| @@ -2,8 +2,41 @@ | ||
| 2 | 2 | WP VR - 360 Panorama and virtual tour creator for WordPress is a customized panorama & virtual builder tool for WordPress websites. |
| 3 | 3 | |
| 4 | 4 | ## Changelog |
| 5 | 5 | |
| 6 | +### 9.1.3 (2026-09-17) | |
| 7 | +- **Security Fix:** Resolved broken access control, authorization bypasses, and stored XSS vulnerabilities in the setup wizard, tour file import, and REST API endpoints. | |
| 8 | +- **Fix:** Restored Fluent Forms and WooCommerce product hotspot types in the modern tour editor. | |
| 9 | +- **Enhancement:** Added searchable dropdown with live search and request cancellation for selecting Fluent Forms and WooCommerce products in hotspot configuration. | |
| 10 | +- **Fix:** Improved Fluent Forms script handling, layout styling, and dynamic form re-initialization inside tour scenes. | |
| 11 | +- **Fix:** Resolved issue where scene numbering counter failed to reset after deleting scenes in the creation modal. | |
| 12 | +- **Fix:** Corrected typo in default scene name across translation strings. | |
| 13 | + | |
| 14 | +### 9.1.2 (2026-09-15) | |
| 15 | +- **Fix:** Restored embed and social share functionality for virtual tours in the new UI (feature parity with legacy UI). | |
| 16 | +- **Fix:** Resolved embedded tour rendering issue (black screen) when tour loaded via the embed iframe. | |
| 17 | +- **Fix:** Improved tour type detection, hotspot rendering, and data validation across legacy and API services. | |
| 18 | + | |
| 19 | +### 9.1.1 (2026-09-08) | |
| 20 | +- **Fix:** Resolved issue where tours created with the new UI failed to render when embedded. | |
| 21 | +- **Fix:** Improved tour type detection and state synchronization across legacy and REST API services. | |
| 22 | +- **Fix:** Prevented WordPress `wptexturize` and content filters from corrupting tour inline scripts. | |
| 23 | +- **Fix:** Resolved container ID conflicts and script errors when embedding multiple tour instances on the same page. | |
| 24 | +- **Fix:** Resolved hotspot click and modal popup display issues across different content formats. | |
| 25 | +- **Fix:** Added safe fallbacks to prevent PHP undefined key warnings in scene and hotspot data validation. | |
| 26 | + | |
| 27 | +### 9.1.0 (2026-09-03) | |
| 28 | +- **New:** Added Breakdance page builder integration with dedicated WPVR block support. | |
| 29 | +- **New:** Added 360-degree video tour support with Video.js and VideoJS-VR integration in the modern tour editor and frontend. | |
| 30 | +- **Fix:** Resolved self-hosted 360-degree video dragging and touch navigation issues with robust deferred initialization. | |
| 31 | +- **Fix:** Resolved Gutenberg block inline script corruption caused by wptexturize modifying operators in the content filter. | |
| 32 | +- **Fix:** Improved video tour metadata handling, state synchronization, and toggle logic between UI modes and editor. | |
| 33 | + | |
| 34 | +### 9.0.3 (2026-09-01) | |
| 35 | +- **Security Fix:** Enforced object-level authorization (BOLA) checks on tour REST API and AJAX endpoints so users can no longer read, edit, or delete tours they don't own. | |
| 36 | +- **Security Fix:** Restricted the UI mode toggle endpoint to administrators only. | |
| 37 | +- **Security Fix:** Sanitized hotspot content (including FluentForm hotspots) on both server and client sides to prevent stored XSS. | |
| 38 | + | |
| 6 | 39 | ### 9.0.2 (2026-08-28) |
| 7 | 40 | - **Fix:** Resolved `wpvrhotspot is not defined` error when caching and JavaScript deferral plugins (such as Autoptimize, WP Rocket, LiteSpeed Cache) are active. |
| 8 | 41 | - **Fix:** Ensured frontend scripts and styles are reliably enqueued across Gutenberg blocks and page builder widgets. |
| 9 | 42 | - **Fix:** Resolved fatal error on `update.php` during plugin updates. |
