توضیحات
100+ Elementor widgets & extensions for WordPress. Build stunning websites with WooCommerce tools, advanced UI elements, and regular updates.
تغییرات این نسخه
1.2.5
WordPress.org compliance: add TOPPPA_Elementor_Kses central sanitizer; all Elementor template/shortcode output uses wp_kses() at output time.
Fix escaping in scroll-to-top, mega menu titles, page title links, CF7/Woo/form shortcodes, theme builder admin labels, and CPT dashboard markup.
Rename unprefixed AJAX actions (topppa_handle_live_editor, topppa_check_temp_validity), option key (topppa_interactive_animations), and script/style handles (topppa-bootstrap, topppa-swiper, etc.).
Theme Builder SQL queries refactored to use $wpdb->prepare(); CPT refresh AJAX requires edit_posts.
1.2.4
Security/escaping pass for WordPress.org review: every flagged output now goes through a context-appropriate escape function (esc_url, esc_attr, esc_html, esc_html__, wp_kses with explicit allowlists).
Theme Builder conditions UI: escape every interpolated attribute and label inside the rule-builder template; replace echo $output; with wp_kses($output, ...) using a dedicated allowlist; switch __() to esc_html__() for the “Select” placeholder.
Elementor link outputs in Button, Flip Box, Advanced Tab, Pricing Table, Icon Box, Item Box, and Team widgets no longer rely on echo $this->get_render_attribute_string(); URLs and link relations are now built and escaped explicitly with esc_url() / esc_attr().
Testimonial widget: wrap every rating_render() output with wp_kses() allowing only <i> with class / aria-hidden.
Product Cart Button widget: rewrite the variations <form> output so eve
WordPress.org compliance: add TOPPPA_Elementor_Kses central sanitizer; all Elementor template/shortcode output uses wp_kses() at output time.
Fix escaping in scroll-to-top, mega menu titles, page title links, CF7/Woo/form shortcodes, theme builder admin labels, and CPT dashboard markup.
Rename unprefixed AJAX actions (topppa_handle_live_editor, topppa_check_temp_validity), option key (topppa_interactive_animations), and script/style handles (topppa-bootstrap, topppa-swiper, etc.).
Theme Builder SQL queries refactored to use $wpdb->prepare(); CPT refresh AJAX requires edit_posts.
1.2.4
Security/escaping pass for WordPress.org review: every flagged output now goes through a context-appropriate escape function (esc_url, esc_attr, esc_html, esc_html__, wp_kses with explicit allowlists).
Theme Builder conditions UI: escape every interpolated attribute and label inside the rule-builder template; replace echo $output; with wp_kses($output, ...) using a dedicated allowlist; switch __() to esc_html__() for the “Select” placeholder.
Elementor link outputs in Button, Flip Box, Advanced Tab, Pricing Table, Icon Box, Item Box, and Team widgets no longer rely on echo $this->get_render_attribute_string(); URLs and link relations are now built and escaped explicitly with esc_url() / esc_attr().
Testimonial widget: wrap every rating_render() output with wp_kses() allowing only <i> with class / aria-hidden.
Product Cart Button widget: rewrite the variations <form> output so eve