Privilege escalation (CVSS 9.8, unauthenticated). A guest registration could overwrite the new account's wp_capabilities row by posting a field name containing a Unicode homoglyph in place of an ASCII letter (e.g. U+0209 replacing 'i' in wp_capabilities). MySQL's accent-insensitive meta_key collation matched the mutated key to the real wp_capabilities row, and the previous remove_accents denylist did not cover all characters in that equivalence class. Fixed in two layers: (1)…
Stability fix: PHP warning "Attempt to read property 'post_name' on null" on archive pages, 404s, and any non-single-post context. get_post returns null on these pages; the userpro_title_tag filter was reading $post->post_name without a null guard, emitting the warning in the site header whenever UserPro was active but no post was in context. (functions/hooks-actions.php)
Stability fix: member directory now survives malformed page/search input. ?userp=abc, ?userp =1 and ?searchuser =x previously caused a PHP 8 fatal (500); ?userp=-1 produced a negative SQL LIMIT. Page numbers are now cast with absint and a non-string search is ignored. Same absint guard applied to the Enhanced Member Directory / collage emd-page parameter.
Removed dead get_pending_verify_requests_count function from admin/admin.php (zero callers; duplicate of the patched function in the requests addon).
Correção
Member directory custom-field sort now sorts and paginates in the database query (meta_key + orderby=meta_value). Previously every matching user was fetched, sorted in PHP, then sliced, and the pagination total was miscalculated (page links ran to hundreds of empty pages).
Enhanced Member Directory and collage now count matches with a single COUNT query instead of fetching every matching user to count them (same fix already applied to the core member directory).
Userpro_badges_admin_users is now capped at 500 rows via the userpro_badges_admin_users_limit filter (previously fetched every account on the site). Full user objects are kept so the badge user dropdowns still show email addresses and load in a handful of queries.
The profile picture/file crop AJAX now receives the security nonce from the front-end script, so uploads keep working with the new nonce check.
The legacy userpro_sc_follow / userpro_sc_unfollow AJAX actions called a non-existent method and fataled on every request; they now use the same follow API as the current handler (and still force the follower to the logged-in user).
UserPro admin screen now shows the correct version number (was stuck at 5.1.11).
Restored bundled cacert.pem files (Campaign Monitor, Twitter libs) and corrected the package folder name to "userpro" so uploads replace the existing plugin instead of installing a second copy.
Segurança
SQL injection in the front-end post publish flow. The lookup query in the 'publish' AJAX action concatenated post_content (which passes through wp_kses without escaping quotes) into raw SQL; now uses $wpdb->prepare. Reachable by any logged-in user.
Privilege/trust meta can no longer be set through a self-service profile save. A denylist (filter: userpro_protected_profile_meta) blocks userpro_verified, account status, connection lists, secret key, badge and social-id meta from the profile-edit POST for non-admins. Previously any logged-in user could set userpro_verified=1 on their own account.
The role-change guard in userpro_update_user_profile used is_admin, which is always true during admin-ajax, so it never fired. Role changes via profile save now require the promote_users capability.
Userpro_crop_picupload AJAX action now requires a valid nonce (previously none) and escapes the file link it returns (reflected XSS via the src parameter).
SQL injection in the badges comment-count query (count_user_comments) now uses $wpdb->prepare with an integer cast.
Social follow/unfollow AJAX now requires login and always uses the current user as the follower (previously the follower id was taken from the request, letting anyone forge follow relationships between any users).
User_id in the display-badges and post-sort AJAX actions is cast with absint.
Userpro_reset_option and userpro_user_invite AJAX actions now require the manage_options capability. Both were registered for logged-out users and gated by the public nonce only, so any visitor could reset all plugin settings or send invitation emails to arbitrary addresses.
The protected-profile-meta check is now case-insensitive, so variants like Userpro_Verified can no longer slip a value into the real (case-insensitively matched) meta row.
Versão 5.1.13
1 melhoria5 correções
Melhoria
Removed dead get_pending_verify_requests_count function from admin/admin.php (zero callers; duplicate of the patched function in the requests addon).
Correção
Memberlist pagination now applies to custom-field sort keys (previously number/offset were only set for built-in sort keys, leaving custom-field-sorted member directories completely unbounded).
Member directory search/filter total-count now uses a single COUNT query instead of fetching up to 10,000 full user records.
Userpro_badges_admin_users now fetches only ID and user_login, capped at 500 rows via the userpro_badges_admin_users_limit filter (previously fetched full WP_User objects for every account).
"Delete badge from all users" now fetches only user IDs before the per-user write loop (previously hydrated full WP_User objects).
User Requests admin panels (both old and new) now use a COUNT query for the pending-user header badges and cap the display list at 200 rows (previously fetched all pending users unbounded).
Versão 5.1.12
1 melhoria2 correções
Melhoria
Seven additional unbounded user queries identified across the plugin remain unpatched in this release (see addons/badges, functions/memberlist- functions.php, admin/panels/requests.php). Treat large Badges admin screens and filtered/sorted member directories as high-risk on installs with 2000+ users until a follow-up release addresses them.
Correção
Userpro_rd_get_users now requests only ID and user_login (previously fetched full WP_User objects and primed the user-meta cache for every account on the site). Row count capped at 500 via the new userpro_rd_users_dropdown_limit filter. A visible truncation notice renders when the limit is hit. Output is now escaped with esc_attr/esc_html.
Get_pending_verify_requests_count_only replaced two unbounded get_users calls (run on every admin page load) with a single WP_User_Query using count_total=true. One COUNT query, zero rows fetched, zero user-meta cache priming.
Issue that caused settings tabs to not display in the UserPro settings page.
Versão 5.1.10
4 correções1 reforço de segurança
Correção
Register shortcode register_redirect fix.
Register Ajax error.
Saving Groups & Fields undefined key warning fix.
Error while viewing followers.
Segurança
Security fix.
2024
3 versões
Versão 5.1.9
1 melhoria1 correção
Melhoria
Improved stability of user password changes.
Correção
Login shortcode login_redirect fix.
Versão 5.1.8
1 reforço de segurança
Segurança
Security fix.
Versão 5.1.7
2 correções1 reforço de segurança
Correção
User profile saving fields issue.
Invitation to register disabled issue.
Segurança
Security fix.
2023
6 versões
Versão 5.1.6
1 correção1 reforço de segurança
Correção
User invitation issue.
Segurança
Security fix
Versão 5.1.5
1 reforço de segurança
Segurança
Security fix
Versão 5.1.4
1 correção
Correção
Users profile view issue.
Versão 5.1.3
2 correções
Correção
Fixed user registration issue.
Fixed user login redirect issue.
Versão 5.1.2
2 melhorias1 reforço de segurança
Melhoria
Improved Facebook login security
Improved compatibility with php 8.2
Segurança
Security fix
Versão 5.1.1
2 correções1 reforço de segurança
Correção
Fixed custom user role field error.
Fixed empty label in a field issue.
Segurança
Security fix
2022
5 versões
Versão 5.1.0
1 melhoria1 correção
Melhoria
Increased datepicker date range.
Correção
Fixed "Change your Password" forms design issues.
Versão 5.0.1
1 correção
Correção
Fixed "Forgot your password?" and "Already a member?" forms design issues.
Versão 5.0.0
2 melhorias1 correção
Melhoria
This update is for Memberlist layouts for UserPro addon plugin.
Guzzle 7.4.5 - PHP HTTP client library.
Correção
Fixed redirect to login page after clicking on "Already a member?".
Versão 4.10.1
1 melhoria
Melhoria
Support with newer PHP version and code more readable.
Versão 4.9.41
1 novidade2 melhorias1 correção
Novidade
Icons: Added extra space.
Melhoria
Buttons: Changed alignment.
Text: Changed alignment.
Correção
Dropdown.
2021
1 versão
Versão 4.9.40
1 melhoria6 correções2 reforços de segurança
Melhoria
Date to age converter is now more dynamic with separators
Correção
Min length validation (empty fields will no longer pass it)
EMD filter with select field - no longer adds backslash to apostrophe or doesn't work
Request verification
Some servers had issues with google oAUTH file import
WPML ?lang format issue with profiles/redirects
Warning in a file "fields-functions"
Segurança
User posts
Reset password by URL will always return generic response
2020
4 versões
Versão 4.9.39
5 melhorias5 correções
Melhoria
Twitter social connect
Google social connect
Date to age converter now supported in EMD
Licensing page response, after submit
"popup-login,register" have been renamed to "popup_userpro-login,register" to avoid incompatibility
Correção
Incompatibility with social connect - facebook in popup window
Date to age converter minor issues
Javascript error "undefined variable"
WordPress 5.6 incompatibility with popup-login,register
Multiselect field - "required" option
Versão 4.9.38
1 novidade7 melhorias7 correções
Novidade
Option to convert datepicker value to age in user profile
Melhoria
LinkedIn social connect v2
Removed CURL notice in licensing page (no longer used)
Datepicker format validation
Add new connection now returns "Pending request" instead of "Undefined"
Country now can be de-selected by users
File upload field "allowed extensions" now can be edited
Function "post_thumb" accepts more parameters and can be used via template override
Correção
File/Picture upload no longer ignores size limit
MultiSelect field now works with required option
Follow - unfollow issues
Pop-up registration - webcam issue
Incompatibility with MailChimp for WooCommerce plugin
Email is in use, when administrator edits another user
WordPress site health issue - The REST API encountered an error
Versão 4.9.37.1
1 correção
Correção
License activation in UserPro admin page
Versão 4.9.37
4 melhorias3 correções
Melhoria
Role-based fields no longer have adminstrator option
Mailchimp will now automatically unsubscribe upon deleted account
In registration settings, allowed roles, administrator is no longer available
Custom dropdown profile fields are now available for search in mobile versions
Correção
Email validation in edit profile
Mailchimp newsletter subscription not working
Datepicker is now hideable from public by user's choice
2019
10 versões
Versão 4.9.36
2 melhorias2 correções
Melhoria
Emd fields are available for translation in .po files
Email texts are available for translation, that are generated upon user interaction in .po files
Correção
Datepicker field not showing newer dates after picking older
Proffesional layout, show/hide fields now respond to user/userpro-admin interaction
Versão 4.9.35.1
1 correção
Correção
Remove files from Example dir.
Versão 4.9.35
2 correções1 reforço de segurança
Correção
The user export download link doesn't appear.
UserPro version not increased.
Segurança
Automatically remove Instagram example dir if dir exist.
Versão 4.9.34
1 melhoria10 correções
Melhoria
Refactor follow/unfollow functionality
Correção
(dot) symbol not allowed in username
Font awesome 5 version update, follow button ajax action refactor
Restricted content redirects on subdomain not working
No alert on reset options
Media manager add-on not working with professional layout
Webcam is not working on chrome/safari
User import not working even if file is .csv extension
Post by user title goes over the borders
Facebook login breaks if social features are disabled
Removed example Instagram library directory
Versão 4.9.33
1 novidade1 melhoria6 correções
Novidade
Added buttons to accept/deny all users at once who requesting/awaiting approval
Melhoria
Requesting/awaiting approval users design changes
Correção
Appearance of recaptcha
Appearance of connection slug
Restricted content redirects on subdomain not working
Block email from registration not working
Email field not trimmed
Auto badges for roles are not working
Versão 4.9.32
1 melhoria4 correções
Melhoria
Users exclude from list template.
Correção
Fields lock functionality is not working.
Redirects are not working after login/register.
Connection button reloads profile page.
User waiting approval can login to the website.
Versão 4.9.31.2
4 correções
Correção
FontAwesome 5 not working.
Manually add badge for user functionality returns Fatal error.
Restrict page functionality not working.
Admin top bar appears for all users.
Versão 4.9.31.1
2 correções
Correção
Emd layout not working.
Languages text domain not working.
Versão 4.9.31
2 novidades4 melhorias3 correções
Novidade
New profile layout.
Invited users list.
Melhoria
Added ability to disable Ajax for login and registration.
Admin dashboard styles changes.
Added CC emails to invite users functionality.
Added "Rejected User Email".
Correção
Modern layout styles breaks page design.
User invitation validations.
Fixed an issue where wp top bar wouldn't hide for non admins with back-end access.
Versão 4.9.30
1 correção
Correção
Removed GET parameter from Linkedin redirect url. -Fixed bug: Removed GET parameter from Google+ redirect url. -Fixed bug: Removed GET parameter from Instagram redirect url. -Fixed bug: Removed GET parameter from Twitter redirect url. -Fixed bug: Memberlist responsive issue.
2018
12 versões
Versão 4.9.29
1 correção
Correção
Google maps not working on user profile. -Fixed bug: Broken email invitation link. -Enhancement: MailChimp API version upgrade from 2.0 to 3.0.
Versão 4.9.28
1 reforço de segurança
Segurança
Register user with administrator role.
Versão 4.9.27
7 correções
Correção
Message "Please correct field" can't be translated.
Facebook login works only after the second click.
Removed deprecated function openssl_encrypt.
Registration ajax bug. If display name was empty redirect not working.
UserPro settings can't be cleared ( Roles that can edit other users profile, Roles that can view other profiles )
If user haven't email address get an error ( Trying to get property of non-object )
Conditional fields not working with select fields. ( Trying to get property of non-object )
Versão 4.9.26
2 melhorias1 correção
Melhoria
View user profile button on default WordPress User section
Pagination for User Request awaiting manual approval
