diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php index 89ff081e..d34a789f 100644 --- a/includes/core/class-shortcodes.php +++ b/includes/core/class-shortcodes.php @@ -672,6 +672,22 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) { $args['form_id'] = ! empty( $args['form_id'] ) ? absint( $args['form_id'] ) : ''; $args['is_block'] = (bool) $args['is_block']; + $form_post = get_post( $args['form_id'] ); + // Invalid post ID. Maybe post doesn't exist. + if ( empty( $form_post ) ) { + return ''; + } + + // Invalid post type. It can be only `um_form` or `um_directory` + $post_types = array( 'um_form' ); + if ( UM()->options()->get( 'members_page' ) ) { + $post_types[] = 'um_directory'; + } + + if ( ! in_array( $form_post->post_type, $post_types, true ) ) { + return ''; + } + /** * Filters variable for enable singleton shortcode loading on the same page. * Note: Set it to `false` if you don't need to render the same form twice or more on the same page. diff --git a/readme.txt b/readme.txt index f9f1fd71..1ff20ae1 100644 --- a/readme.txt +++ b/readme.txt @@ -190,6 +190,8 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI * Fixed: Email changing via User Account flush session. Security enhancement because email can be used for login * Fixed: User Profile image URL in meta tags * Fixed: Empty User Profile and PHP Fatal error when cannot get profile field data +* Fixed: Parsing /modal/ templates and parsing templates on the Windows hosting +* Fixed: Validation `form_id` attribute in the `ultimatemember` shortcode **Templates required update**