توضیحات
Free: WC Wishlist, Email automation, Elementor Widgets. Premium: Back-in-Stock Notifier, Save for Later, Multi-lists, Reports, Email Marketing.
تغییرات این نسخه
1.9.21
Tested: WC 10.9.4
Added: Added nonce validation for delete_item and load_fragments AJAX actions to prevent cross‑site request forgery (CSRF).
Added: Enforced current_user_can( ‘manage_options’ ) capability checks on all administrative AJAX endpoints to ensure only authorized users can trigger them.
Fixed: Escaped all echo do_shortcode() outputs using wp_kses_post to mitigate potential XSS vulnerabilities.
1.9.20
Added: New filter “wlfmc_disable_pagination_on_drag_drop” to control whether Drag & Drop automatically disables pagination.
Updated: Pagination now stays active by default when Drag & Drop is enabled, instead of being overridden.
Tweak: Refactored conditional logic to apply the new filter, preserving legacy behavior when filter returns true.
Fixed: Unauthenticated Stored XSS vulnerability in variation attributes by implementing proper validation and sanitization using WooCommerce core functions before storing data in product_meta.
Fixed: Missing CSRF protection by adding mandatory Nonce validation for all AJAX endpoints.
Added: Nonce tokens to all frontend AJAX requests for enhanced security.
Improved: Output escaping for variation data on the wishlist page (wp_kses_post) as a defense-in-depth measure.
Tweak: Updated JavaScript to seamlessly handle new Nonce tokens with every AJAX call.
1.9.19
Tested: WC 10.8.1
Tweak: Upgraded the internal SVG sanitization dependency (enshrined/svg-sanitize) to version ^0.22.0 for improved security auditing and
Tested: WC 10.9.4
Added: Added nonce validation for delete_item and load_fragments AJAX actions to prevent cross‑site request forgery (CSRF).
Added: Enforced current_user_can( ‘manage_options’ ) capability checks on all administrative AJAX endpoints to ensure only authorized users can trigger them.
Fixed: Escaped all echo do_shortcode() outputs using wp_kses_post to mitigate potential XSS vulnerabilities.
1.9.20
Added: New filter “wlfmc_disable_pagination_on_drag_drop” to control whether Drag & Drop automatically disables pagination.
Updated: Pagination now stays active by default when Drag & Drop is enabled, instead of being overridden.
Tweak: Refactored conditional logic to apply the new filter, preserving legacy behavior when filter returns true.
Fixed: Unauthenticated Stored XSS vulnerability in variation attributes by implementing proper validation and sanitization using WooCommerce core functions before storing data in product_meta.
Fixed: Missing CSRF protection by adding mandatory Nonce validation for all AJAX endpoints.
Added: Nonce tokens to all frontend AJAX requests for enhanced security.
Improved: Output escaping for variation data on the wishlist page (wp_kses_post) as a defense-in-depth measure.
Tweak: Updated JavaScript to seamlessly handle new Nonce tokens with every AJAX call.
1.9.19
Tested: WC 10.8.1
Tweak: Upgraded the internal SVG sanitization dependency (enshrined/svg-sanitize) to version ^0.22.0 for improved security auditing and