Ultimate Member

• Enhancements:

  • Added: $form_id parameter to the action hooks um_before_form, um_before_{$mode}_fields, um_main_{$mode}_fields, um_after_form_fields, um_after_{$mode}_fields and um_after_form.
  • Added: Action hook um_before_render_dynamic_modal_content for 3rd-party integration when the admin popup is opened.
  • Added: Filter hooks um_email_validation_real_error_codes and um_email_validation_error_message for 3rd-party integration to change or make visible the real error message for email fields validation.
  • Added: Threads field support in the UM Forms and Social Icons meta-row.

• Bugfixes:

  • Fixed: Security issue related to an unauthenticated PHP Object Injection vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added um_maybe_unserialize() function.
  • Fixed: Security issue related to administrator Stored SQL Injection via Directory Search-Field Identifiers. (Reported by Ananda Dhakal (Patchstack)). Added sanitizing for the searching fields in the member directory.
  • Fixed: Security issue related to an unauthenticated Improper Enforcement of Behavioral Workflow vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added unique nonce fields and attributes for requests.
  • Fixed: CVE-2026-96270 security issue. Added sanitizing for the form_id attribute during the Ultimate Member forms submission. (Reported by Wordfence).
  • Fixed: CVE-2026-93428 security issue. Fixed fields privacy when displaying the User Profile fields. (Reported by Wordfence).
  • Fixed: Security issue related to Privilege Escalation. Fixed user account submission and nonce security. Reset the user if it hasn't the ability to download the file. (Reported by Intrudify (Patchstack)).
  • Fixed: is_url() validation for the social links fields.
  • Fixed: unique_email validation. Parse primary and secondary email fields to make the email unique between them.

• Templates Requiring Update:

  • profile/comments.php
  • profile/posts.php
  • login.php
  • members.php
  • profile.php
  • register.php

• Deprecated:

  • Deprecated: UM()->check_ajax_nonce and UM()->admin()->check_ajax_nonce() functions. Use WordPress native wp_verify_nonce(), check_admin_referer() and check_ajax_referer() instead with unique nonce field values. Left them now for backward compatibility.
  • Deprecated: Using um_admin_scripts.nonce and um_scripts.nonce localized data in UM scripts. Left them still localized for backward compatibility.
  • Deprecated: JS common action for '.um-ajax-action' class. It's not used anymore in UM core and extensions and can be removed the same as AJAX handler for um_muted_action.
  • Deprecated: Action hook um_run_ajax_function__{$hook} used in the um_muted_action handler.
  • Marked as deprecate soon: in_group attribute for the fields in the UM Forms builder.

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Fallback for wp-cli/wp-config-transformer library if the wp-config.php file isn't writable.
  • Added: Filter hook um_members_directory_filter_text 3rd parameter $is_default to check if it's admin filtering or frontend query.
  • Added: 'Administrative capabilities ban' option enabled by default after the first installation.
  • Optimized: Slow SQL query for batch empty account status check.
  • Optimized: Set the recurring action for account status check as unique.
  • Optimized: Redundant SQL calls when editing Profile page with callback dropdowns. Cached usermeta existence checks per user and key during a single load (Reported by @MissVeronica, author @faisalahammad).

• Bugfixes:

  • Fixed: Security issue related to an unauthenticated visitor can store JavaScript that runs in an administrator's session, through their own profile name. (Reported by Karthik Ramakrishnan and WPScan team). Fixed um_convert_tags() function and applied the escapers throughout the placeholder replacement.
  • Fixed: Using LIKE compare for the text-type filters with custom usermeta table (Reported by @MissVeronica, author @faisalahammad).
  • Fixed: "Can user edit this field?" field setting displaying only for the User Profile form fields.
  • Fixed: Getting the pages list in the wp-admin UM > Settings > General > Pages section.
  • Fixed: Displaying the field-type time on the User Profile page.
  • Fixed: Using illegal_user_logins for current admin user with the username specified in the illegal user logins list.

• Deprecated:

  • Deprecated: Filter hook um_members_directory_filter_text_meta_value is fully deprecated, replacement isn't required for the text-type filter field.

• Enhancements:

  • Added: Using illegal_user_logins filter to sanitize the user_login field value during registration or upgrade.
  • Added: Using wp-cli/wp-config-transformer library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
  • Added: New user-capabilities functions UM()->common()->users()->can_view_user(), UM()->common()->users()->get_privacy_setting(), UM()->common()->users()->is_user_profile_private(), UM()->common()->users()->get_restricted_privacy_notice(), UM()->common()->users()->can_view_private_user_profile(), UM()->common()->users()->can_view_user_profile(). The future replacement for the um_can_view_profile() helper with different cases to check.
  • Updated: Version of the WordPress native excluded functions to avoid the using them in the callbacks.

• Bugfixes:

  • Fixed: WP_Filesystem() initialization optimization. Init WP_Filesystem() only once when it's necessary.
  • Fixed: Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
  • Fixed: Registration form infinite loop - gdpr-register.php calls the_content recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
  • Fixed: Causes site-wide rest_cookie_invalid_nonce on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized um_admin_scripts.nonce globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
  • Fixed: Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
  • Fixed: Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
  • Fixed: Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields.
  • Fixed: Member Directory type-button styles.
  • Fixed: Added fallback for the date and time fields to show date and time using the WordPress native format.

• Templates Requiring Update:

  • gdpr-register.php
  • profile.php

• Deprecated:

  • Deprecated: Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native <input type="date" /> and <input type="time" /> instead.

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value.
  • Added: The API key field type for the settings fields.

• Bugfixes:

  • Fixed: Security issue, CVE ID: CVE-2026-4248. Extern blacklist filter for convert_tag replace placeholders function. (Additional keys were researched by Hrro. This info added for the Wordfence team if they need this information).
  • Fixed: Security issue when accidentally manage_options level user role can be listed in the User Role dropdown on the registration/edit profile forms. (Researched by Haitam Lazaar).
  • Fixed: Set size proportions during responsive handlers.
  • Fixed: mousewheel action during member directory loading and overlay is displayed.
  • Fixed: WP_Styles notice due to not loaded um_modal styles.
  • Fixed: oEmbed-type field styles.

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Bugfixes:

  • Fixed: Security issue, CVE ID: CVE-2026-7761.
    • Restricted get_directory_by_hash() function to only match posts with post_type='um_directory' and publish post status.
    • Used 0 === strpos() instead of strstr() for getting proper post_data.
    • Added condition for getting only allowed fields in tagline_fields and reveal_fields to build_user_card_data().
  • Fixed: Security issue, CVE ID: CVE-2026-8489.
    • Used WordPress native wp_kses() escaper for displaying user_description field. Used WordPress native make_clickable() function to make raw links clickable.
  • Fixed: Security issue, CVE ID: CVE-2026-xxxx. Make the role and status visible for the user who can edit these users in the request. Reported by Ben Tamam.
  • Fixed: Remove UM option function when the option value equals "0".

• Deprecated:

  • Temporary deprecated: UM REST API. Legacy feature that has to be refactored. Will be refactored and re-released soon.

• Enhancements:

  • Added: Checking format of the 3rd-party registered custom fields. Avoid PHP errors related to the wrong format or unexpected attributes.

• Bugfixes:

  • Fixed: Added uploader fields accept argument for set allowed mime-types in the upload dialog window. Updated 3.1.2 version of this library hayageek/jquery-upload-file. Don't use 4.0.11 version for now.
  • Fixed: JS initialization of the empty uploader fields.
  • Fixed: User Profile URLs in the User Profile form on the not-predefined pages placed via shortcode.

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: UM > Settings > Advanced > APIs section for set available APIs settings.
  • Added: GoogleMaps API setting when it's available.
  • Added: Function UM()->mail()->enabled_email() for checking if the email notification is enabled by the user.
  • Added: color type of sanitize settings saved in wp-admin.
  • Added: Checking array type of submission data when url type of sanitize is used in wp-admin.
  • Added: Enhance UM form sanitization filter with $form_data param. Added the $form_data parameter to the um_sanitize_form_submission filter.
  • Added: Option for special character requirement for passwords. It's situated in "General > Users > Password requires special character" (based on @faisalahammad suggestions)
  • Added: Filter hook um_before_account_delete_text for changing before delete account text by 3rd-party plugins. End-customers can use it for translations.
  • Added: Filter hook um_custom_{$message_key} (um_custom_pending_message, um_custom_checkmail_message) for changing after-registration message based on the user status by 3rd-party plugins. End-customers can use it for translations.
  • Added: Filter hook um_convert_tags_blacklist_fields For 3rd-party integrations to control the usermeta keys in um_convert_tags() function.
  • Added: .um-display-none CSS utility + umShow()/umHide()/umToggle() jQuery helpers.
  • Added: um-notice JS library.

• Bugfixes:

  • Fixed: Security issue, CVE ID: CVE-2026-4248. Added blacklist filter for convert_tag replace placeholders function.
  • Fixed: HTML sanitization logic for textarea-type custom fields with enabled HTML using setting.
  • Fixed: WP editor formatting to prevent incorrect HTML entity conversion when using html-mode in the textarea-type custom fields. Applied and removed this filter dynamically to avoid interfering with other processes.
  • Fixed: Dynamic string translation pattern and improve escaping. Replaced incorrect __('%s') pattern. (@faisalahammad)
  • Fixed: wp_die() function triggering on the frontend actions. Added UM notice above the User Profile page. (based on @faisalahammad suggestions)
  • Fixed: Password reset key handling for multiple users. Previously, the static reset key caused issues when handling password resets for multiple users simultaneously.
  • Fixed: um_trim_string() function for using with UTF-8 symbols.
  • Fixed: PHP Notice: Function WP_Scripts::add was called incorrectly.

• Templates Requiring Update:

  • members.php
  • message.php
  • restricted-blog.php
  • restricted-taxonomy.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Server-side validation when the Search Form is submitted.
  • Added: Action hook um_approve_user_on_email_confirmation to natively approve the user after validating the email activation link.
  • Added: JS filter wp.hook um_member_directory_popstate_ignore to stop window.pushSate in the member directory for 3rd-party integrations.

• Bugfixes:

  • Fixed: Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It's still allowed to use only predefined 'user_description' tags in wp_kses().
  • Fixed: Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.
  • Fixed: Profile photo dropdown menu position for screens smaller than 340px.
  • Fixed: Display of the saved value of the "Privacy Options" > "Allowed roles" setting for the member directory.
  • Fixed: Information in Site-Health about the registration form's Template and Role settings.
  • Fixed: Information in Site-Health about the login and profile form's Template settings.

• Templates Requiring Update:

  • members.php
  • searchform.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: 'Privacy Options' for Member Directory. 'Who can see this member directory' and 'Allowed Roles'.
  • Added: 'Rate Limit' setting for nopriv AJAX actions.

• Bugfixes:

  • Fixed: Security issue CVE ID: CVE-2025-13220. Used shortcode_atts() function to avoid using wrong attributes.
  • Fixed: Security issue CVE ID: CVE-2025-13217. Implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds.
  • Fixed: Security issue CVE ID: CVE-2025-14081. Filtering fields based on user permissions during Account form submission.
  • Fixed: Security issue CVE ID: CVE-2025-12492. Added directory privacy settings and added rate limiting.

• Templates Requiring Update:

  • members.php
  • members-grid.php
  • members-list.php

• Enhancements:

  • Added: Extra condition for checking the license activation requests.
  • Added: 2nd $args attribute to the action hook 'um_cover_area_content'.
  • Added: $args and $user_id attributes to the action hook 'um_after_profile_header_name'.
  • Added: Class um-profile-subnav-{$subnav_id}-link to the sub navigation links in the User Profile page.
  • Tweak: Updated Extensions_Updater class to use Action Scheduler in the upgrade process of the UM extensions.

• Bugfixes:

  • Fixed: User profile links in the comments section on the frontend when the $comment->user_id is empty.
  • Fixed: The emotize function regexp for better emoji converting.
  • Fixed: The conflict between the image uploader and lazy-loading attribute added by 3rd-party plugins.
  • Fixed: PHP warnings for roles without meta data.
  • Fixed: Typo in labels.

• Enhancements:

  • Added: Avoid caching of the UM Forms on the mobile devices via adding the nocache headers to the screens with UM Forms.
  • Added: Filter hook um_get_empty_status_users_query_result for changing default query on the different websites to optimize it.
  • Added: Filter hook um_admin_settings_get_pages_list_args for changing WP_Query arguments for getting pages visible in the dropdown fields in UM Settings.
  • Added: JS filter hook um_admin_blocks_prefixes_excluded for excluding 3rd-party Gutenberg blocks with predefined prefixes from UM restriction arguments.
  • Added: WebP file-extension support for UM uploader.
  • Added: UM_LICENSE_REQUEST_DEBUG constant for debugging license activation process when it's needed.
  • Added: Extensions_Updater class to standardize the upgrade process in UM extensions.
  • Added: Sanitize handlers sanitize_array_key_int and sanitize_array_key for making sanitize in UM extensions' settings.

• Bugfixes:

  • Fixed: Changed the view and the edit user profile links in the comments section on the frontend.
  • Fixed: Contains conditional logic operand when value is array.
  • Fixed: Getting cover_size for displaying it in the member directory card.
  • Fixed: Filter's range for numeric-type fields to avoid getting the empty values.
  • Fixed: Integer validation for the 'start_of_week' WP native setting.
  • Fixed: Dependencies with Action Scheduler library.

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Filter hook um_password_reset_form_primary_btn_classes for primary button classes in UM Password Reset form.
  • Added: Filter hook um_login_form_primary_btn_classes for primary button classes in UM Login form.
  • Added: Filter hook um_register_form_primary_btn_classes for primary button classes in UM Registration form.
  • Tweak: Refactored Site Health data, added hooks for 3rd-party integration.
  • Tweak: Avoid using um_user( 'password_reset_link' ) and make it directly with UM()->password()->reset_url( $user_id ) for getting a proper reset URL.
  • Tweak: Avoid using um_user( 'account_activation_link' ) and make it directly with UM()->permalinks()->activate_url( $user_id ) for getting a proper activation URL.

• Bugfixes:

  • Fixed: Stripped shortcodes in the user data during the Account, Registration and Profile forms submission. (Thanks to MissVeronica)
  • Fixed: Email placeholders values.
  • Fixed: Refactor deactivation logic to un-schedule Action Scheduler actions.
  • Fixed: Action Scheduler library errors. Updated to the recent 3.9.2 version.
  • Fixed: Secondary email field validation.
  • Fixed: Action Scheduler batch actions with users who have Undefined status.
  • Fixed: Restrictions for 3rd-party Gutenberg Blocks.
  • Fixed: Date/time picker filter-types range query on Member Directories.
  • Fixed: Renamed "Macedonia, the former Yugoslav Republic of" to the official "North Macedonia".

• Deprecated:

  • Fully deprecated account_activation_link_tags_patterns( $placeholders ) function. It's not used previously. Used email function arguments instead.
  • Fully deprecated account_activation_link_tags_replaces( $replace_placeholders ) function. It's not used previously. Used email function arguments instead.
  • Fully deprecated UM()->profile()->add_placeholder() function. Used email function arguments instead.
  • Fully deprecated UM()->profile()->add_replace_placeholder() function. Used email function arguments instead.
  • Fully deprecated UM()->user()->add_activation_placeholder() function. Used email function arguments instead.
  • Fully deprecated UM()->user()->add_activation_replace_placeholder() function. Used email function arguments instead.
  • Deprecated UM()->user()->maybe_generate_password_reset_key( $userdata ) function. Use UM()->common()->users()->maybe_generate_password_reset_key( $userdata ) instead.
  • Deprecated UM()->user()->set_last_login() function. Use UM()->common()->users()->set_last_login( $user_id ) instead.

• Templates Requiring Update:

  • password-reset.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Bugfixes:

  • Fixed: Security issue CVE ID: CVE-2025-47691. Used "sniccowp/php-scoper-wordpress-excludes" for getting the recent WordPress functions list and added them to the dynamic blacklist based on the WordPress version.
  • Fixed: The Action Scheduler action um_set_default_account_status. Case when some users were approved manually or deleted, and we need to reset the admin notice. Added error_log() to the wrong conditions.
  • Fixed: Reset Password request from not a predefined password reset page. It's possible to submit reset password form sitewide using block or shortcode.
  • Fixed: Setting 'Allow users to change email' for the Account page. It works now for any role instead of only the roles with 'Can edit other member accounts?' capability enabled.

• Enhancements:

  • Added: The Ignore the "User Role > Registration Options" setting. It provides an ability to auto-approve users if they were created via wp-admin > Users screen.
  • Tweak: Avoid email notifications to Administrator about user registration via wp-admin > Users screen.
  • Tweak: Updated the Action Scheduler implementation to improve flexibility and clarity. Refactor Action Scheduler for not only email handling.

• Bugfixes:

  • Fixed: Member Directory styles when it's rendered on the Gutenberg builder page.
  • Fixed: Member Directory filtering query when the custom users metatable is used.
  • Fixed: PHP Warning that occurs when using the getimagesize function with an image from an external source.
  • Fixed: Reset Password email notification's the {password_reset_link}` placeholder.
  • Fixed: Changed "Turkey" to the current official term "Türkiye".

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: UM()->common()->filesystem()::maybe_init_wp_filesystem(); method.
  • Added: UM()->common()->filesystem()::remove_dir(); method.

• Bugfixes:

  • Fixed: Security issue CVE ID: CVE-2025-1702. Reviewed general search scripts and suggested another solution that uses only $wpdb->prepare().

• Bugfixes:

  • Fixed: Security issue CVE ID: CVE-2025-1702.
  • Fixed: Activation link redirects to Reset Password after registration without password field and required email activation.
  • Fixed: Honeypot scripts/styles for themes without pre-rendered shortcodes. Enqueue honeypot scripts/styles everytime.
  • Fixed: Profile photo metadata when Gravatar image is used.

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: User Profile form-id attribute and updated code for Profile/Cover photos actions dropdowns.
  • Added: Honeypot scripts/styles via wp_add_inline_script(), wp_add_inline_style() changed from direct adding in header and footer.
  • Updated: We've made improvements to requests for extension updates to boost stability.
  • Updated: PHP requirement - the minimum PHP version is now upgraded to 7.0.
  • Updated: Using $wpdb and WPCS for queries. Set minimum required version to 6.2 due to using %i for $wpdb->prepare().
  • Updated: Revised wp-admin user actions handling. Now, the required capability is edit_users instead of manage_options.
  • Removed: User Profile hidden inputs on view mode.
  • Tweak: WPCS enhancements.

• Bugfixes:

  • Fixed: Security issue CVE ID: CVE-2024-12276.
  • Fixed: Custom usermeta table metakeys for filtering in member directory (from _money_spent to wc_money_spent_ and added wc_order_count_).
  • Fixed: Layout for "Download your data" and "Erase of your data" fields.
  • Fixed: Image sizes used for Open Graph meta in User Profile headers are now corrected.
  • Fixed: "Delete account text" settings visibility issue in wp-admin.
  • Fixed: The "Privacy Policy" field in the registration form. Disallowed HTML from the "Privacy Policy" content (like <form>) is filtered out by the wp_kses() function.
  • Fixed: Password fields are now sanitized the WordPress native way, with wp_unslash() omitted post-submission.

• Templates Requiring Update:

  • gdpr-register.php
  • profile.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Compatibility with the new Ultimate Member - Zapier extension
  • Added: Only approved user Reset Password setting defined as true by default
  • Added: UM()->is_new_ui() function for future enhancements related to new UI
  • Added: Filter hook um_before_user_submitted_registration_data
  • Tweak: Changed hook's priority for initialization of email templates paths
  • Tweak: Removed load_plugin_textdomain due to (article)[https://make.wordpress.org/core/2024/10/21/i18n-improvements-6-7/#Enhanced-support-for-only-using-PHP-translation-files]

• Bugfixes:

  • Fixed: Security issue CVE ID: CVE-2025-0308
  • Fixed: Security issue CVE ID: CVE-2025-0318
  • Fixed: Using placeholders in email templates when Action Scheduler is active. Using fetch_user_id attribute for fetching necessary user before sending email
  • Fixed: PHP 8.4 compatibility. Using WordPress native wp_is_mobile() instead of MobileDetect library
  • Fixed: PHP errors related to UM()->localize() function
  • Fixed: PHP errors in user meta header when last_update meta is empty
  • Fixed: Small CSS changes and avoid duplicates
  • Fixed: Removed ms-native show password button for type="password" field in UM forms
  • Fixed: Define scalable attribute for cropper

• Deprecated:

  • Fully deprecated UM()->mobile() function
  • Fully deprecated UM()->localize() function
  • Fully deprecated um_language_textdomain filter hook

• Templates Requiring Update:

  • account.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: um_image_upload_validation hook for 3rd-party validation during upload images

• Bugfixes:

  • Fixed: "Load textdomain just in time" issue
  • Fixed: Capabilities checking in the wp-admin > Users list table
  • Fixed: File/image upload on the role specific profile form
  • Fixed: Issues when the form's custom fields meta has a wrong format
  • Fixed: Validation of the "Registration Default Role" slug
  • Fixed: Allowed query variables via registered REST API class only when REST_REQUEST is defined

• Enhancements:

  • Added: Action Scheduler (version 3.8.1) for email sending. More info is here
  • Added: Supporting new wp_register_block_metadata_collection() function for registering WP Blocks

• Bugfixes:

  • Fixed: ajax_image_upload() and ajax_resize_image() handlers vulnerability. CVE ID: CVE-2024-10528
  • Fixed: Disabling user status column wp-admin > Users screen
  • Fixed: User status filter on wp-admin > Users on mobile devices
  • Fixed: Extra unwrapping of the WP Editor field's value

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Using PHP tidy extension (if it's active) to make HTML textarea value clear
  • Added: um_tidy_config filter hook for setting PHP tidy config
  • Tweak: Avoid using force set_status() function.
  • Tweak: Properly using UM()->common()->users()->get_status( $user_id ) instead of um_user( 'account_status' )
  • Tweak: Properly using UM()->common()->users()->get_status( $user_id, 'formatted' ) instead of um_user( 'account_status_name' )
  • Tweak: Properly using um_user( 'status' ) for getting user role setting while registration

• Bugfixes:

  • Fixed: UM tipsy removing inside .um-page selector (e.g. tipsy init from um-modal)
  • Fixed: Rollback using <iframe> for displaying HTML formatted textarea value
  • Fixed: Capability to edit user profile for Administrator when user doesn't have a capability to edit its profile
  • Fixed: Sending email notifications based on user status after registration
  • Fixed: PHP error when meta um_member_directory_data has a wrong format

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Bugfixes:

  • Fixed: Download routing initialization
  • Fixed: Textarea height and HTML formatted textarea field height isolated via <iframe> on view mode
  • Fixed: User registration if email activation or admin review are required
  • Fixed: First installation errors

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Single user actions on WP Users list table
  • Updated: User status filter on WP Users list table
  • Updated: User bulk actions on WP Users list table
  • Updated: User actions on User Profile and Member Directory card
  • Added: Applying shortcodes in the post restriction message
  • Added: ProfilePage Structured Data
  • Added: Ability to use HTML tags (allowed in wp_kses_post) in the global block restriction message
  • Changed: Some wp-admin fields descriptions
  • Updated: Data format in um_admin_bulk_user_actions_hook filter hook. Changed format from $action_slug => array( 'label' => $action_title ) to $action_slug => $action_title
  • Added: $old_status param to um_after_user_status_is_changed action hook
  • Added: $user_id param to um_before_user_hash_is_changed action hook
  • Added: $user_id, $hash, $expiration params to um_after_user_hash_is_changed action hook
  • Added: um_restricted_post_content filter hook
  • Added: um_loggedin_inner_content filter hook
  • Added: um_profile_dynamic_meta_profile_schema filter hook
  • Removed: UM()->fields()->get_restricted_fields_for_edit() function from a fields loop

• Bugfixes:

  • Fixed: Single user action on User Profile security vulnerability. CVE ID: CVE-2024-8520
  • Fixed: [um_loggedin] shortcode security vulnerability. CVE ID: CVE-2024-8519
  • Fixed: Performance issue related to Settings > Secure tab
  • Fixed: The "Clear All" button in the member directory did not reset all dependent dropdowns
  • Fixed: Telegram and Discord social links in profile header
  • Fixed: UM links to empty phone numbers
  • Fixed: Email changing via User Account flush session. Security enhancement because email can be used for login
  • Fixed: User Profile image URL in meta tags
  • Fixed: Empty User Profile and PHP Fatal error when cannot get profile field data
  • Fixed: Parsing /modal/ templates and parsing templates on the Windows hosting
  • Fixed: Validation form_id attribute in the ultimatemember shortcode

• Templates Requiring Update:

  • login-to-view.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Deprecated:

  • Hook: Action hook um_after_user_status_is_changed_hook. Use action hook um_after_user_status_is_changed instead.
  • Hook: Action hook um_when_status_is_set. Use action hook um_before_user_status_is_set instead.
  • Hook: Action hook um_admin_user_action_hook. Use filter hook um_handle_bulk_actions-users-{$current_action} for custom user bulk actions instead.
  • Hook: Action hook um_admin_user_action_{$bulk_action}_hook. Use filter hook um_handle_bulk_actions-users-{$current_action} for custom user bulk actions instead.
  • Hook: Action hook um_admin_custom_hook_{$action}. Use filter hook um_handle_bulk_actions-users-{$current_action} for custom user bulk actions instead.
  • Hook: Filter hook um_admin_views_users. Use filter 'um_user_statuses_admin_filter_options' hook instead.
  • Function: UM()->user()->set_status( $status ). Use function UM()->common()->users()->set_status( $status, $user_id ) instead.
  • Function: UM()->user()->assign_secretkey(). Use function UM()->common()->users()->assign_secretkey( $user_id ) instead.
  • Function: UM()->user()->approve( $repeat ). Use function UM()->common()->users()->approve( $user_id, $force ) instead.
  • Function: UM()->user()->email_pending(). Use function UM()->common()->users()->send_activation( $user_id, $force ) instead.
  • Function: UM()->user()->pending(). Use function UM()->common()->users()->set_as_pending( $user_id, $force ) instead.
  • Function: UM()->user()->reject(). Use function UM()->common()->users()->reject( $user_id ) instead.
  • Function: UM()->user()->deactivate(). Use function UM()->common()->users()->deactivate( $user_id ) instead.
  • Function: UM()->user()->user_exists_by_id( $user_id ). Use function UM()->common()->users()::user_exists( $user_id ) instead.
  • Function: UM()->files()->format_bytes( $size ). Use function UM()->common()->filesystem()::format_bytes( $size ) instead.

• Enhancements:

  • Added: Member Directory > Admin Filtering supports datepicker and timepicker filter-types with only "From" or "To" filled value
  • Added: Ability to customize modal templates upload-single.php and view-photo.php
  • Added: New FontAwesome library. Version 6.5.2

• Bugfixes:

  • Fixed: Using HTML in the block restriction message. Replaced escaper to wp_kses sanitize while saving
  • Fixed: Getting user capabilities without role
  • Fixed: YouTube validation when field value is empty
  • Fixed: Social URLs sanitizing where user can put his social username (e.g. Instagram, Facebook)
  • Fixed: Using only published forms and member directories IDs on predefined pages installation
  • Fixed: Member Directory before query hook when custom meta table is active
  • Fixed: Unique email validation
  • Fixed: Displaying asterisk on the Profile > View Mode
  • Fixed: PHP errors while upgrade from 1.3.x version
  • Fixed: Rating field view
  • Fixed: Sorting by last login value when "Hide my last login" is set
  • Fixed: PHP errors while uploading files
  • Fixed: Parsing error on the license activation

• Templates Requiring Update:

  • Renamed templates/modal/um_upload_single.php → templates/modal/upload-single.php
  • Renamed templates/modal/um_view_photo.php → templates/modal/view-photo.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: "Hide my last login" via the Account > Privacy setting
  • Added: Exclude and Include fields for member directory searching
  • Tweak: Compatibility with WordPress 6.5

• Bugfixes:

  • Fixed: URL attributes escaping (CVE-2024-2765)
  • Fixed: wp-admin Ultimate Member > Dashboard layouts
  • Fixed: Required fields labels
  • Fixed: Change password and update account email notifications duplicates
  • Fixed: Reset Password urlencoded username
  • Fixed: Clear media JS in wp-admin settings

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Tweak: Added separate file for full changelog. readme.txt shows only a few latest versions

• Bugfixes:

  • Fixed: Member directory data sanitizing (CVE-2024-2123)
  • Fixed: Activation link time changed from seconds to days
  • Fixed: Password validation error
  • Fixed: Password reset url for the approved user who didn't set their password after registration without password
  • Fixed: Conflict with WebP Uploads

• Enhancements:

  • Added: Link to the Ultimate Member docs
  • Tweak: Ultimate Member > Settings redesign. More details about setting up. Tooltips changed to descriptions.

• Bugfixes:

  • Fixed: Member directory queries to custom usermeta table properly escaped and validated
  • Fixed: Member directory custom sorting when wp_usermeta table is used
  • Fixed: aria-invalid attribute for the user description field
  • Fixed: wp_kses protocols for email notifications content
  • Fixed: PHP notice while registration form validation
  • Fixed: Field validations (English letters, Alpha-numeric types)
  • Fixed: Hidden buttons in the modal when uploading profile and cover photo
  • Fixed: Theme updater log message
  • Fixed: Search line shortcode layout
  • Fixed: PHP notice while login form submission
  • Fixed: Email notifications HTML layout
  • Fixed: Default email notification body color
  • Fixed: Ignore username slug when custom meta slug exists when parse user from query

• Templates Requiring Update:

  • email/notification_deletion.php
  • email/notification_new_user.php
  • email/notification_review.php
  • email/welcome_email.php
  • password-change.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: The data protocol for embedding base64 encoded logos in emails
  • Added: Hook um_access_restricted_post_instance for filtering the restricted post instance
  • Added: Shortcode [um_author_profile_link] for getting user Profile URL
  • Updated: Using underscore.js native debounce method for resize handler
  • Updated: Texts spelling

• Bugfixes:

  • Fixed: AJAX requests conflict with um_current_locale attribute
  • Fixed: Pickadate styling (Date & Time fields) in wp-admin screen
  • Fixed: RTL styling and removed um class from UM frontend predefined pages
  • Fixed: select2 conflict with Impreza theme
  • Fixed: cropper conflict with Avada theme and active Fusion Image lazyload
  • Fixed: MegaMenu conflict with nav menu items conditional settings (e.g. Newsletter theme)
  • Fixed: PHP Fatal error when there isn't a proper WP_Post object in UM User Profile > Posts loop
  • Fixed: Account styles
  • Fixed: Saving um_form_version postmeta

• Templates Requiring Update:

  • profile/posts-single.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Updated: Twitter texts to X
  • Added: Safeguards against clickjacking attacks on UM Forms

• Bugfixes:

  • Fixed: Displaying notice to avoid using wrong symbols
  • Fixed: UM > Settings button styles
  • Fixed: Error notice when creating page via extensions
  • Fixed: Workaround for Cropper.JS if UM.frontend.cropper.obj undefined (Cropper hasn't been properly inited for UM objects)
  • Fixed: The visibility of sub-items of hidden menu items

• Enhancements:

  • Refactored: wp-admin assets. Separated or merged some file based on the wp-admin screens
  • Tweak: SASS pre-processor is used for wp-admin styles.
  • Tweak: Using minified JS and CSS in wp-admin and frontend assets
  • Tweak: Added PHP class UM()->admin()->screen() for screen control in wp-admin
  • Updated: jquery-ui styles to 1.13.2 version. Prefixed with .um class.
  • Updated: Cropper.JS to 1.6.1 version
  • Note: Select2.JS version 4.0.13
  • Refreshed: Tipsy.JS to 1.0.0a version. Removed custom changes and restored library base code
  • Refreshed: Raty.JS to 2.6.0 version. Restored library base code
  • Refreshed: Pickadate.JS to 3.6.2 version. Restored library base code
  • Updated: Used um-tip-{x} classes to make Tipsy.JS initialization commonly for wp-admin and frontend.
  • Updated: wp-admin forms class and render icon type field
  • Updated: Using custom_submitdiv on the UM Form and UM Member Directory screen to avoid custom styling for unnecessary metabox functionality. Just to render the necessary metabox content with only submission tools.

• Bugfixes:

  • Fixed: Using fields with numeric keys in Form Builder
  • Fixed: Pickadate.JS (datetime picker) localizations using
  • Fixed: PHP notices on the SiteHealth and Form Builder pages
  • Fixed: Using 'um_user_permissions_filter' hook and it's arguments.

• Deprecated:

  • Removed Simplebar.JS library in Ultimate Member core. It's used only in extensions.
  • Removed outdated styles and scripts for 1.3.x first install page
  • UM()->admin()->enqueue()->js_url param. Please use UM()->admin()->enqueue()::get_url( 'js' ); or self::get_url( 'js' ); instead
  • UM()->admin()->enqueue()->css_url param. Please use UM()->admin()->enqueue()::get_url( 'css' ); or self::get_url( 'js' ); instead
  • UM()->frontend()->enqueue()->js_url param. Please use UM()->frontend()->enqueue()::get_url( 'js' ); or self::get_url( 'js' ); instead
  • UM()->frontend()->enqueue()->css_url param. Please use UM()->frontend()->enqueue()::get_url( 'css' ); or self::get_url( 'js' ); instead
  • Fully UM()->permalinks()->um_rel_canonical_() function. Because since version 2.1.7 there is used um_profile_remove_wpseo(); alternative
  • Fully UM()->permalinks()->admin_act_url() function. Since update for wp-admin links when there is nonce this function isn't used
  • Fully UM()->admin()->enqueue()->front_js_baseurl param.
  • Fully UM()->admin()->enqueue()->front_css_baseurl param.
  • Fully UM()->admin()->enqueue()->post_page param.
  • Fully UM()->frontend()->enqueue()->load_google_charts() function. Outdated.
  • Fully UM()->frontend()->enqueue()->load_fileupload() function. Used scripts/styles dependencies to load script in the necessary place.
  • Fully UM()->frontend()->enqueue()->load_datetimepicker() function. Used scripts/styles dependencies to load script in the necessary place.
  • Fully UM()->frontend()->enqueue()->load_scrollbar() function. Outdated
  • Fully UM()->frontend()->enqueue()->load_imagecrop() function. Used scripts/styles dependencies to load script in the necessary place.
  • UM()->is_um_screen() function. Please use UM()->admin()->screen()->is_own_screen() instead
  • UM()->is_plugin_post_type() function. Please use UM()->admin()->screen()->is_own_post_type() instead
  • UM()->is_restricted_entity() function. Please use UM()->admin()->screen()->is_restricted_entity() instead
  • UM()->cpt_list() function. Please use UM()->common()->cpt()->get_list() instead
  • um-admin-clear CSS class. It duplicates WordPress native clear. Using WordPress native instead.
  • um-admin-tipsy-{x} classes to make Tipsy.JS initialization commonly for wp-admin and frontend by um-tip-{x} class.

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Site Health sections
  • Added: oEmbed field type
  • Added: YouTube field type supports YouTube Shorts links
  • Added: Profile permalink base options: Unique hash, Custom usermeta
  • Added: UM Form meta um_form_version for legacy support in the future
  • Added: Setting "Deleting user comments after deleting a user" for WordPress native logic workaround
  • Added: aria-invalid and aria-errormessage attributes to the fields on UM Forms
  • Updated: Structure for enqueue assets PHP classes
  • Updated: Hooks Documentation v2

• Bugfixes:

  • Fixed: Member directory search query escaping process
  • Fixed: Added 'ID' metakey to the blacklist. It's not possible to create field with 'ID' metakey to avoid the conflict
  • Fixed: Add/Edit Field metabox and "Field Icon", "Conditional logic" fields
  • Fixed: Init jquery-slider-ui script/style on the block editor page
  • Fixed: Displaying "Notifications Account Tab" setting
  • Fixed: Displaying Post Date on the User Profile > Posts tab based on this article
  • Fixed: Small PHP warning, notices and typos

• Deprecated:

  • UM()->enqueue() use UM()->frontend()->enqueue() method
  • UM()->admin_enqueue() use UM()->admin()->enqueue() method
  • UM()->admin_enqueue()->suffix property use UM()->frontend()->enqueue()::get_suffix()
  • UM()->admin()->enqueue()->suffix property use UM()->frontend()->enqueue()::get_suffix()
  • Changed directories for the fonts (fonticons + raty), and JS/CSS files related to libs jquery-ui, raty, select2, tipsy, fonticons (FontAwesome + Ionicons)

• Templates Requiring Update:

  • account.php
  • login.php
  • password-change.php
  • password-reset.php
  • register.php
  • profile/posts-single.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Bugfixes:

  • Fixed: Empty mail From data when there isn't set an option
  • Fixed: Nonce validation for the admin actions handler
  • Fixed: REST API endpoint List Pages redirecting to the homepage
  • Fixed: Standardize the 'editable' attribute for the UM fields and hooks that can extend these fields
  • Fixed: Redirection from default WordPress registration to UM registration page (if it's not a published)

• Enhancements:

  • Added: 'um_can_view_profile' hook to operate with profile privacy
  • Added: 'um_member_directory_core_search_fields' hook to operate with core searching fields in member directory search
  • Tweak: Standardize the condition for checking not editable fields to empty( $data['editable'] )
  • Tweak: Unified UM()->fields()->editing and UM()->fields()->viewing to bool variables use true|false in conditions to make === or !== comparing
  • Updated: Hooks Documentation v2

• Bugfixes:

  • Fixed: Restriction settings handler when there isn't a WP_Post in query. PHP notices in some cases when WP query is not canonical
  • Fixed: User description (Biography) field conflict with validation (max chars) in both cases when HTML can be used or not. Case when there are 2 biography fields are displayed on the profile (header + form field)
  • Fixed: Displaying WordPress native registration errors when unique username|email validation is disabled
  • Fixed: Make links clickable in the Registration Details
  • Fixed: WP_Users_Query on wp-admin > Users screen
  • Fixed: Performance for um_get_form_fields hook
  • Fixed: Admin Modal JS library conflict with bootstrap.js

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Compatibility with UM:Stripe extension
  • Added: Show/hide password button for toggle password visibility
  • Added: JS scripts for syncing biography fields if there are the 1st field in the profile header and the 2nd field in the profile form

• Bugfixes:

  • Fixed: Using allowed hosts for safe redirect after profile deletion
  • Fixed: Nonce validation for the admin actions handler
  • Fixed: Using singleton for UM Forms and UM Account shortcodes. Empty pages issue
  • Fixed: PHP errors in admin notices
  • Fixed: PHP errors on UM Profile update when there is multiselect field
  • Fixed: UM Form and UM Member Directories titles un-slashed. Please re-update the entities where you have extra-slashes
  • Fixed: Maximum allowed words option for textarea where you may insert HTML tags. Ignore HTML tags symbols when count
  • Fixed: Sanitize for fields (Min characters, Max characters, etc.) where can be empty string or absint value

• Templates Requiring Update:

  • profile.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Secure settings. Read more
  • Added: Admin notices about possible security issues. For example, regarding the roles with which the user can register on the site
  • Added: um_edit_profile_url hook for force changing user profile edit URL
  • Added: Additional hook attributes to 'um_reset_password_errors_hook' and 'um_reset_password_process_hook'
  • Added: $form_data attribute to 'um_before_save_registration_details' hook
  • Added: um_safe_redirect() function for handle wp_safe_redirect() function with new the "Allowed hosts for safe redirect" setting
  • Updated: Hooks Documentation v2

• Bugfixes:

  • Fixed: Updating user description if there isn't custom field on profile form, but field is displayed on profile top
  • Fixed: Delete Row and Sub-Row actions in UM Form Builder. Avoid cases when fields from rows and sub-rows are still in form after delete their parents rows
  • Fixed: Ultimate Member WP Cron schedule events starting time. Daily event starts since 12:00AM for now. The similar for weekly and twice-daily events
  • Fixed: Custom sorting label issue on the Member Directory header
  • Fixed: Disabled not-editable fields on UM Forms
  • Fixed: Disabled fields attribute on UM Forms
  • Fixed: Registration with empty role. Set default if role fields on the form are empty when form is submitted
  • Fixed: Admin notices after UM actions has unique key with 'um_' prefix for now
  • Fixed: Escaping form errors. It used esc_html() but now there is wp_kses()
  • Fixed: Stop render 2 similar shortcodes on the same page (e.g. 2 login forms with the same form_id). To return back use um_ultimatemember_shortcode_disable_singleton hook
  • Fixed: Stop render Ultimate Member forms (Login, Profile, Registration, Member Directory) on the predefined Account page
  • Fixed: Using blocks with Ultimate Member shortcodes on the predefined Ultimate Member pages
  • Fixed: Using some specific functions which cannot exist if PHP modules are disabled

• Deprecated:

  • Deprecated: Unnecessary um_multiselect_option_value hook

• Templates Requiring Update:

  • members.php

• Bugfixes:

  • Fixed: A privilege escalation vulnerability used through UM Forms. Known in the wild that vulnerability allowed strangers to create administrator-level WordPress users. Please update immediately and check all administrator-level users on your website.
  • Fixed: Displaying fields on Account page > Privacy > Member directory settings
  • Fixed: Allowed types for the file field
  • Fixed: Disabled weekdays for the datepicker field

• Bugfixes:

  • Fixed: Password Confirm field and validation
  • Fixed: Form Builder row editing
  • Fixed: Spotify URL user URL display on user profile
  • Fixed: Spotify URL validation

• Enhancements:

  • Removed: extract() function and increase supporting WordPress Code Standards
  • Updated: Hooks Documentation v2

• Bugfixes:

  • Fixed: A privilege escalation vulnerability used through UM Forms. Known in the wild that vulnerability allowed strangers to create administrator-level WordPress users. Please update immediately and check all administrator-level users on your website.

• Enhancements:

  • Added: Avoid using extract() function and increase supporting WordPress Code Standards

• Bugfixes:

  • Fixed: PHP8.2 PHP errors (deprecated, warnings, etc.)
  • Fixed: Using str_contains() in template override
  • Fixed: Override templates and custom path for 'members-grid.php', 'members-header.php', 'members-list.php', 'members-pagination.php', 'searchform.php', 'login-to-view.php', 'profile/comments.php', 'profile/comments-single.php', 'profile/posts.php', 'profile/posts-single.php', 'modal/um_upload_single.php', 'modal/um_view_photo.php' template files
  • Fixed: Custom emails data "--- UM Email HTML Templates ---" in Install info

• Enhancements:

  • Added: um_profile_menu_link_{$id}_attrs hook for changing link attributes
  • Added: get_member_directory_id() function for getting member directory ID based on page ID
  • Added: The "Order" and "Data type" settings for custom sorting fields based on metakey in Member Directory
  • Added: New hooks um_profile_permalink,um_external_profile_url
  • Added: Users dropdown field to Admin Forms class
  • Added: Spotify URL field type
  • Added: New developer docs here. It will be upgraded from version to version

• Bugfixes:

  • Fixed: PHP8.2 PHP errors (deprecated, warnings, etc.)
  • Fixed: Filters visibility on member directory page based on public or private visibility for filter's field
  • Fixed: Incorrect Member Directory numerical sorting order
  • Fixed: wp_editor() doesn't work correctly in content restriction settings for Mac users
  • Fixed: Profile links when WPML plugin is active
  • Fixed: ACF and UM blocks conflict
  • Fixed: UM()->mail()->locate_template() function's visibility

• Deprecated:

  • Deprecated: um_localize_permalink_filter. Use post_link instead

• Templates Requiring Update:

  • members.php

• Bugfixes:

  • Fixed: Email notifications sending
  • Fixed: File and Image uploaders and allowed types data for them
  • Fixed: Content field-type editor in wp-admin Form Builder
  • Fixed: Image and File uploaders max size saving in wp-admin Form Builder

• Enhancements:

  • Added: Override templates versioning utility for wp-admin
  • Added: Style and class attributes to info_text field type in settings
  • Added: Emails to install info
  • Added: 'um_email_get_template_file_path' hook
  • Added: Merging data passed with original field data when edit_field() function running
  • Added: loading="lazy" for avatars and cover photos
  • Tweak: Changed Discord account validation
  • Tweak: Changes the structure for the Gutenberg blocks' scripts and way of registration
  • Tweak: Removed filter_input function using

• Bugfixes:

  • Fixed: Removed the hidden in UI taxonomies from the Access > Enable the "Content Restriction" settings for taxonomies setting
  • Fixed: Dynamically declared variables inside the classes for PHP8 installations
  • Fixed: Added wpnonce attribute for duplicate UM Form link
  • Fixed: Sanitize restriction messages when Gutenberg block is restricted
  • Fixed: Login form error class vulnerability

• All templates required update. Please add the version comments to your custom templates in themes

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Hook arguments ($form_id, $not_searched) to 'um_members_directory_head'
  • Added: Using user locale get_user_locale() for localization with the 1st priority
  • Added: Hooks to change the profile SEO image: 'um_profile_dynamic_meta_image_size', 'um_profile_dynamic_meta_image_type'
  • Added: Filter for making 3rd-party roles editable through Ultimate Member interfaces. Use 'um_extend_editable_roles' and pass there an array of role keys( e.g. 'editor', 'administrator', etc. )

• Bugfixes:

  • Fixed: Major issues with the Member Directory search line
  • Fixed: Social links (Twitch, TikTok, Reddit) colors in profile header
  • Fixed: Exclude registered date field from editable fields
  • Fixed: Create the custom table for usermeta if does not exists
  • Fixed: Locale loading time and hook for that
  • Fixed: Used wp_unslash() for input POST data on Change Password
  • Fixed: Role setting "Avoid indexing profile by search engines"
  • Fixed: Date Picker field value format for 3rd-party integration meta fields
  • Fixed: Last login timestamp being lost in the users cache
  • Fixed: Textdomain typos
  • Fixed: Small PHP warnings and notices

• Deprecated:

  • Deprecated: VKontakte and Google+ predefined fields. VKontakte and Google+ fields validation changed to just URL validation.

• Templates Requiring Update:

  • members.php

• Enhancements:

  • Added: TikTok, Twitch and Reddit fields
  • Added: Handler of restriction settings for blog page
  • Added: Support of the <iframes> inside textarea with enabled the "HTML using" option
  • Added: 'um_get_field_date' hook for filtering date fields
  • Added: UM()->get_allowed_html() function for using it inside wp_kses allowed HTML tags

• Bugfixes:

  • Fixed: Redirect to some links when content is restricted. Using esc_url_raw() instead of esc_url() for redirect to URLs inside class-access.php
  • Fixed: Handle restriction settings for attachments, later hook is used for checking capabilities through current_user_can()
  • Fixed: Honeypot triggering in password reset, when not set
  • Fixed: Small PHP notices and warnings

• Bugfixes:

  • Fixed: Plugin upgrade DB initialization and PHP Fatal Error.

• Enhancements:

  • Added: Custom dropdown callback functions security enhancements. Avoid using blacklisted functions through namespace or uppercase format
  • Added: Validation for upgrade package in wp-admin
  • Added: Change Password request limit option for prevent from any brute-force attacks or password guessing with the form
  • Added: Strong password checking for not using username|email inside the password
  • Added: um_custom_authenticate_error_codes hook for handling 3rd-party login errors on UM invalid form

• Bugfixes:

  • Fixed: Some texts sanitizing
  • Fixed: PHP Error in url-type field on UM Forms
  • Fixed: Using wp_mkdir to avoid the filesystem conflict when copy email template to theme
  • Fixed: Password Reset URL generating
  • Fixed: Multiple users approve
  • Fixed: Using regular URL-type field for displaying

• Templates Requiring Update:

  • members.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Custom fields callbacks blacklist. Use um_dropdown_options_source_blacklist filter for adding your custom functions to the custom callbacks blacklist. By default there are all PHP internal functions.

• Bugfixes:

  • Fixed: Posts' restriction that is based on term restriction settings
  • Fixed: Issue with class name in checkbox and radio. Class name being 'activeright' instead of 'active right'
  • Fixed: Admin upgrade scripts and upgrades pack validation
  • Fixed: Directory traversal vulnerabilities
  • Fixed: Destroying user sessions after changing "Approved" status to something else (e.g. deactivated)
  • Fixed: Conflict when wp_get_current_user() not exists. Transferred restriction settings callbacks to plugins_loaded hook
  • Fixed: Restriction post displaying when 404 is enabled and old restiction logic isn't active
  • Fixed: PHP warning when nav menu is empty
  • Fixed: Disable auto-login after user is registered by Administrator and UM Registration form
  • Fixed: Some typos errors
  • Fixed: Using an apostrophe symbols in emails for registration and login both
  • Fixed: Sanitizing YouTube links. Applying both https://youtu.be/xxxxxxx and https://youtube.com/xxxxxxx links

• Deprecated:

  • Removed: Outdated setting using in code (force_display_name_capitlized). Moved the functionality to extended repo

• Enhancements:

  • Added: Input type "tel" using for the "Mobile Number" and "Phone Number" fields

• Bugfixes:

  • Fixed: Performance issue on wp-admin Users screen. Queries were replaced to the cache transient values
  • Fixed: Privacy policy displaying when there are 2 registration forms on the same page
  • Fixed: Password Reset process via Ultimate Member - Password Reset form. Reset password links' arguments changed to the same view as WordPress native has. Password Reset available for the same cases as native WordPress Password Reset has
  • Fixed: Sanitizing for the Info Text field-type in wp-admin forms. Needed for the proper 3rd-party integrations
  • Fixed: Displaying the filters' titles on the Member Directory pages

• Deprecated:

  • UM()->query()->get_users_by_status() without alternativities. It's unused since 2.5.0. Will be removed since 2.7.0
  • UM()->user()->get_pending_users_count(). Use UM()->query()->get_pending_users_count() instead. It's unused since 2.5.0. Will be removed since 2.7.0
  • UM()->user()->remove_cached_queue() without alternativities. It's unused since 2.5.0. Will be removed since 2.7.0

• Templates Requiring Update:

  • password-change.php
  • password-reset.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Bugfixes:

  • Fixed: Member Directory vulnerabilities
  • Fixed: 3rd-party integration with profile tabs and ability to show edit profile form on the 3rd-party profile tab
  • Fixed: PHP fatal error on unset
  • Fixed: select2 style conflicts with 3rd-party plugins

• Enhancements:

  • Added: Number-type Ultimate Member custom fields to the list of the sorting fields on the member directory

• Bugfixes:

  • Fixed: XSS issue related to the JS confirmation and links with JS code inside
  • Fixed: PHP error when um_options option in wp_options table doesn't exist or has wrong format
  • Fixed: select2 styles for RTL languages
  • Fixed: Using slashes in the Choices callback setting for the dropdown/multi-select fields. It's for the using PHP namespaces
  • Fixed: Deleting um_member_directory_data user meta when user is deleted
  • Fixed: Using special chars inside the password and avoid using "" symbol (WordPress native logic)
  • Fixed: Conflict when wp_get_current_user() not exists
  • Fixed: Changed hook for member directory variables initialization for getting ability to use Ultimate Member hooks for customizing these variables via theme
  • Fixed: Remove a redundant WP_Users_Query when getting empty account_status users

• Enhancements:

  • Added: "Allow external link redirect confirm" setting for the displaying JS.confirm alert before redirect to external link from User Profile links
  • Added: "Allowed Choice Callbacks" setting for the security enhancements

• Bugfixes:

  • Fixed: PHP warning when nav menu is empty
  • Fixed: Security issue related to the User Description field
  • Fixed: Security issue related to the [um_loggedin] shortcode
  • Fixed: Using $current_screen without checking for existence
  • Fixed: remove_unused_uploads() function for some PHP installations

• Enhancements:

  • Added: wp-admin notice with reminder about locking WordPress native registration for guests
  • Added: Users dropdown field for Ultimate Member settings fields in wp-admin. It supports AJAX lazy loading
  • Added: JS confirm when redirection from User Profile links to the 3rd-party URL

• Bugfixes:

  • Fixed: PHP warning when there aren't proper user while login
  • Fixed: Removing UM custom capabilities from global $wp_roles when uninstall
  • Fixed: Removing UM custom roles from user roles after uninstall
  • Fixed: Issue with echo XSS on User Profile
  • Fixed: Sanitizing for the checkbox, radio, multiselect fields for PHP8 installations

• Deprecated:

  • um_whitelisted_wpadmin_access hook and wpadmin_allow_ips option. They were unused and redundant since the 2.x version

• Enhancements:

  • Added: wp-admin notice on the Settings page when settings have been changed (#963)
  • Added: WP Blocks restriction settings for the blocks (templates/nav-menu) on the FSE pages
  • Added: UM-specific query_var for UM additional Users_Query on users.php screen in wp-admin. um_custom_user_query = true
  • Added: Ability for dropdown.js to use it inside parent wrapper (not only document.body)
  • Changed: Using WP Cron schedules. Un-schedule events after plugin deactivation
  • Removed: um_check_extensions_licenses and replaced it to um_daily_scheduled_events event

• Bugfixes:

  • Fixed: "Can user edit this field?" fields' option for the file/image upload field-types (#958)
  • Fixed: Using uppercase symbols in the "Blocked Email Addresses" and "Blacklist Words" blacklists settings (#962)
  • Fixed: PHP warning related to the Ultimate Member custom fields without type
  • Fixed: Some typos in the labels (#975)
  • Fixed: UX issue with wrong text on the admin notice about upgrade
  • Fixed: UX issue with Blacklist Words and Blocked Email settings labels. Added a small description about per line separation (#962)
  • Fixed: Sorting the Extensions settings sections

• Enhancements:

  • Added: WhatsApp, Telegram, Discord, Viber messengers predefined fields.
  • Added: Callback for deleting the custom field data from member direcroty settings when this custom field has been deleted in Form Builder.
  • Added: 'um_account_active_tab_inited' JS hook.
  • Updated: Require a strong password option (Ultimate Member > Settings > General > Users > Require a strong password?) to make it common for all Ultimate Member forms. Renamed option key from reset_require_strongpass to require_strongpass.
  • Updated: Form errors texts on the login/password reset forms. Made them secure.
  • Deprecated: Ultimate Member > Settings > General > Account > Require a strong password? option and merged with Ultimate Member > Settings > General > Users > Require a strong password? option.

• Bugfixes:

  • Fixed: "Clear All" button for the filters with "&" symbol in the label.
  • Fixed: Uninstall process when delete UM data. Avoid the issue when 3rd-party pages that had been selected as UM page are removed on UM uninstall.
  • Fixed: Header meta for the Twitter Card. If the user has twitter field filled then will be filled by this value.
  • Fixed: Member directory a slider filter's label displaying. It uses the filled label for now.
  • Fixed: SkypeID field validation. Also all SkypeID fields on your forms changed type from url to text. SkypeID supports nicknames or https://join.skype.com/{hash} links.
  • Fixed: Typos in Account > Privacy tab texts related to Download/Erase the user data.
  • Fixed: Some typos in the fields' labels.
  • Fixed: "false" display name in the member directory. It displays empty for now if the user hasn't display name.
  • Fixed: UM()->clean_array() function.
  • Fixed: LinkedIn field URL. Added ability to display the organization URL.
  • Fixed: Canonical link of the user profile if WPML plugin is active.
  • Fixed: Replacing placeholders in nav menus. Used an earlier hook for filtering items before generating HTML and avoided issues with raw, not-escaped HTML inside tags' attributes.

• Templates Requiring Update:

  • members-grid.php
  • members-list.php
  • password-reset.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Ability to insert SoundCloud track URL instead of Track ID
  • Added: Settings for the password min/max length (Ultimate Member > Settings > Users)

• Bugfixes:

  • Fixed: Invalid role keys on the role list-table + role edit screen (case when latin symbols used with not UTF-8 symbols)
  • Fixed: Restriction logic and archive lists (+ nav menu bar) with active "Disable pre-queries for restriction content logic" option
  • Fixed: Restriction settings fields conditions on wp-admin screens
  • Fixed: Account user_login field validation removed as redundant. The field is disabled and not used in code flow
  • Fixed: display_name data update after First + Last name fields edition on the Account page
  • Fixed: Password length validation on the Account page and Password Reset page
  • Fixed: Using custom fields from multi-select dropdowns for user's Display Name. Unserialized custom field's values

• Bugfixes:

  • Fixed: Hiding comments feed for pages with active comments
  • Fixed: Changing the post title to the restricted value while displaying in the loop that uses direct post_title variable
  • Fixed: PHP errors related to not passed function attributes from 3rd-party plugins or themes when using WP native hooks
  • Fixed: Handling the login form errors via \WP_Error

• Enhancements:

  • Added: 'um_ignore_restricted_title' hook for workaround show post title of the restricted post
  • Added: Disable pre-queries for restriction content logic ('disable_restriction_pre_queries') option for backward compatibility with business logic where 404 error for restricted content isn't a good way
  • Added: Replace the restricted Post Title ('restricted_post_title_replace') option for ability to disable restricted post's title replace

• Bugfixes:

  • Fixed: pre_get_terms callback to avoid the conflicts with other terms queries
  • Fixed: Terms query and global access settings on PHP8 installations
  • Fixed: Member directory dropdown filters where options contain & symbol
  • Fixed: Displaying 404 error for the restricted Media
  • Fixed: Displaying 'Login as this user' action on the user profile
  • Fixed: Sanitizing of the social links fields (e.g. Twitter, Facebook, etc.)
  • Fixed: Visibility of a restricted taxonomy page in the nav menu
  • Fixed: Sanitizing key for the drag&drop action
  • Fixed: Sanitizing the description field with allowed HTML inside
  • Fixed: The "Assignment to constant variable" JS error on some sites
  • Fixed: Keep description formatting in a view mode
  • Fixed: Profile form nonce handling, security enhancement
  • Fixed: `um_edit_profile_url()`` function and added $user_id attribute
  • Optimized: Restriction content handlers, avoid queries duplicates or unnecessary queries

• Bugfixes:

  • Fixed: is_restricted() functions in class-access.php. Avoid using object as array offset

• Enhancements:

  • Added: Extended callback functions for sanitizing data in wp-admin forms fields
  • Added: Restricted Access Post Title setting

• Bugfixes:

  • Fixed: Restriction settings and related queries (comments, archives, recent posts, post navigation, etc.)
  • Fixed: Sanitizing max-width value of the Login/Registration/Profile form settings
  • Fixed: Sanitizing in_group field's data
  • Fixed: Restriction settings related with Hide in queries
  • Fixed: Restriction settings and CPU performance issues on some installations
  • Fixed: Form meta settings and handling them on PHP8 installations
  • Fixed: Make it clearer the restriction settings form labels

• Enhancements:

  • Added: Sanitizing handlers to the Ultimate Member > Settings forms' fields
  • Added: Sanitizing handlers to the Ultimate Member > User Role Add/Edit forms' fields
  • Added: Sanitizing handlers to the Ultimate Member > Forms forms' fields
  • Added: Sanitizing handlers to the Ultimate Member > Forms > Add Field/Edit Field forms' fields
  • Added: Sanitizing handlers to the Ultimate Member > User Roles forms' fields
  • Added: Sanitizing handlers to the Restriction Content forms' fields in the posts/pages/menus additional fields
  • Added: Sanitizing handlers to the all (Login/Registration/Profile/Account) frontend forms' fields
  • Added: Custom placeholder setting for the Confirm Password field

• Bugfixes:

  • Fixed: Content restriction settings using in Avada theme with active page headers
  • Fixed: Content restriction (CPT + Terms). Avoid displaying comments if the post is restricted
  • Fixed: Content restriction (CPT + Terms). Avoid displaying comments and posts feed
  • Fixed: Content restriction (CPT + Terms). Displaying the proper count of the posts. Restricted are excluded
  • Fixed: Saving and displaying settings on the UM > Settings > Access screen
  • Fixed: Saving and displaying default Member Directory settings
  • Fixed: Minor PHP warnings on registration data preview
  • Fixed: Member directory slider filter-type query and results
  • Fixed: Uploader filename displaying

• Tweaks:

  • WordPress 5.8 compatibility. Widgets screen changes based on the new features with Legacy Widget block

• Templates Requiring Update:

  • members.php
  • password-reset.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: um_scripts.max_upload_size localized variable getting from wp_max_upload_size()
  • Updated: dropdown.js library to make the stable working

• Bugfixes:

  • Fixed: Displaying different profile form shortcodes with different role visibility settings on the same page
  • Fixed: Displaying avatar on the logout page
  • Fixed: Role meta sanitizing and related XSS vulnerability

• Templates Requiring Update:

  • logout.php
  • members.php
  • members-list.php

• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade *

• Enhancements:

  • Added: Hook um_registration_for_loggedin_users to unlock the ability to add new users through the registration form
  • Added: Filter hook 'um_change_usermeta_for_update' for extending $to_update usermeta array after all profile fields validations
  • Added: Filter hook 'um_profile_tabs_privacy_list' and 'um_profile_menu_can_view_tab' for extending privacy options for Profile Tabs

• Bugfixes:

  • Fixed: XSS vulnerability when getting user profile URL
  • Fixed: Temp directory size calculation

• Bugfixes:
  • Fixed: Endless JS loop when filtering on Member Directory page

• Bugfixes:
  • Fixed: Endless JS loop when filtering on Member Directory page
  • Fixed: Regular expression for registration form and username field (added ability to use spaces) (#812)

• Enhancements:

  • Added: Activation link expiration setting (#803)
  • Added: 'Owner and specific roles' privacy type for the Profile tabs (#773)
  • Added: Hooks um_before_email_notification_sending and um_after_email_notification_sending regarding #743 pull-request
  • Added: Hooks for integration member directory filters with different conditions for query to DB

• Bugfixes:

  • Fixed: Editing private profiles capability. Removed the priority for "Can edit other member accounts?" capability when the account is private. (#805)
  • Fixed: PHP notice when the admin filtering field has the not array default value (e.g. bool)
  • Fixed: The conflict with Disable Blog plugin regarding this issue. download_routing callback has the highest priority now.
  • Fixed: Fields privacy functionality. This function um_can_view_field() has been rewritten (#780)
  • Fixed: Fields privacy + form validation functionality. Skip the field's validation that aren't visible on the form based on the privacy settings (#795)
  • Fixed: PHP notice in the confirm password label wp.org thread
  • Fixed: Confirm password placeholder when label is empty
  • Fixed: Permanently deleting form's field (#786)
  • Fixed: Default value with comma for checkbox field-type (#729)
  • Fixed: Gutenberg blocks conditional settings (#793)
  • Fixed: Getting active Profile tab when some of them are hidden
  • Fixed: Restricted content message is showing twice and removing header, avoid the conflicts with themes that use 'the_content' filter in header or footer (#799)
  • Fixed: "Is required" validation for the multiselect field-type when it's empty on submit
  • Fixed: Using 'wp_login_failed' hook, added 2nd parameter required since WordPress 5.4 version (#810)

• Enhancements:

  • Added: General and role setting to avoid indexing users' profiles
  • Added: um_prepare_user_results_array_meta hook and the 2nd argument for um_prepare_user_results_array hook for handle $user_ids based on getting members query
  • Added: Change password email when the password has been reset
  • Added: jQuery v3 compatibility
  • Added: An option "Administrator" in a menu settings to make the menu visible for administrators only

• Bugfixes:

  • Fixed: Creating and removing usermeta data with password_rst_attempts key, just update if exists for now
  • Fixed: Using 'edit_users' capability instead of 'manage_options' for approve|reject membership
  • Fixed: Using 'manage_options' capability instead of 'delete_users' for switching between members
  • Fixed: Using myCRED points metakeys in UM usermeta table
  • Fixed: Empty icons are shown in the popup "Choose from... available icons"
  • Fixed: Member Directory slider filter with NaN or decimal range
  • Fixed: PHP notices and warnings
  • Fixed: Security vulnerability with User Account page and password field
  • Fixed: User creating without username but based on first+last name with not-ASCII symbols
  • Fixed: Password reset hash generating more than 1 time
  • Fixed: Random order type translation string on the member directory
  • Fixed: Resize and compress images when uploading on User Profile images fields or user wall
  • Fixed: Displaying more than 1 UM popups on the same page
  • Fixed: UM dropdown.js position calculation
  • Fixed: Select2 dropdown block position calculation

• Tweaks:

  • Updated: Select2 to 4.0.13 version

• Bugfixes:
  • Fixed: Conditional logic for the form fields without metakeys

• Enhancements:

  • Added a tooltip with meta key name for fields in a form settings
  • Added Administrator user role to a restriction setting (to make the content visible only for Administrator role)

• Bugfixes:

  • Added third parameter $args to the action hook for Profile Tab redirections um_user_after_updating_profile
  • Fixed issues with fields without metakeys when trying to display them by the hook
  • Fixed PHP notices/warnings

• Enhancements:

  • Added: um_member_directory_cover_image_size hook with ability to change the cover photo size on the member directory
  • Added: um_member_directory_avatar_image_size hook with ability to change the profile photo size on the member directory
  • Added: um_member_directory_get_members_allow JS hook for 3rd-party integration with the member directory. You could use a time throttle until some data is loaded
  • Added: Notice about the fields' conditional logic rules + small CSS enhancements
  • Added: Invalid nonce validation on Login and Registration pages instead of wp_die()
  • Added: Privacy settings for the Divider field type (#688)
  • Added: Ability for the integration with Gutenberg Block restriction settings (extends the block restriction settings via 3rd-party plugins)
  • Added: Strings translations

• Bugfixes:

  • Fixed: Upgrade process on websites where a hosting locks the frequent AJAX requests (added default JS throttle between requests)
  • Fixed: Getting page content of the GDPR privacy policies
  • Fixed: Password strength validation for Unicode symbols
  • Fixed: Issue with apostrophe options in the multiselect/checkbox fields (#689)
  • Fixed: Translation for Password field's label
  • Fixed: Download Personal Data URL
  • Fixed: Vulnerability with timestamp field on UM Forms (the hidden field with name='timestamp' is deprecated)

• Tweaks:

  • There are changed PHP’s intval(), strval(), floatval(), and boolval() typecasting functions to (int), (string), (float) and (bool) regarding this doc.

• Enhancements:

  • Added ratings required notice and warning

• Bugfixes:

  • Fixed conflict with other plugins with user 'status' in admin
  • Fixed security patch for UM forms handlers
  • Fixed security patch for handlers on the edit users' roles
  • Fixed member directory admin filtering by the field with uppercase in 'key'
  • Fixed member directory sorting by the full name
  • Fixed registration form with not editable role field
  • Fixed PHP notice for the filter without field's label
  • Fixed PHP notice on Admin_Form class initialization
  • Fixed style of the textarea field
  • Fixed Confirm Password field's placeholder

• Bugfixes:

  • Fixed can_view_profile() function
  • Fixed security patch for role change via profile form
  • Fixed admin-menu PHP notice

• Enhancements:

  • Deprecated the Feed widget from Ultimate Member dashboard

• Bugfixes:

  • Fixed age filter at Member Directory when using WP native usermeta table
  • Fixed the role field values at the user profile/registration forms
  • Fixed PHP notice when cover photo is empty
  • Fixed the conflict issue with Pickadate JS library and their legacy.js functions
  • Fixed Gutenberg Blocks descriptions

• Bugfixes:

  • Fixed security patch for role change via profile form

• Enhancements:

  • Added dependency functions for extensions: Ultimate Member - User Notes & Ultimate Member - Profile Tabs
  • Added unique IDs to the form fields at the Profile's view mode
  • Added restrictions for WP > Users list table based on UM Roles capabilities

• Bugfixes:

  • Removed additional slashes in the UM custom roles titles
  • Fixed cleaning user old uploads and integration with Social activity & Groups files
  • Fixed Info window fields (hide fields without metakeys)
  • Fixed PHP warning in conditional logic function
  • Fixed member directory preloader when using a slider filter
  • Fixed 'redirect_to' attribute and approving user on registration
  • Fixed activate an account via email

• Enhancements:

  • Added dependency functions for plugins: Ultimate Member - JobBoardWP integration & JobBoardWP
  • Added account privacy setting for the avoiding profile indexation
  • Added setting "Change image orientation" based on image EXIF data
  • Added setting "Account Deletion without password Custom Text"

• Bugfixes:

  • Fixed security lacks for 'redirect_to' attributes
  • Fixed account submission when change a password
  • Fixed updating UM roles metadata (WP capabilities section) when 3rd-party plugins update the caps for the UM roles
  • Fixed member directory roles in query (the case when selected some roles, but current user can see another only)
  • Fixed member directory sorting
  • Fixed member directory list dropdown init after changing view type
  • Fixed member directory admin filtering by the 'user_registered' field
  • Fixed validation when using HTML in textarea
  • Fixed cleaning user old uploads
  • Fixed conditional logic for file/image-type fields
  • Fixed "get_profile_photo_size" function (avoid PHP notice with array_combine)
  • Fixed password reset/change form when other forms are initialized at the same page
  • Fixed getting extension updates on multisites
  • Fixed the 'wp_authenticate_user' filter's variables (changed username string to WP_User object)
  • Fixed SEO link canonical for the profile page
  • Fixed displaying error & notice when the text is empty

• Deprecated:

  • Deprecated JS event 'um_before_modal_removed', use wp.hooks action 'um_before_modal_removed' instead

• Enhancements:

  • Added The profile page SEO meta tags for OG, Twitter and schema.org
  • Added filter to the field's privacy option for the 3rd-party integrations 'um_field_privacy_options'
  • Added layout changes to show email notification description in Settings > Email screen
  • Added member directory option 'Exclude specific users'
  • Added filter for the changing redirect after profile edited 'um_update_profile_redirect_after'
  • Added JS filters for conditional logic
  • Tweak: apply_shortcodes() function support
  • Tweak: nav-menu custom fields using 'wp_nav_menu_item_custom_fields' hook

• Bugfixes:

  • Fixed custom meta table fields migration (create, edit, remove field actions)
  • Fixed wp-login.php and UM login form validation/errors triggers when using email for login
  • Fixed profile form duplicates, show only the first form shortcode on the page for the user with selected role
  • Fixed creating user uploads directory on registration
  • Fixed Role fields validation on registration
  • Fixed Erase User Data field on the Account page
  • Fixed profile privacy
  • Fixed SkypeID field
  • Fixed clickable links in the UM forms which are displayed in a modal window
  • Fixed disabling select and textarea fields in inactive tabs on Account
  • Fixed compatibility with jQuery 3.x and 'load' event
  • Fixed some translations
  • Small PHP notices fixes

• Enhancements:

  • Added number field-type to member directory filters
  • Changed export/erase personal data in account page
  • Sanitizing variables in wp-admin

• Bugfixes:

  • Fixed PHP notice 'form_id' on account submission
  • Fixed birthday range for member directory filter
  • Fixed fields visibility when user can edit other users
  • Fixed honeypot JS
  • Fixed edit mode for Role (Dropdown/Radio) fields (getting editable priority role)

• Enhancements:

  • Updated select2 JS library to 4.0.12 version
  • Added a few member directories PHP and JS filters for 3rd-party integrations
  • Added labels for member directories filters to increase Accessibility points in Audit
  • Added formatting for submitted data
  • Added fields notices functionality
  • Added sanitizing $_GET variables in wp-admin side

• Bugfixes:

  • Fixed activation licenses with sslverify
  • Fixed fields' options if they contains spaces in the start and the end of option (added trim)
  • Fixed getting range for slider filters
  • Fixed 2.1.3-beta3 package upgrade
  • Fixed resize image on registration form
  • Fixed multiselect field styles
  • Fixed issue with not editable fields and their visibility
  • Fixed displaying header with member counts
  • Fixed JS errors with not defined tinyMCE on Forms builder
  • Fixed issues with "key => value" fields (dropdown + multiselect) if 'um_select_options_pair' filter is used
  • Fixed social URLs validations
  • Fixed Ultimate Member wrapper's visibility on add/edit user page (wp-admin)
  • Fixed jQuery-UI library images
  • Fixed vulnerability with sanitizing $_POST
  • Fixed last login order on member directories when UM metatable is turned on
  • Fixed RTL styles at Account page and Member Directory

• Enhancements:

  • Added sorting by Last & First name
  • Added integrations with future extensions
  • Added filter for changing the order of options in select-type filter
  • Added GDPR template to get overwritten in the theme directory
  • Added member directories' custom sorting labels
  • Added ability to use custom metatable for faster requests for Member Directories
  • Added ability to request Erase or Download user data via Privacy tab at the Account page
  • Added an option to set the "Hide profile from directory" option by default

• Bugfixes:

  • Fixed [um_loggedin] shortcode render with htmlspecialchars_decode
  • Fixed checkbox options missing selections with conditional settings
  • Fixed vulnerability with uploading cover/profile photo for other user ID
  • Fixed integration with WPML for Account and User pages in case if there are different permalinks for different languages for these pages
  • Fixed issues with pagination settings
  • Fixed search line additional slashes
  • Fixed issues with member results JS template
  • Fixed getting posts count at the Posts tab for 3rd party integrations
  • Fixed member directories' admin filtering
  • Fixed issue with reset filters on member directory
  • Fixed getting image/file custom fields values in form submission with not validated values
  • Fixed JS handlers for select-type filters with callback and parent/child relations
  • Fixed um_convert_tags for array-type values
  • Fixed small CSS issues

• Enhancements:

  • Added text-type filters
  • Added sorting for filters, tagline and reveal section fields
  • Added universal hook for field's wrapper and improve rendering the field wrapper attributes
  • Added returning only existed values for select-type filters
  • Added checking privacy for custom fields in filters and general search, exclude private fields
  • Added Form fields validation for E-mail( not unique )
  • Added $user_id attribute in update profile hooks for proper callbacks

• Bugfixes:

  • Fixed fields privacy, editable and visibility attributes
  • Fixed member directory styles
  • Fixed random sorting
  • Fixed conflict with 'php_data' variable in admin JS
  • Fixed datepicker/timepicker filtering in the member directories
  • Fixed initialization of datepicker, timepicker, slider filters when the "Show results only after search/filtration" option is active
  • Fixed callback select-type filters handlers on member directories filters bar
  • Fixed cover photo thumbnail sizes in member directory
  • Fixed Role filter
  • Fixed clearing filters with || condition
  • Fixed endless recursion in the function um_check_conditions_on_submit()
  • Fixed issue that appears if we try to update several plugins at once
  • Fixed using different templates for different member directories
  • Fixed form previews, added overlay and displayed buttons
  • Fixed wp-admin/admin-post.php access issue

• Bugfixes:
  • Fixed admin actions hook
  • Fixed JS templates for list and grid view when user metakeys contain "-" symbol
  • Fixed JS template list "$show_block" issue
  • Fixed member directory search if 'roles_can_search' is set
  • Fixed member directory filters bar animation
  • Fixed save profile with Last Login field
  • Fixed admin builder for profile form, show not editable fields

• Enhancements:

  • Added member directory list view
  • Added member directory search bar
  • Added member directory filters by range, date and time
  • Added AJAXed member directories
  • Updated member directories' search engine
  • Additional parameter 'user_id' to action hook 'um_user_after_updating_profile'
  • Added ability to set profile/cover image sizes from Ultimate Member -> General -> Uploads settings or Original size
  • Added ability edit cover photo HTML (e.g. for adding some HTML attributes. See how add srcset attribute based on all generated cover sizes here)
  • Added custom date format for Date Picker field
  • Added hook 'um_show_meta_item_html' to customize user meta HTML at User Profile page
  • Added "aria-label" attribute in Field icon

• Bugfixes:

  • Optimized usermeta for Account submit security
  • Fixed flushing rewrite rules on every page reloading
  • Fixed Gmail & Yahoo UTF-8 encoding of email notification subject
  • Fixed ajax_resize_image() process
  • Fixed country fields values
  • Fixed dynamic_profile.php notice
  • Fixed integration with WP native admin_post and admin_post_nopriv requests
  • Fixed profile image settings
  • Fixed profile privacy for not logged in users, if restriction options set for profile page as visible only for logged in and showing message instead of redirect (it makes the same for {site_url}/user and {site_url}/user/{user_slug} )
  • Fixed security issue on registration form submission when username or email have conditional logic
  • Fixed RTL styles issues on user profile and account pages
  • Fixed upload profile/cover photos at the profile page, don't apply until the crop finished
  • Fixed alphabetical field validation for cyrillic and not UTF-8 symbols
  • Fixed user profile validation if username, username or email, password and email fields were added to form
  • Fixed user profile preview in admin Form Builder
  • Fixed getting templates function for some Windows servers
  • Fixed plugin update process for multisites
  • Fixed function "um_apply_conditions". An error appears with jQuery v2.1.3
  • Localized um-raty.js library
  • Localized strings

• Enhancements:

  • Added security fixes (XSS)
  • Added hooks for 3rd party integrations
  • Updated Datepicker & Timepicker library from 5.6 to 6.2 version

• Bugfixes:

  • Fixed validation of forms conditional fields at the backend (for the nesting fields)
  • Fixed edit profile mode when profile menu is disabled
  • Fixed RTL styles and layouts
  • Fixed user profile description validation
  • Fixed JS errors on some installs
  • Fixed ability approve users by Administrator with special capabilities
  • Fixed multiselects' retrieval of options from callback function
  • Fixed save process and conditional logic for Appearances -> Profile Menu settings section
  • Fixed uninstall process
  • Fixed is_selected method for some cases
  • Fixed form settings fields for default button labels in wp-admin metaboxes
  • Fixed generate metakeys for the form's custom fields
  • Fixed issue when UM Roles localized as object on Add/Edit User screen
  • Fixed PHP notices

• Bugfixes:
  • Fixed profile privacy for not logged in users, if restriction options set for profile page as visible only for logged in

• Enhancements:

  • Added security fixes (XSS)

• Bugfixes:

  • Fixed update process for not UM custom role
  • Fixed extensions licenses validation handler
  • Fixed profile tabs handlers

• Enhancements:

  • Added option to disable profile avatar uploader
  • Moved extensions icons to core

• Bugfixes:

  • Fixed Profile Tabs Privacy settings
  • Fixed Notifications Account tab view
  • Fixed warnings on validation process
  • Fixed slashes in some texts from options
  • Fixed callback functions for select and multiselect fields

• Enhancements:

  • Extended hooks for 3rd party integrations

• Bugfixes:

  • Fixed settings labels with CPT & Taxonomies
  • Fixed UM Roles create/edit XSS security issue
  • Fixed XSS security issue on account upgrade

• Bugfixes:
  • Fixed UM Roles create/edit security issue

• Enhancements:

  • Extended hooks for 3rd party integrations

• Bugfixes:

  • Fixed PHP notices when runs validation
  • Fixed loop issue with Profile tabs
  • Fixed home page restrictions

• Enhancements:

  • Extended hooks for 3rd party integrations

• Bugfixes:

  • Fixed security vulnerability with registration form
  • Fixed the using of deprecated send password hook

• Enhancements:

  • Added an ability to 3rd party integration with cover image actions

• Bugfixes:

  • Fixed ability to edit profile on not predefined Profile Page

• Bugfixes:
  • Fixed save special characters values
  • Fixed trim fields options before validation
  • Fixed save empty value at Profile Registration form in radio/checkbox/select/multiselect fields
  • Fixed displaying empty value of multiselect field at Profile Page
  • Fixed cover photo dropdown menus

• Bugfixes:
  • Fixed extensions' upgrader
  • Security vulnerabilities on Profile/Registration submit and file/images uploading
  • Fixed session clean on logout

• Bugfixes:
  • Fixed issues with Gutenberg scripts and UM blocks
  • Security vulnerabilities on Profile/Registration submit and file/images uploading

• Enhancements:

  • Added automatically template saver when you upgrade your theme
  • Added default value for Date and Time user profile fields
  • Updated Scroll library
  • Added REST API v2 class with new query vars. There is an ability to select v1 or v2 for use. For old users v1 is default, for new users v2

• Bugfixes:

  • Added nocache headers to reset password form
  • Email templates saving to child theme, if parent theme already has email template files
  • Email templates locate in the default plugin folder with active WPML
  • Form builder with some predefined form fields, which had different keys/metakeys (currently use the same)
  • Logout redirect with active WPML
  • Fixed $_SERVER usage when WP-CLI using
  • Extended integration for UM field value
  • um_user function avoid loop when 'display name' and 'full name' used
  • Restriction options for Terms and access on front-end
  • Plugin/Theme upgrader
  • Remove duplicate data 'user_login' from metadata
  • Replace placeholders duplicates
  • Password Reset link regeneration
  • Fixed issues with scroll on mobile devices
  • Fixed multisite activation

• Deprecated:

  • "Is Account page?" and "Is User page?" options for WPML integration ( because WPML translations works properly )

• Bugfixes:
  • Fixed Last Login order in Member Directory

• Enhancements:

  • Added option for enable/disable Gutenberg blocks

• Bugfixes:

  • Fixed conflicts with themes, which not support custom Gutenberg blocks via the option

• Enhancements:

  • Added Gutenberg blocks section with Ultimate Member shortcodes
  • Clear temp directory on upload process 1 day files old
  • Updated custom scrollbar JS library to jQuery 3 support

• Bugfixes:

  • Fixed vulnerability with Reset Password form
  • Fixed Edit Row settings
  • Fixed save profile fields with 0 values
  • Fixed upload photo base URL for Windows servers
  • Fixed displaying user Posts at Profile/Posts tab
  • Fixed unique filename issue, upload avatar with high case extension
  • Fixed member directory filter title
  • Fixed duplicate delete user handler
  • Fixed sorting by Last Login date for users without meta
  • Fixed hook after password reset (issue #532)
  • Fixed member directory user role filter
  • Fixed restriction content WC Products integration
  • Fixed words count for French in user description field
  • Fixed is_selected function for dropdown/multi-select/checkbox profile fields
  • Fixed disable email field at Edit Profile form via filter (disabled by default)

• Bugfixes:
  • Fixed security issue on user Account Update

• Enhancements:

  • Restored option for disable users cache
  • Transposh plugin integration

• Bugfixes:

  • Fixed delete users handlers on single/multisite installs
  • Fixed fields labels on member directory
  • Fixed profile form cover photo ratio value
  • Fixed profile and registration form default field's values
  • Fixed "is_selected" function with empty value and default value option
  • Fixed member directory notices with disabled metadata
  • Fixed textarea profile field formatting
  • Fixed registration without username field
  • Fixed flush password reset limit after successfully login
  • Fixed upload files handlers for avoid the conflicts with other plugins

• Enhancements:
  • Added option to enable Gutenberg Blocks restriction

• Enhancements:
  • Additional Block's restriction options
  • Added column to show User Account Status
  • Added filter for disabling Gutenberg blocks restriction to avoid themes conflicts

• Enhancements:

  • Added Block's restriction options
  • Added compatibility for upcoming User Events extension

• Bugfixes:

  • Fixed Live Preview form at wp-admin
  • Fixed tinyMCE editor loading in form builder
  • Fixed external function for dropdown options
  • Fixed Add New Menu Item handler
  • Fixed small notices at frontend
  • Fixed a few admin settings fields
  • Fixed displaying comments when they are disabled

• Bugfixes:
  • Fixed JS/CSS enqueue at wp-admin

• Enhancements:

  • Added new "Extensions" class for future integrations

• Bugfixes:

  • Fixed logout redirect vulnerability
  • Fixed modal window responsive position
  • Fixed class autoloader for Windows servers
  • Fixed admin forms integration
  • Fixed empty value for select2 selectbox
  • Fixed unchecked Remember Me by default on login page
  • Fixed admin forms esc_attr value
  • Fixed admin forms buttons wp_unslash
  • Fixed get/clean plugin upgrades on multisites
  • Fixed verify nonce on $_GET requests

• Deprecated:

  • removed "UM_TEXTDOMAIN" constant
  • removed function UM()->get_ajax_route() for AJAX vulnerability fix

• Bugfixes:
  • Fixed AJAX vulnerabilities
  • Fixed delete user email notification
  • Fixed profile tabs displaying

• Bugfixes:
  • Added compatibility with PHP7.2 (removed deprecated functions and ini variables)
  • Fixed duplicated "redirect_to" field
  • Fixed errors on the installs < PHP5.6
  • Fixed download files/images on the installs with the different home URL and site URL
  • Fixed unique emails in admin email notifications
  • Remove language notice, all translates are available on wp.org

• Bugfixes:
  • Fixed compatibility with JS/CSS cache plugins

• Bugfixes:
  • Fixed crop settings of the big images
  • Fixed WPML integration with email notifications
  • Fixed uppercase symbols using at profile page slug
  • Fixed download files/images with cache
  • Fixed download files/images with not closed buffers
  • Fixed looping in case if set 'display_name' as custom fields for display name setting
  • Fixed cover photo size
  • Fixed date time internalization
  • Fixed posts pagination for un-logged users
  • Fixed conditional JS
  • Fixed "um_" prefix for role data
  • Added compatibility for upcoming User Bookmarks extension

• Bugfixes:
  • Fixed User Profile Posts pagination

• Bugfixes:
  • Fixed Email notifications
  • Fixed Download files/images for multisites
  • Fixed Profile/Cover image for multisites
  • Fixed XSS vulnerabilities (detected by @Serhack)
  • Fixed trim fields on submit forms
  • Fixed submitted info

• Bugfixes:
  • Fixed files class

• Enhancements:

  • New files/images downloading process
  • Added dependencies with User Photos and Groups extensions

• Bugfixes:

  • File/Image email placeholders after registration form submitting
  • File/Image forms fields values on submit/edit
  • Fixed multisite file/image upload process
  • Fixed clearing old user sessions after the changing a password
  • Made reset password process via WP native functions

• Enhancements:
  • Upgrade minified scripts

• Bugfixes:
  • WP native AJAX using
  • Force purge temp files dir

• Bugfixes:
  • Fixed File/Image uploader

• Enhancements:

  • Added an ability to filter user's profile slug "um_change_user_profile_slug"
  • Added an ability to filter pages for exclude restriction content settings "um_exclude_posts_from_privacy"

• Bugfixes:

  • Fixed callback functions in member directory search
  • Fixed Profile Privacy Settings for different languages
  • Fixed security vulnerabilities (File/Image uploader)
  • Fixed security vulnerabilities (HTML arguments)
  • Fixed search in members directory for some cases, when metadata format isn't correct
  • Fixed some cases in conditional logic
  • Fixed WP Capabilities list for Gravity Forms
  • Fixed View Profile capabilities

• Deprecated:

  • Filters "um_before_user_upload", "um_after_user_upload"

• Bugfixes:
  • Fixed search in members directory by User Tags field (other case)

• Bugfixes:
  • Fixed search in members directory by User Tags field

• Bugfixes:
  • Fixed few JS file's full versions
  • Fixed search in members directory by multiselect/radio/checkbox field
  • Fixed first activation role metadata reset

• Enhancements:

  • Added an ability to create different email templates for each site on multisites installs
  • Added major version notice
  • Added an ability to make Profile Form visible for 2 or more roles
  • Added ability to dismiss some UM notices
  • Redesign some parts of field's conditional logic settings

• Bugfixes:

  • Fixed PHP memory limit issue on some installs. Created pseudo-constructor
  • Disabled email notification to user, which wasn't approved about delete their account
  • Fixed profile tabs privacy
  • Fixed default avatars and Gravatar displaying
  • Fixed get current URL function
  • Fixed admin bar displaying
  • Fixed members directory search
  • Fixed nav-menu items restriction handlers
  • Fixed user displaying on multisite (added 404 error in some cases)
  • Fixed XSS at wp-admin settings screen
  • Fixed user's "user_login" permalinks
  • Fixed user's capabilities ("Edit", "Delete" user) and profile actions displaying
  • Fixed field's conditional logic
  • Fixed issue with account button ID's duplicates

• Deprecated:

  • REST API user's key option;

• Enhancements:

  • Added UM dashboard widget for getting latest extension's upgrades

• Bugfixes:

  • Fixed User Profile restriction when the user isn't logged in
  • Fixed Profile Tabs displaying on desktop/mobile
  • Fixed set user status after registration on some installs
  • Fixed PHP memory limit issue on some installs with small PHP memory limit
  • Fixed PHP validation on submit UM Forms with conditional fields logic

• Bugfixes:
  • Fixed Profile Tabs issues

• Bugfixes:
  • Fixed GDPR min.js script

• Enhancements:

  • Added support for GDPR Personal Data Exporter
  • Added support for GDPR Personal Data Eraser
  • Added new privacy field to form builder for GDPR consent collection
  • Added GDPR privacy policy guide text
  • Added GDPR compatibility on delete user process
  • Added security to Restricted posts comments
  • Added security to custom field type Password
  • Deprecated time checking spam bot

• Bugfixes:

  • Fixed settings tabs for PHP7.1
  • Fixed issues with Profile Tabs
  • Fixed User Avatars
  • Fixed set user status on Registration process
  • Fixed Account Privacy tab content

• Bugfixes:
  • Fixed and optimized user avatars
  • Fixed Profile Menu on some installs
  • Fixed fields IDs duplicates
  • Fixed cache users count

• Bugfixes:
  • Fixed approving users with "Administrator" role
  • Fixed problem with URLs for upload images
  • Fixed not UM roles, which start from "um_" symbols
  • Fixed content restriction logic

• Bugfixes:
  • Fixed profile form JS

• Bugfixes:
  • Fixed Profile Form field privacy
  • Fixed conditional menu logic for 2 different nav menu hooks
  • Fixed registration form preview on wp-admin screen
  • Restored old CSS settings to "um_old_settings.css"
  • Clean user's cache

• Bugfixes:
  • Fixed registration form role

• Bugfixes:
  • Fixed license activation

• Bugfixes:
  • Fixed add rewrite rules for UM pages
  • Fixed Profile Form, Registration Form use custom settings and role
  • Fixed save settings security

• Bugfixes:
  • Fixed nav-menu content restriction issues for Administrator role

• Bugfixes:
  • Fixed old pre2.0 extensions notices
  • Fixed nav-menu content restriction issues
  • Fixed lost password URL in UM Login Form
  • Fixed restriction message on taxonomy page, which is restricted

• Enhancements:

  • Added activation dependencies for extensions
  • Added Licenses checking and changed Licenses page
  • Added uninstall.php file for delete permanently all UM settings
  • Added ability to register users without WP Registration enabled
  • Added visual integration WPML+UM email notifications
  • Added Account Upgrade email notification
  • Added ability to register users using role field on Registration Form
  • Added Account page shortcodes for each tab content
  • Changed UM Option View (deprecated/added options)
  • Changed UM Roles, optimized for WP native logic
  • Changed backend forms/fields to WP native styles
  • Changed Content Restriction feature for posts, taxonomies, menus
  • Changed Email Notifications settings and using templates logic
  • Deprecated Redux Framework
  • Deprecated old unusable options
  • Deprecated old unusable forms metadata
  • Deprecated old unusable member directories metadata
  • Deprecated old unusable user roles metadata
  • Optimized registration/upgrade profile process (some hook deprecated)
  • Optimized some code parts, deprecated some functions
  • Updated FontAwesome library
  • Removed addons to separate extensions
  • Created Plugin Updater for getting updates and license details from Shop
  • Increased integration abilities, added new hooks (see new Hooks Docs + PHP documentation);
  • Integrated plugin activation, user creation processes with multisite
  • Make dependencies with extensions
  • OOP structure without procedural methods for wp-admin side;

• Bugfixes:

  • Fixed avatars on some SSL installs
  • Fixed some vulnerabilities
  • Fixed integrations with core/extensions
  • Fixed Edit Profile button at members directory
  • Fixed conditional logic PHP validation and JS validation (for IE,Edge browsers)
  • Fixed textdomains for translations
  • Fixed integration with Woocommerce, SEO Framework, WPML
  • Fixed navigation menu items custom fields (Mega Menu, etc. compatibility)
  • Fixed theme conflicts with UM js libraries
  • Fixed and optimized handlers for user permalinks
  • Fixed replace placeholders for users
  • Fixed conditional fields logic
  • Fixed fields sanitize for remove XSS injections

• Enhancements:

  • Add new filter hook um_add_user_frontend_submitted
  • Add class for member tagline in directory grid um-member-tagline-<field key>
  • Add recaptcha support and submit button id
  • Update extensions page layout

• Bugfixes:

  • Fix Conditional Logic fields
  • Fix required field with specific roles in privacy
  • Remove wpautop from biography
  • Remove notices

• Bugfixes
  • Fix system info

• Enhancements:
  • Update readme.txt

• Enhancements:

  • Add new filter hook to modify the profile cancel uri for redirection
    • um_edit_profile_cancel_uri
  • Add new filter hook to modify the specific field type's value
    • um_edit_{$type}_field_value
  • Add new filter hook that modies the file name
    • um_upload_file_name
  • Update en_US translation files

• Bugfixes:

  • Fix file clean up with image/file fields on profile update
  • Fix text domain slug for wp.org translation compatibility
  • Fix change password email notification
  • Fix double click submission in registration forms
  • Fix custom field role validation
  • Fix conditional logic 'content block' field
  • Fix conditional logic field operators and visibility
  • Fix textarea field sanitation
  • Fix system info false positive virus scan results
  • Fix field validation for minimum and maximum numeric values
  • Fix used custom fields visibility in form builders
  • Fix cache user's profile option description
  • Fix double click for android device
  • Fix png image upload with transparency
  • Fix extra slashes in form edit view when invalid input fields occur
  • Remove notices

• Enhancements:

  • Adds new action hooks before and after WP_User_Query.
    • um_user_before_query
    • um_user_after_query
  • Adds a dismiss link in locale / language translation notices
  • Adds correct user profile url in WPML language switcher
  • Adds new option to disable name fields in account page
    • UM > Settings > Account > Disable First & Last Name fields
  • Add new filters to modify upload base directories
    • um_multisite_upload_sites_directory
    • um_multisite_upload_directory
  • Adds new action hook in admin > user edit > Ultimate Member to append any customisation
    • um_user_profile_section
  • Adds H2 for UltimateMember section to Add/Edit User Form

• Bugfixes

  • Fix image url cache filter
  • Fix PHP 7.1+ compatibility issues
  • Fix UTF8 encoding in form fields
  • Fix hide member directory option.
  • Fix conditional logic fields.
  • Fix login access settings for logged-in users.
  • Fix WP role synchronisation on UM role update
  • Fix WP authenticate filter hook
  • Fix radio and checbox field active state colors when disabled.
  • Fix Content Availability conditional fields in edit/add category screens
  • Remove notices

• Enhancements:

  • Adds user avatar's alternate text. The default text is set to display_name
  • Adds new filter hook to modif the user avatar's alternate text.
    • um_avatar_image_alternate_text
  • Set gravatar for newly registered users
  • Adds Tag archive page access settings

• Bugfixes

  • Remove pointer cursor from field areas in profile view mode
  • Fix profile slug in permalinks
  • Fix URL field 'nofollow' issue
  • Fix field icons display
  • Fix an issue with admin roles in editing fields
  • Fix whitepspace issue with Email Address validation
  • Fix profile visibility option in member directories
  • Fix icon display as label in profile view
  • Fix PHP 7.1.1 compatibility
  • Fix redirection on update profile slug
  • Fix dynamic CSS options in member directory
  • Fix edit profile option by specific role
  • Fix Vkontakte view
  • Remove notices

• Enhancements:

  • Add filter hook to disable secure account fields
    • um_account_secure_fields__enabled
  • Updates ReduxFramework to version 3.6.2
  • Adds a body class in profile/user page for the current loggedin user
    • um-own-profile

• Bugfixes

  • Fix select/multi-select field options translation
  • Fix profiles visibility and access permissions in member directories
  • Fix User deletion in mobile browsers
  • Fix WPML & PolyLang compatibility issues
  • Fix field view and edit restriction
  • Fix author name in recent comments widget
  • Fix overwrite of multiple image and file uploads with the same filename
  • Remove notices

• Bugfixes
  • Fix conditional field option with 'contains'
  • Fix WPML compatibility with UM logout

• Bugfixes:
  • Fix loop email notifications on user creation in the back-end

• Enhancements:

  • Adds new username and string validation filter hooks:
    • um_validation_safe_username_regex
    • um_validation_safe_string_regex
  • Adds new filter hook to modify conditional fields
    • um_get_field__{$field_key}
  • Change max limit of users queue's count in cache
  • Adds current logged in users WP and Community roles in the System Info
  • Adds confirmation on user deletion

• Bugfixes:

  • Fix conditional fields
  • Fix logout compatibility issues with WPML
  • Fix select option's custom callback validation
  • Fix translation strings of primary and secondary buttons on Login and Register forms.
  • Fix gender filter and results
  • Fix user deletion in account page for mobile browsers
  • Fix form rows CSS options
  • Fix default text autocomplete
  • Remove notices

• Bugfixes:
  • Fix menu settings compatibility issue with WP 4.7
  • Fix mobile class on account delete tab heading
  • Fixes an issue where tagline shows the current users to all members
  • Fixes notice on updating WP List Table quick edit
  • Remove notices

• Bugfixes:
  • Fix set and reset password validation.
  • Remove notices

• Bugfixes:
  • Fix invalid security notice in set password.

• Bugfixes:
  • Fix 'Invalid user ID' on profile update

• Enhancements:

  • Improves clear users cache.
  • Removes user id from redirect URL on registration process for pending review and email activation statuses.

• Bugfixes:

  • Fix assigning of role on registration process
  • Fix change email address in edit mode.
  • Fix change password validation.
  • Removes notices when role field is present in the profile form.

• Enhancements:

  • Adds a filter hook to modify the submitted details on registration process
    • um_before_save_filter_submitted
  • Adds a filter hook to disable canonical link in header
    • um_allow_canonical__filter
  • Adds a filter hook to modify the auto-generated email address on registration process
    • um_user_register_submitted__email
  • Adds filter hooks to modify locale, language file path and textdomain
    • um_language_textdomain
    • um_language_locale
    • um_language_file
  • Adds filter hook to modify the data of selected value:
    • um_is_selected_filter_data
  • Adds new select/multi-select options to retrieve options from a callback.
    • In the form builder, edit or add a select/multi-select field and add your callback function in Choices callback field to get populated.
  • Adds parent select field option to dynamically populate another select field.
    • If Choices Callback option is set in the field settings, the Parent Option triggers an Ajax request to populate the child options on change event.
  • Updates um.min.js file.
  • Updates en_US translation file.

• Bugfixes:

  • Removes notices from WPCLI console.
  • Removes notices from edit profile mode
  • Removes autocomplete from search filter fields
  • Fix translation strings of search filters on a member directory
  • Fix email notifications not sending on registration process
  • Fix field selection with special characters on form submission
  • Fix assigning of role on register submission process

• Enhancements:

  • Improves the bulk filters, actions and redirection in User Screens
  • Adds new access options to disallow access on homepage and category pages.
  • Adds Textarea to show in profile tagline on Member Directory
  • Adds a filter hook um_allow_frontend_image_uploads to allow profile and cover photo uploads on front-end pages.
  • Adds new filter hooks to modify image field data on upload:
    • um_image_handle_global__option
    • um_image_handle_{$field}__option
  • Adds a new filter hook to modify the redirection of non logged in users who visit the parent user page.
    • um_locate_user_profile_not_loggedin__redirect
  • Improves generate dummies tool with wp_remote_get
  • Adds a new action hook for a new section in cover area:
    • um_cover_area_content
  • Updates the English translation .po and .mo files.
  • Improves the shortcode um_show_content to swap the user_id with the current profile.

• Bugfixes:

  • Fixes a bug where multi-select field options doesn't match the user selected options that contain html entities.
  • Fixes a bug to display correct role slugs in radio and select fields.
  • Fixes a bug where reset password form is conflicting with register and login form on a page.
  • Fixes a bug where Users queue count in the Admin > All Users / Users menu doesn't update when a user account is in pending user review and gets deleted.
  • Fixes a typo in Password Reset Email option's description
  • Fixes a bug where conditional fields 'equals to' validation on registration process
  • Fixes a bug to disable the query with hiding account on member directory
  • Fixes a bug to retrieve specific number of members
  • Fixes a bug to retrieve all members with get_members new parameter number
  • Fixes a typo in Welcome Email template.
  • Fixes a bug where login form redirection is set to wp-admin/admin-ajax.php instead of the current page when loaded via ajax.
  • Fixes a bug where uninstall link doesn't load.
  • Fixes a bug to redirect users to correct URL after login based from login options.
  • Fixes a bug where non-logged in users are not able to access the profile page when Global Site Access is set to Site accessible to Logged In Users.
  • Fixes a bug to modify the login redirection url especially when DOING_AJAX is defined.
  • Fixes a bug to retrieve correct community roles per site in a Multisite Network setup.

• Enhancements:
  • Adds a new filter hook to modify the cover photo uri.
    • um_user_cover_photo_uri__filter
• Bugfixes:
  • Fixes a bug to allow users change their password in account form
  • Fixes a bug to allow role validation and assigning of roles to users on registration process
  • Fixes a bug to avoid blank admin footer text all around WordPress

• Enhancements:
  • Adds a new filter hook to modify the profile cover photo uri.
    • um_user_cover_photo_uri__filter
• Bugfixes:
  • Fixes a bug to allow users change their password in account form
  • Fixes a bug to reset passwords

• Enhancements:

  • Adds a system information tool for support purposes
  • Adds a new option to disable generating profile slugs on every load of member directory pages.
    • Located in UM > Settings > Advanced > Stop generating profile slugs in member directory.
    • This improves the performance when loading profiles in directories. It generates profile slug on Profile Update ( front and back-end ), Registration Process and viewing the Users in the back-end.
  • Adds new filter hook um_activate_url to modify the account activation url.
  • Adds new filter hooks to modify first and last name cases
    • um_user_first_name_case
    • um_user_last_name_case
  • Adds new filter hooks to modify nonces of image and file uploads
    • um_file_upload_nonce
    • um_image_upload_nonce
  • Improves search member filters and keyword sensitivity
  • Improves generation of profile slugs
  • Improves force capitalization of display names with dash
  • Improves the pagination and loading of profiles in member directory

• Bugfixes:

  • Fixes a bug where users in member directory are missing after updating their profile
  • Fixes a bug to generate random email when email field is not added in a form.
  • Fixes a bug to show hidden members in member directory for admins
  • Fixes a bug to validate username length on registration process
  • Fixes a bug to display profile name in dynamic menu and profile page title
  • Fixes a bug where frequent security notices show on registration process
  • Fixes a bug to assign correct role to a user on registration process
  • Fixes a bug to display correct roles in radio and dropdown fields
  • Fixes a bug to validate the reset password
  • Fixes a bug to change the assign of role in navigation menu items
  • Fixes a bug to select radio field in profile form
  • Fixes a bug to allow frontpage and posts page to handle custom access settings
  • Fixes a bug where profile role field's conditional logic doesn't show/hide the second field.
  • Fixes a bug to show 'Last Login' field in profile edit and view mode.
  • Fixes a bug to sync roles with users in Edit Roles.
  • Fixes a bug to disable/enable UM profile cache
  • Fixes a bug to disable biography field's character limit when added in form

• Fixed: radio field in account page

• New: allow non-editable fields in registration form
• Fixed: member directory mobile pagination
• Fixed: biography field validation in profile header and forms
• Fixed: remove override 'birth date' label
• Fixed: html support in biography field
• Fixed: select options search
• Fixed: select field's search query
• Fixed: search filters and multi-select fields
• Fixed: select, radio and checkbox field options
• Fixed: multiple select in UM settings
• Fixed: member directory's pagination links
• Fixed: remove nonce and http referer from submitted user details
• Fixed: disallow direct access link to posts with enabled category access restriction
• Added: new filter hook: um_get_default_cover_uri_filter
• Added: new filter hook: um_register_allow_nonce_verification
• Added: new filter hook: um_get_option_filter__{$option_id}
• Added: new filter hook: um_profile_{$key}__filter
• Added: new filter hook: um_profile_{$key}_empty__filter
• Added: new filter hook um_enable_ajax_urls
• Added: new filter hook um_field_checkbox_item_title

• Tweak: update translation strings and English translation file.
• Fixed: alphabetic and lowercase validations
• Fixed: checkbox and radio label encoding
• Fixed: user_login field validation type
• Fixed: registration form process
• Fixed: remove comments with hidden/private posts from comment tab

• Tweak: update ReduxFramework to version 3.6.0.1
• Added: new action hook 'um_registration_after_auto_login'
• Added: new option for Network Permalink Structure
• Added: an account option to require first and last name
• Fixed: account deletion and password confirmation
• Fixed: registration form submission process
• Fixed: access settings in home page and posts conflict
• Fixed: encoding non UTF8 strings

• Fixed: edit profile permission

• Fixed: admin navigation
• Fixed: profile access and redirection

• Fixed: access settings and redirection for logged out users
• Fixed: global access settings
• Fixed: remove notice in permalink

• Fixed: edit profile url in multi-site setup
• Fixed: global access settings

• Fixed: change password
• Fixed: menu settings and roles
• Fixed: cropper issue with Avada theme
• Fixed: image cropper and modal
• Fixed: nonce in registration forms
• Fixed: user redirection for non-loggedin users
• Fixed: global access setting

• Added: filter 'um_register_hidden_role_field'
• Added: filters and action hooks in form post
• Added: cache time filter in avatar url
• Fixed: Nonces added to file uploads
• Fixed: remove notices
• Fixed: upload image cropper
• Fixed: select field multiple select
• Fixed: changing community role by admin
• Fixed: current url method in multisite setup
• Fixed: access settings

• Fixed: change password
• Fixed: select field overlay

• Fixed: admin access restriction

• Fixed: query of pages

• Fixed: select fields styles
• Fixed: select fields with accented characters
• Fixed: select fields with accented text values
• Fixed: select fields in overlay
• Fixed: admin front-end access restriction
• Fixed: pages query

• Fixed: remove quick edit from Built-in roles row actions
• Fixed: remove notices
• Fixed: dropdown/select fields
• Fixed: upload file extension's case sensitive issue
• Fixed: reset and change password

• New: generate dummy users tool
• Added: filter 'um_submit_form_error' for custom error messages
• Tweak: update compressed CSS
• Tweak: update select2.js to version 4.0.2
• Fixed: gravatar and transfer tool
• Fixed: permalink base for username
• Fixed: saving account fields
• Fixed: remove notice
• Fixed: upload form error logging
• Fixed: cache option
• Fixed: edit profile url
• Fixed: login redirection
• Fixed: remove account information from welcome email
• Fixed: form error with users tags
• Fixed: select fields with accented characters
• Fixed: image upload

• Added: 'wp_authenticate_username_password_before' action hook
• Tweak: remove access settings in media screens
• Fixed: convert tags format
• Fixed: ReduxFramework notice
• Fixed: remove PHP notice

• Added: 'um_form_fields_textarea_settings' filter
• Added: reset password limit options
• Added: option to force display name to be capitlized
• Fixed: remove notices
• Fixed: redirect url on login
• Fixed: optimize query and object caching
• Fixed: profile photo as required field
• Fixed: admin access in front-end login
• Fixed: typos in tooltips
• Fixed: embedding video fields
• Fixed: Flush rewrite rules

• Fixed: menu incompatibility issue
• Fixed: username validation
• Fixed: admin css conflict
• Fixed: display name capitalization
• Fixed: search member filter and fields
• Fixed: member directory big SELECT query
• Added: action hook 'um_access_post_type' & 'um_access_post_type_{current_page_type}' for current page type in access settings

• Fixed: remove core notices from ajax requests
• Fixed: upload form and media path

• New: advanced option to disable profile object caching
• Added: ssl media uri function
• Added: first and last name initial as meta key
• Fixed: order by random and pagination
• Fixed: user sort by random
• Fixed: status message encoding
• Fixed: image upload and file name
• Fixed: user login with other provider
• Fixed: translation strings
• Fixed: dependencies fatal errors
• Fixed: remove notices

• Fixed: Fatal errors with language filter file

• Fixed: Search widget fatal error
• Fixed: image jpeg upload sizes

• New: support for wordfence and limit login
• New: search widget
• New: secondary email address
• Added: hook to password reset form fields
• Added: privacy options for profile menu tabs
• Added: option to allow primary email editable in profile view
• Added: member directory sort randomly
• Fixed: user page redirection
• Fixed: admin script error
• Fixed: invalid image path
• Fixed: upload image png with transparency
• Fixed: permalink basename fallback
• Fixed: casting variable and add new filter
• Fixed: remove notices
• Fixed: search users by tag
• Fixed: force UT8 encoding option
• Fixed: email content type
• Fixed: WPML compatibility
• Fixed: permalink base name format and redirect loop in profile page
• Fixed: form labels textdomain
• Fixed: edit profile redirect
• Tweak: accept period in profile url

• New: an option to force Strings to use UTF-8 encoding
• New: an option to change Gravatar default image
• New: South Sudan to the list of countries.
• Fixed: update profile edit
• Fixed: remove feed from content restriction
• Fixed: search username query
• Fixed: support for server query string data after user login
• Fixed: matching fields values
• Fixed: email template path
• Fixed: shortcode within [um_show_content] shortcode
• Tweak: remove notices

• Fixed: redirect URL after login
• Fixed: security check in registration form
• Fixed: email template path string
• Fixed: member directory query

• Fixed: email template and localization
• Fixed: redirect URL

• Fixed: Registration form redirect url

• New: filter um_<field_type>_form_show_field for display field
• New: shortcode: show custom content to specific role [um_show_content roles='member'][/um_show_content]
• New: 'not' attribute to [um_show_content not='member,contributor'][/um_show_content] shortcode
• Tweak: update masonry script
• Tweak: sql concatenate with prepare statement
• Fixed: remove notices
• Fixed: missing mCSB_buttons.png
• Fixed: set Gravatar default image as UM default image
• Fixed: fix default gravatar image
• Fixed: select2 multi dropdown for wc orders
• Fixed: show admin bar option
• Fixed: session issue with logout
• Fixed: register using email address if it exists
• Fixed: duplicate full_name permalinks
• Fixed: duplicate profile
• Fixed: show admin bar for non-logged in users
• Fixed: honorifics in full name
• Fixed: unsynced wp role
• Fixed: display wp user role filters
• Fixed: select and radio invalid value
• Fixed: email template path
• Fixed: user profile url with single dash in the last name
• Fixed: function to check meta value existence by meta key
• Fixed: um-admin-dashboard warnings
• Fixed: community role field in profile edit screen
• Fixed: mismatched roles
• Fixed: admin access in profiles
• Fixed: allow multiple member directory shortcode in a page
• Fixed: datepicker for ios and safari
• Fixed: adding of members in wp-admin
• Fixed: Fix redirection and XSS issue in login form

• New: add gravatar transfer tool
• New: show users with gravatar photo in member directory
• New: add upgrade class for data migration
• Tweak: Set last login for new users to show in member directory
• Tweak: validate roles for forms without fields
• Tweak: cropper js update
• Tweak: update minified script
• Tweak: tooltip and comment
• Fixed: member search query
• Fixed: Registration process with pending and show message enabled
• Fixed: Fix form security validation
• Fixed: email content type, template and localization
• Fixed: remove php notices
• Fixed: custom columns for roles
• Fixed: admin bar visibility per user role
• Fixed: community role editing

• Tweak: remove username validation
• Tweak: update minified scripts
• Fixed: Fix email and user submitted data encoding
• Fixed: role validation on register submission
• Fixed: form role and validation
• Fixed: search form pagination visibility

• New: Add password confirmation validation
• New: Add VK url validation
• New: Add Vkontakte as predefined url field
• New: Add additional file types
• New: Add file size limit label in image field
• New: Added password reset limit
• New: Allow redirect_to param after registration
• New: Indonesian language support added
• New: Add bio characters limit
• Tweak: Use native WP masonry script instead of duplicating it
• Tweak: Add image upload notice
• Tweak: Add option to allow users to hide profiles from member page
• Tweak: Add filters to modify output field
• Tweak: Add filter hook for email template path
• Tweak: Tweak upload form styles
• Tweak: Remove masonry from core and gulp
• Tweak: Add admin assets and apply minification
• Tweak: Update pickadate assets
• Tweak: Allowing usertags in search filters
• Tweak: Allow members template to be customized/overridden
• Tweak: Option to login user after clicking the activation link
• Tweak: Remove bio count strings
• Fixed: bio limit javascript error
• Fixed: ssl checker for load balancers
• Fixed: redirect loop with wpml permalink
• Fixed: WPML permalink and form compatibility
• Fixed: blocked words
• Fixed: searching with space
• Fixed: change password
• Fixed: members grid override
• Fixed: tipsy.js error
• Fixed: Plugin conflict causing account page displaying wrong info
• Fixed: email locale tempalte path
• Fixed: invalid role
• Fixed: validation for change password
• Fixed: unchecked access roles
• Fixed: telno input styles
• Fixed: escape display name in title attributes
• Fixed: datepicker css issue with some themes
• Fixed: make sure the hash parameter is a string
• Fixed: loading core assets
• Fixed: title tags not updated
• Fixed: empty uneditable fields
• Fixed: account deletion on one submission
• Fixed: Fixed indentation
• Fixed: user_login fallbacks and remove email address
• Fixed: password changed email template

• New: added in-page content restriction to protect content for logged-in or logged out users
• New: added community role field to user creation in backend
• New: added community role field to user editing in backend
• New: show specific users in members directory
• New: added a new field type: Number
• New: added filter hooks to specific profile fields
• New: added custom admin bulk actions support
• New: added usermeta support to content locking feature in-page
• Tweak: several tweaks in core to be more WordPress native
• Tweak: added fallback for page setup selections
• Tweak: automatic clickable links in profile header bio
• Tweak: trim long field labels in backend fields modal
• Fixed: profile page SEO title
• Fixed: multi-site redirect support
• Fixed: activation hash comparison
• Fixed: page setup fallback field
• Fixed: prevents php warnings and notices
• Fixed: WP-CLI and cronjobs issues
• Fixed: category posts restriction and redirection
• Fixed: category access settings
• Fixed: activation link

• Fixed: registration/login issues resolved

• New: new privacy option for fields: allow profile owner & specific roles to view the field
• Fixed: wrong php syntax in admin notice

• Fixed: Member search on homepage
• Fixed: emoticons support
• Fixed: redux notices, css styles in admin
• Fixed: users not being deleted

• Fixed: array format and notices
• Fixed: users search, delete confirmation and role filter
• Fixed: unique key field validation

• Fixed: Add slash in base url filter for multisite
• Fixed: manage user roles, status and filters
• Fixed: Enable WPML support to all UM url/links
• Fixed: Sanitize referers and printing notices in admin screens

• New: added Simplified Chinese language support
• Tweak: added many new filters (for developers)
• Fixed: Display name update in profile
• Fixed: Photo upload unique IDs
• Fixed: Remove duplicated method um_convert_tags

• New: added new documentation links to plugin files
• New: added filters to control profile photo menu (for developers)
• Fixed: added security patch to remove decrypted passwords from database
• Fixed: bug with blocked words during registration
• Fixed: some localization strings
• Fixed: php warnings/bugs on specific installs

• Fixed: Bug with plugin folder structure

• Fixed: Role name display in Users dashboard

• New: added Greek language support
• Tweak: added custom class to every user meta in member directory
• Tweak: added option to stop flushing rewrite rules every load (performance tweak)
• Fixed: WPML issue on multisite install
• Fixed: Removed redux menu from tools
• Fixed: fix for wp_authenticate_username_password()
• Fixed: searching users by e-mail address
• Fixed: conflict with sites with thousands of pages

• Fixed: 404 error on UM pages

• Tweak: saved some database queries
• Tweak: plugin not compatible with cache plugins out of the box - needs to exclude dynamic urls from cache
• Tweak: added more development filters in backend

• Fixed: PHP strstr() notice on profile

• Fixed: compatibility bug with older PHP versions

• Tweak: added security by sanitizing file/image uploads
• Fixed: issue with account page > notifications tab
• Fixed: image upload path in email notification
• Fixed: php issue with displaying name
• Fixed: missing localisation strings
• Fixed: couple of php notices

• New: added security measure for profile photo uploads
• New: added filter to hook in registration details sent in email notification
• New: added core pages filter to allow you change pages of extensions within plugin settings (e.g. activity)
• Fixed: multi-select field filtering bug
• Fixed: strip slashes from field names in fields modal
• Fixed: show drag and drop footer content only in the drag and drop form builder page
• Fixed: profile photo crop/upload issue
• Fixed: category/post specific restriction conflict
• Fixed: display UM classes only in UM pages
• Fixed: minor code improvements

• Fixed: please update - profile issue

• New: filter for comment types tab in profile
• New: jQuery.scrollto script added (for developers and extensions support)
• Fixed: XSS vulnerability in text input
• Fixed: user goes to profile about tab after editing profile

• New: added Brazilian Portuguese language support
• Tweak: added support for upcoming social activity extension

• New: added option to restrict categories in addition to per post content restriction
• New: added support to use dynamic user/profile ID in shortcode field e.g. [your-shortcode user_id={profile_id}]
• New: added security feature to disable admin logging via frontend (optional)
• New: added filter to um_get_core_page() function (for developers)
• Tweak: removed delay from tooltips
• Fixed: conflict with Podcast feed

• Fixed: issue with logout from adminbar

• New: added last login date support
• New: show user's last login in profile
• New: added sorting members by last login date
• New: added option to re-assign core pages in plugin settings
• Fixed: issue with multi-select required field
• Fixed: URL validation for custom fields
• Fixed: backend user filtering by non-english role
• Fixed: RTL css bugs

• Fixed: Woocommerce manual order dropdown conflict

• New: ability to delete user cache from plugin dashboard
• New: function is_ultimatemember() checks if user is on UM page (developers)
• New: option to disallow editing email in account page
• New: added Spanish (Mexico) language support
• Fixed: bug with profile viewing and user roles
• Fixed: Woocommerce dropdown bugs/conflicts
• Fixed: ipad/tablet css fixes for profile columns
• Fixed: deleting users delete their content

• Fixed: Redux errors and popups in backend

• Fixed: major issue with showing HTML in profiles

• New: easily sync UM roles with WP roles with role settings
• New: first steps towards WPML compatibility
• New: option to show member results only If user has searched
• New: add .um-err class to UM form if the form contains errors
• New: updated redux framework to latest version
• Fixed: feed issue with private / access locked posts

• New: added support for Farsi / Romanian language
• Tweak: adapted core community roles to prevent conflicts
• Fixed: bug with search results pagination
• Fixed: issue with panic key usage and wp-admin screen
• Fixed: bug with custom field validation action

• Fixed: php notice causing errors to appear in both frontend and backend

• New: added required support for WooCommerce extension
• Tweak: added option to fix conflicts of user profile links using different server method to get current url
• Fixed: security fix for redux framework added
• Fixed: button appearance on tablets
• Fixed: member search by display name

• Tweak: added a filter hook to change priority of enqueued styles/scripts
• Fixed: UM forms and elements not appearing in IE
• Fixed: Skype field output
• Fixed: conflict with libraries using Mobile Detect
• Fixed: issue with WP locale (using get_locale() now instead)

• Fixed: correction to last update
• Fixed: Private messages extension bug

• New: added Czech language support
• Fixed: WooCommerce dropdown issues and bugs in backend

• New: added Google map field
• New: added Vimeo video field
• New: added YouTube video field
• New: added SoundCloud track field
• New: added Hebrew language support
• Tweak: do not show captcha response in submitted registration details
• Fixed: profile photo upload issue on profile view mode
• Fixed: user search in backend/frontend
• Fixed: UM login check
• Fixed: admin settings css issue on mobile
• Fixed: cache variable undefined issue

• Fixed: issue with image upload fields
• Fixed: date localization resolved
• Fixed: issue with image upload during registration
• Fixed: JS issues for PM extension

• New: hooks and compatibility with Private Messages extension
• Fixed: bug with empty password on welcome e-mail
• Fixed: bug with member search using default permalinks

• New: RESTful API methods update.user, get.stats, and delete.user
• New: added Danish (Dansk) support
• New: added Swedish (Svenska) support
• Tweak: minor account and logout redirection tweaks
• Fixed: issue with changing user role
• Fixed: bug with login form validation
• Fixed: issue with biography field and html

• Fixed: bug with activation e-mails
• Fixed: bug stopping password reset
• Fixed: bug with changing user role and status in backend

• New: user profiles are cached to speed up load time
• New: emoji support added to bio / user descriptions
• Fixed: issues with bio field HTML
• Fixed: WP-admin PHP warning
• Fixed: bug with localization of en_US.po file

• New: Important: Introduces the Ultimate Member RESTful API
• Tweak: improved um_user_ip() function
• Fixed: issue with invalid html on profile photo and cover photo

• New: added custom field validation support via hooks um_custom_field_validation_{$hook}
• Fixed: important bug with profile menu tabs / system

• New: display pending users count in backend
• Tweak: improved user deletion process from backend
• Tweak: tweaked filter for register/login buttons
• Tweak: disabled registration timebot for admins
• Fixed: wp-load.php path in image and file upload scripts
• Fixed: RTL compatibility bugs
• Fixed: bug with registration and role field
• Fixed: bug with edit profile and biography length in header

• Fixed: Important WP 4.2 conflict resolved: filtering users in backend

• Tweak: Compatible with WordPress 4.2
• Tweak: general code tweaks and improvements
• Tweak: new action hook when user is deleted
• Tweak: new action/filter hooks for profiles (developers)
• Tweak: new filter hook for profile privacy option
• Fixed: permalink issues

• Fixed: password reset security fix ( do not reveal emails )
• Fixed: bug with custom profile templates
• Fixed: display name in member directories
• Fixed: URL fields display in member directory
• Fixed: many bugs with previous version

• Fixed: e-mail activation bugs

• New: added Russian language support
• Fixed: Security patch related to add_query_arg()
• Fixed: bug with approval HTML e-mail

• Fixed: major bug with admin capability / editing user profiles via frontend

• New: added caching to user roles and user permissions to save queries
• New: added user switching feature to allow super admins to sign in as another user easily (without password)
• New: added new modal css/js for future support
• New: added custom scrollbar support for future development use
• Tweak: added form elements focus css
• Fixed: bug with required radio button
• Fixed: prevent access for backend login/register/lost password for a logged in user

• Fixed: major bug with datepicker (Update recommended)

• New: new action hook that runs when user role is changed um_member_role_upgrade
• Fixed: bug/compatibility issue with caching UM roles data
• Fixed: bug with changing role settings/permissions
• Fixed: bug with setting e-mail activation redirect URL

• Fixed: Major bug with dropdown and date fields (Update recommended)
• Fixed: hard-coded translation issues

• New: added option to manage if access control widgets can be edited by admins only
• Tweak: update to last security patch - deletes user who try to get unauthorized access

• Fixed: Important security patch - please update
• Fixed: conflict with The Events Calendar plugin
• Fixed: bug with edit profile link

• Fixed: bug where you user could use an already existing e-mail in account page
• Fixed: bug with special characaters in username
• Fixed: bug with showing draft posts in user profile

• New: added multi language support to assign different languages to different forms (beta feature)
• New: added RTL support (beta, still partial)
• New: added a dashboard widget to view latest blog posts from the plugin
• Tweak: changed manage_options permission to edit_users on some admin actions
• Fixed: corrected all active color references in the css
• Fixed: bug with user_row_actions filter
• Fixed: do not store user_pass in submitted metakey during registration

• New: Added Arabic language (ar) support
• Fixed: Date fields not working in Safari
• Fixed: issue with HTML e-mails
• Fixed: issue with showing sidebar logout widget on bbpress forums

• Tweak: added more hooks to mail function to allow for sending custom e-mails
• Fixed: issue with content lock settings in backend appearing for non-admins
• Fixed: issue with form errors handling

• Fixed: bug with member directory search
• Fixed: bug with custom role homepage

• Fixed: bug with showing register and login forms on same page

• New: added option to customize redirection URL after e-mail activation
• Fixed: issue with hardcoded ajax/upload URLs - they are now localized
• Fixed: issue with admin notification for a deleted account
• Fixed: admin notifications are in plain text format

• Tweak: featured image in user posts goes to post link
• Fixed: solved a bug with e-mail validation

• Tweak: minor admin css changes
• Tweak: error message for frontend upload with theme/plugin conflicts

• Tweak: Major Performance Improvements (beta)

• Fixed: bug with viewing member profiles

• Tweak: profile edit form tweaked to be processed for profile edit only. allows you to have custom (not nested) valid forms in other profile tabs

• Tweak: UM admins can see unapproved users on front-end members directory
• Fixed: few misspelling errors
• Fixed: bug with custom profile templates (showing blank) resolved

• New: added option to show user social links in profile header (optional)
• New: added option to display post featured image in profile "posts" tab
• Tweak: improved error reporting for theme conflicts on photo upload
• Fixed: issue with comments tab on profile

• New: adds automatic body class to UM core pages automatically
• Fixed: important jQuery issue
• Fixed: upload security issue - extension error was empty

• New: added a logout template If user is already logged in (customizable)
• New: strong password formula not required when resetting password (optional)
• Fixed: jQuery issue with live() method - Thanks to Jim Wetton

• Fixed: issue with saving user account general tab

• New: official support for plugin extensions released

• Tweak: added licensing support to plugin core
• Fixed: issue with account form

• Tweak: Redux up to date
• Fixed: security issue related to deleting a temp file via ajax
• Fixed: bug with a php warning on undefined field type

Credits to "James Golovich http://www.pritect.net" for the security checks

• Fixed: important correction from previous version

• New: integration with comments to show user profile link instead of user link (not compatible with all themes)
• New: option to control maximum size of uploaded profile photo
• New: option to control maximum size of uploaded cover photo
• Tweak: URL fields will are now treated as hyperlinks
• Fixed: bug with member directory privacy option
• Fixed: bug with using # as a character in file or image upload

• New: added {user_avatar_small} tag to display user photo in menu (requires extra css work)
• Tweak: Removed !important css rules from colors and backgrounds
• Fixed: issue with content block field

• New: improved & modern html e-mail templates
• New: addon to transfer BuddyPress profile photos to Ultimate Member (user request)
• New: added option to turn off time bot feature (fixes conflict with plugins)
• New: added built-in addons support
• Tweak: improved backend design and css

• Fixed: bug with numeric validation for a field
• Fixed: bug with conditional logic rules with checkbox