Mykyta Synelnikov fd44b978cf Refactor form sanitization to improve data handling. ...

Changed `wp_kses` to utilize 'user_description' instead of dynamic HTML templates, ensuring stricter sanitization. Introduced a new filter, `um_sanitize_form_submission`, for extending form sanitization logic, and preserved the original input in `$submission_input` for additional context.

2026-01-19 11:55:22 +02:00

..

rest

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-access.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-account.php

Fix: CVE-2025-14081 and update field filtering logic.

2025-12-05 18:08:59 +02:00

class-ajax-common.php

* maybe fixed CVE-2024-10528;

2024-11-05 11:55:07 +02:00

class-blocks.php

- fix restrictions for all blocks

2025-06-19 15:30:30 +03:00

class-builtin.php

- fix country name

2025-06-18 11:11:09 +03:00

class-cron.php

Fix invalid 'start_of_week' handling in weekly events logic

2025-09-05 15:24:28 +03:00

class-date-time.php

- finally reviewed #1361;

2023-12-01 12:50:13 +02:00

class-external-integrations.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

class-fields.php

- allow webp image format

2025-09-22 12:48:39 +03:00

class-files.php

Implement directory privacy settings and add rate limiting

2025-12-11 17:36:42 +02:00

class-fonticons.php

- FontIcons libraries moving to legacy;

2023-09-26 12:25:49 +03:00

class-form.php

Refactor form sanitization to improve data handling.

2026-01-19 11:55:22 +02:00

class-gdpr.php

- partially reviewed #1361;

2023-11-30 10:55:00 +02:00

class-login.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-logout.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-mail.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-member-directory-meta.php

Implement directory privacy settings and add rate limiting

2025-12-11 17:36:42 +02:00

class-member-directory.php

Reduce hash length and add user token management functions

2025-12-16 17:05:51 +02:00

class-multisite.php

- fixed scroll via enqueue new scroll library;

2019-05-02 18:29:00 +03:00

class-options.php

- WPCS;

2024-03-07 14:56:55 +02:00

class-password.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-permalinks.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-plugin-updater.php

* updated requests to site URL;

2025-01-31 15:19:28 +02:00

class-profile.php

Add new hooks, refactor workflows, and deprecate unused functions

2025-06-25 16:01:08 +03:00

class-query.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-register.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-rewrite.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00

class-roles-capabilities.php

* fixed um_current_user_can();

2024-11-15 11:16:55 +02:00

class-setup.php

Refactor batch action scheduling for account status updates (#1692)

2025-06-18 15:17:19 +03:00

class-shortcodes.php

Merge branch 'development/2.9.x' into fix/CVE-2025-13220

2025-12-16 17:13:37 +02:00

class-templates.php

- WPCS for defined constants;

2023-09-13 22:56:32 +03:00

class-uploader.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-user-posts.php

Implement directory privacy settings and add rate limiting

2025-12-11 17:36:42 +02:00

class-user.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-validation.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-actions-access.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-actions-account.php

Prevent shortcode execution in user input sanitization.

2025-06-24 17:16:28 +03:00

um-actions-form.php

Fix email validation logic in Ultimate Member forms

2025-06-25 18:09:48 +03:00

um-actions-global.php

* added honeypot scripts/styles via

2025-01-30 13:00:17 +02:00

um-actions-login.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-misc.php

* added security condition to check that one logged-in user cannot activate another one user via email activation link;

2024-10-11 18:47:40 +03:00

um-actions-profile.php

Add $args and $user_id to 'um_after_profile_header_name'

2025-12-02 10:27:13 +02:00

um-actions-register.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-save-profile.php

* fixed #1434;

2024-09-26 17:39:57 +03:00

um-actions-user.php

- added escape functions, security fix for XSS;

2019-08-08 00:36:33 +03:00

um-actions-wpadmin.php

- intermediate results with sanitizing form handlers;

2021-06-29 02:51:54 +03:00

um-filters-account.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-filters-avatars.php

* reviewed #1582;

2024-11-13 17:20:52 +02:00

um-filters-commenting.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

um-filters-fields.php

Fix: Address CVE-2025-13217 and improve input sanitization

2025-12-05 17:56:45 +02:00

um-filters-files.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-login.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-filters-misc.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-navmenu.php

- fixed conditional menu handlers for MegaMenu themes (#1334);

2024-01-04 00:54:19 +02:00

um-filters-profile.php

* fixed deprecated function

2024-09-27 18:01:58 +03:00

um-filters-user.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00