| @@ -1,12 +1,12 @@ | ||
| 1 | 1 | === GiveWP - Donation Plugin and Fundraising Platform === |
| 2 | -Contributors: givewp, dlocc, webdevmattcrom, ravinderk, mehul0810, kevinwhoffman, jason_the_adams, henryholtgeerts, kbjohnson90, alaca, benmeredithgmailcom, jonwaldstein, joshuadinh, glaubersilvawp, pauloiankoski | |
| 2 | +Contributors: givewp, dlocc, webdevmattcrom, ravinderk, mehul0810, kevinwhoffman, jason_the_adams, henryholtgeerts, kbjohnson90, alaca, benmeredithgmailcom, jonwaldstein, joshuadinh, glaubersilvawp, pauloiankoski, filipecouto, waynerocha | |
| 3 | 3 | Donate link: https://go.givewp.com/home |
| 4 | 4 | Tags: donation, donate, recurring donations, fundraising, crowdfunding |
| 5 | -Requires at least: 6.6 | |
| 6 | -Tested up to: 7.0 | |
| 5 | +Requires at least: 6.9 | |
| 6 | +Tested up to: 7.1 | |
| 7 | 7 | Requires PHP: 7.4 |
| 8 | -Stable tag: 4.15.3 | |
| 8 | +Stable tag: 4.17.0 | |
| 9 | 9 | License: GPLv3 |
| 10 | 10 | License URI: http://www.gnu.org/licenses/gpl-3.0.html |
| 11 | 11 | |
| 12 | 12 | Accept donations and begin fundraising with GiveWP, the highest rated WordPress donation plugin for online giving. |
| @@ -272,8 +272,98 @@ | ||
| 272 | 272 | |
| 273 | 273 | 10. Use almost any payment gateway integration with GiveWP through our add-ons or by creating your own add-on. |
| 274 | 274 | |
| 275 | 275 | == Changelog == |
| 276 | += 4.17.0: September 23rd, 2026 = | |
| 277 | +* Feature: Added the ability to embed donation forms on any website with a copy-paste snippet from the form builder | |
| 278 | +* Enhancement: Donation form embeds now show a loading state while the form loads | |
| 279 | +* Fix: Fixed PHP 8.4 deprecation notices about implicitly nullable parameters | |
| 280 | +* Fix: Fixed the revenue table index migration adding duplicate indexes when it runs more than once | |
| 281 | +* Fix: Added additional escaping to the legacy donation form's billing address fields. | |
| 282 | +* Security: Donors can no longer add unverified email addresses to their own donor record. | |
| 283 | +* Security: Enhanced security for donations imported from CSV | |
| 284 | + | |
| 285 | += 4.16.9: September 16th, 2026 = | |
| 286 | +* Security: Added additional validation to PayPal Commerce donation processing. | |
| 287 | +* Security: Added additional sanitization to donor information displayed on public pages. | |
| 288 | +* Fix: Resolved an issue where resuming a paused Stripe subscription triggered a fatal error. | |
| 289 | + | |
| 290 | += 4.16.8.1: September 10th, 2026 = | |
| 291 | +* Security: Improved validation of the event tickets purchase flow. | |
| 292 | +* Security: Added additional validation to PayPal Commerce completed-order processing. | |
| 293 | +* Security: Added additional validation to donor email lookups. Thanks Jakub Herman for responsibly disclosing this issue. | |
| 294 | + | |
| 295 | += 4.16.8: September 2nd, 2026 = | |
| 296 | +* Fix: Fixed a campaign's default donation form appearing unpublished in the form builder. | |
| 297 | +* Fix: Fixed PHP warnings on the form builder screen when its page is opened without the locale or donation form ID query arguments. | |
| 298 | +* Fix: Resolved a plugin conflict that prevented donor first and last names from being recorded when the Charitable plugin was active alongside GiveWP. | |
| 299 | +* Fix: Resolved an issue where the custom amount minimum and maximum also applied to the donation levels and the set donation amount, so a level below the minimum could not be donated. Forms that leave the minimum empty now fall back to the lowest configured amount, and a minimum or maximum with cents is no longer rounded down. | |
| 300 | +* Security: Removed vulnerable dead code related to legacy donor relinking. (CVE-2026-82676) | |
| 301 | +* Security: Enhanced security on donor account access. (CVE-2026-82675) | |
| 302 | +* Tweak: Replaced the axios HTTP client with WordPress core's apiFetch in the donor dashboard, reports, onboarding wizard, and the log and migration list tables, and removed axios from the plugin's JavaScript dependencies. | |
| 303 | + | |
| 304 | += 4.16.7.2: August 27th, 2026 = | |
| 305 | +* Security: Added additional hardening for serialized data handling in the donation flow. | |
| 306 | + | |
| 307 | += 4.16.7.1: August 24th, 2026 = | |
| 308 | +* Security: Added additional validation to PayPal Donations order requests. | |
| 309 | + | |
| 310 | += 4.16.7: August 20th, 2026 = | |
| 311 | +* Security: Hardened donor-account email access authentication. | |
| 312 | +* Security: Improved validation of the checkout login form. | |
| 313 | +* Fix: Resolved an issue where paused or failing Stripe Payment Element subscriptions remained stuck when the donor updated their payment method or the subscription was resumed in Stripe. | |
| 314 | +* Fix: Resolved a conflict where scripts enqueued by other plugins while a donation form was being rendered could stop the form builder design preview and embedded forms from loading. | |
| 315 | +* Fix: Resolved an issue where editing a page could exhaust the PHP call stack when a theme or plugin filtered post metadata. | |
| 316 | +* Fix: Activation banner for addons doesn't show when addons are activated from the Unified License Manager | |
| 317 | + | |
| 318 | += 4.16.6.1: August 12th, 2026 = | |
| 319 | +* Security: Added additional validation to PayPal Standard IPN. | |
| 320 | + | |
| 321 | += 4.16.6: August 6th, 2026 = | |
| 322 | +* Tweak: Improved the unified licensing page experience. | |
| 323 | +* Security: Added additional validation when handling serialized data during the donation process. | |
| 324 | +* Security: Added additional escaping and validation to legacy donor admin screens and the donors REST API. | |
| 325 | +* Security: Strengthened validation of the donor email-access token and the donation receipt email preview. | |
| 326 | +* Security: Added a capability check to the onboarding form preview screen to prevent unauthorized access. | |
| 327 | +* Security: Added nonce verification to the front-end registration handler and restricted automatic donor account linking to the verified donation checkout flow. | |
| 328 | +* Fix: Added validation to prevent empty password updates in the Donor Dashboard. | |
| 329 | +* Fix: Resolved an issue where uploading a ZIP add-on with a folder name that differs from the ZIP filename (e.g. give-recurring-donations-2.19.0.zip containing the folder give-recurring/) would fail to detect the plugin after extraction. | |
| 330 | + | |
| 331 | += 4.16.5.1: July 27th, 2026 = | |
| 332 | +* Security: Strengthened security on legacy donors listing and donation details pages. | |
| 333 | + | |
| 334 | += 4.16.5: July 22nd, 2026 = | |
| 335 | +* Fix: Resolved an issue where selecting a donation amount level would also select other levels with the same value. | |
| 336 | +* Fix: Resolved an issue where extra separators could render in the donation confirmation page header when line breaks were present in the header text. | |
| 337 | +* Fix: Resolved an issue where refunding a donation made with a per-form Stripe account would fail because the refund request used the default account instead of the form-specific account. | |
| 338 | + | |
| 339 | += 4.16.4: July 14th, 2026 = | |
| 340 | +* Security: Added additional validation to the core settings importer. | |
| 341 | +* Security: Added additional escaping to donor information displayed in the admin. | |
| 342 | +* Security: Added additional escaping to the Sequoia (Multi-Step Form) template output. (CVE-2026-14987) | |
| 343 | + | |
| 344 | += 4.16.3: July 6th, 2026 = | |
| 345 | +* Security: Added additional validation to ensure donation gateway selection respects the enabled payment gateway settings. | |
| 346 | +* Security: Improved escaping of donation form template output. | |
| 347 | +* Security: Improved the security of the recurring donation REST API. | |
| 348 | + | |
| 349 | += 4.16.2: July 1st, 2026 = | |
| 350 | +* Security: Added additional escaping and sanitization to the Sequoia (Multi-Step Form) template settings and donation form markup (CVE-2026-13704). | |
| 351 | + | |
| 352 | += 4.16.1: June 29th, 2026 = | |
| 353 | +* Security: Standardized email access confirmation AJAX responses to prevent distinguishable server responses. | |
| 354 | +* Security: Added additional escaping and sanitization to the Campaign Comments block and shortcode attributes (CVE-2026-13246). | |
| 355 | + | |
| 356 | += 4.16.0: June 24th, 2026 = | |
| 357 | +* Feature: Added an optional donation ID parameter to gateway webhook event handlers, allowing gateways to locate donations when the transaction ID is only available in the webhook payload. | |
| 358 | +* Fix: Resolved an issue where multi-step donation forms could be incorrectly rejected as spam because Akismet was checked on every form step; the spam check now runs once on final submission. | |
| 359 | + | |
| 360 | += 4.15.5: June 22nd, 2026 = | |
| 361 | +* Security: Improved the security of the Donor Dashboard login process. | |
| 362 | + | |
| 363 | += 4.15.4: June 15th, 2026 = | |
| 364 | +* Security: Added additional protection to the email notification settings. | |
| 365 | + | |
| 276 | 366 | = 4.15.3: May 28th, 2026 = |
| 277 | 367 | * Fix: Resolved a user role permission conflict with The Events Calendar Pro |
| 278 | 368 | * Fix: Resolved an issue when using multiple Stripe accounts, recurring donations, and webhook API 2026-02-25.clover |
| 279 | 369 | |
