses that become more active in the community. If you’re thinking to yourself that maybe now’s the perfect time to start contributing time to the WordPress project, good thinking! In the meantime, if you want to weigh in, fill in the community summit nomination form. Thanks, and wish us luck!

* Nominating yourself: Do nominate yourself if you fall into one of the categories described in the post above, or if you believe that you have a unique point of view. Please do not nominate yourself if you just think it would be cool to hang out with this group. This is a working event, and everyone is expected to bring something special to the table.

** I (and/or a helpful community volunteer) will sift through the nominations and compile a shortlist of the most-nominated people/businesses and the most intriguing underdogs. This list will be reviewed by the summit planning committee (made up of team reps) to create the invitation list.

Three external libraries included in WordPress received security updates:

• Plupload (version 1.5.4), which WordPress uses for uploading media.
• SWFUpload, which WordPress previously used for uploading media, and may still be in use by plugins.
• SWFObject, which WordPress previously used to embed Flash content, and may still be in use by plugins and themes.

Thanks to Neal Poole and Nathan Partlan for responsibly disclosing the bugs in Plupload and SWFUpload, and Szymon Gruszecki for a separate bug in SWFUpload.

WordPress 3.3.2 also addresses:

• Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances, disclosed by Jon Cave of our WordPress core security team, and Adam Backstrom.
• Cross-site scripting vulnerability when making URLs clickable, by Jon Cave.
• Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs. Thanks to Mauro Gentile for responsibly disclosing these issues to the security team.

These issues were fixed by the WordPress core security team. Five other bugs were also fixed in version 3.3.2. Consult the change log for more details.

Download WordPress 3.3.2 or update now from the Dashboard → Updates menu in your site’s admin area.

WordPress 3.4 Beta 3 also available

Our development of WordPress 3.4 development continues. Today we are proud to release Beta 3 for testing. Nearly 90 changes have been made since Beta 2, released 9 days ago. (We are aiming for a beta every week.)

This is still beta software, so we don’t recommend that you use it on production sites. But if you’re a plugin developer, a theme developer, or a site administrator, you should be running this on your test environments and reporting any bugs you find. (See the known issues here.) If you’re a WordPress user who wants to open your presents early, take advantage of WordPress’s famous 5-minute install and spin up a secondary test site. Let us know what you think!

Version 3.4 Beta 3 includes all of the fixes included in version 3.3.2. Download WordPress 3.4 Beta 3 or use the WordPress Beta Tester plugin.

Download WordPress 3.4 Beta 2