توضیحات
Team plugin to showcase team members, sports rosters, or creative portfolios with grid, list, Slider, table layout. Supports Corporate and Sports Leag …
تغییرات این نسخه
2.6.9
Security: Fixed Broken Access Control / CSRF (CVE-2025-58222) — the bundled Freemius SDK reset the usage-tracking opt-in (“reset anonymous mode”) from a plain link, with no nonce or capability check, so a crafted link or a logged-out request could reset it. It now requires an administrator and a confirmed, nonce-protected request
Security: Hardening — unauthenticated requests can no longer make the plugin write files or settings (the generated team.css was rewritten on every page view; role capabilities, the post-update routine and migration scheduling could be triggered by logged-out admin-ajax.php requests)
Security: Debug log is now stored under a non-guessable file name in a folder that blocks web access, and no longer records webhook signatures or member contact details; custom log paths must end in .log
Security: CSV export neutralises spreadsheet formulas (cells starting with =, +, -, @), which also keeps phone numbers like +1-555… intact in Excel
Security: “Open links in new window” now adds rel=”noopener noreferrer”
Fix: “Open links in new window” produced a broken target attribute, so links reused one named tab
Fix: A CSV exported by the plugin can now be imported again (the file’s UTF-8 BOM made the header check fail)
Fix: Elementor Team widget “Read More” button now shows by default and hides when single member view is disabled (the condition was inverted in every layout)
Fix: Elementor Team widget List Style 3 (Pro) links the photo and Read More to
Security: Fixed Broken Access Control / CSRF (CVE-2025-58222) — the bundled Freemius SDK reset the usage-tracking opt-in (“reset anonymous mode”) from a plain link, with no nonce or capability check, so a crafted link or a logged-out request could reset it. It now requires an administrator and a confirmed, nonce-protected request
Security: Hardening — unauthenticated requests can no longer make the plugin write files or settings (the generated team.css was rewritten on every page view; role capabilities, the post-update routine and migration scheduling could be triggered by logged-out admin-ajax.php requests)
Security: Debug log is now stored under a non-guessable file name in a folder that blocks web access, and no longer records webhook signatures or member contact details; custom log paths must end in .log
Security: CSV export neutralises spreadsheet formulas (cells starting with =, +, -, @), which also keeps phone numbers like +1-555… intact in Excel
Security: “Open links in new window” now adds rel=”noopener noreferrer”
Fix: “Open links in new window” produced a broken target attribute, so links reused one named tab
Fix: A CSV exported by the plugin can now be imported again (the file’s UTF-8 BOM made the header check fail)
Fix: Elementor Team widget “Read More” button now shows by default and hides when single member view is disabled (the condition was inverted in every layout)
Fix: Elementor Team widget List Style 3 (Pro) links the photo and Read More to