| @@ -2,8 +2,53 @@ | ||
| 2 | 2 | WP VR - 360 Panorama and virtual tour creator for WordPress is a customized panorama & virtual builder tool for WordPress websites. |
| 3 | 3 | |
| 4 | 4 | ## Changelog |
| 5 | 5 | |
| 6 | +### 9.2.0 (2026-10-08) | |
| 7 | +- **New:** Added Text Overlay feature to create customizable rich text overlays on tour scenes with WYSIWYG editing, styling, and layer controls. | |
| 8 | +- **New:** Added Sticker Hotspots with interactive templates including discount buttons, add-to-cart, action buttons, social share, and social proof. | |
| 9 | +- **Enhancement:** Added responsive scaling, container observation, and customizable styling options (dimensions, borders, typography) for sticker hotspots. | |
| 10 | +- **Enhancement:** Self-hosted Inter font files to eliminate Google Fonts CDN dependencies and improve loading performance. | |
| 11 | +- **Fix:** Optimized mobile panorama resolution with attachment metadata, local file fallbacks, device GPU limit checks, and cached attachment lookups. | |
| 12 | + | |
| 13 | +### 9.1.4 (2026-10-02) | |
| 14 | +- **Fix:** Added missing alternative text (alt attribute) to the floor plan image for accessibility (WCAG) compliance. | |
| 15 | +- **Fix:** Improved floor plan pointer data handling and attribute escaping. | |
| 16 | +- **Fix:** Resolved duplicate telemetry tracker instantiation and event handling. | |
| 17 | + | |
| 18 | +### 9.1.3 (2026-09-17) | |
| 19 | +- **Security Fix:** Resolved broken access control, authorization bypasses, and stored XSS vulnerabilities in the setup wizard, tour file import, and REST API endpoints. | |
| 20 | +- **Fix:** Restored Fluent Forms and WooCommerce product hotspot types in the modern tour editor. | |
| 21 | +- **Enhancement:** Added searchable dropdown with live search and request cancellation for selecting Fluent Forms and WooCommerce products in hotspot configuration. | |
| 22 | +- **Fix:** Improved Fluent Forms script handling, layout styling, and dynamic form re-initialization inside tour scenes. | |
| 23 | +- **Fix:** Resolved issue where scene numbering counter failed to reset after deleting scenes in the creation modal. | |
| 24 | +- **Fix:** Corrected typo in default scene name across translation strings. | |
| 25 | + | |
| 26 | +### 9.1.2 (2026-09-15) | |
| 27 | +- **Fix:** Restored embed and social share functionality for virtual tours in the new UI (feature parity with legacy UI). | |
| 28 | +- **Fix:** Resolved embedded tour rendering issue (black screen) when tour loaded via the embed iframe. | |
| 29 | +- **Fix:** Improved tour type detection, hotspot rendering, and data validation across legacy and API services. | |
| 30 | + | |
| 31 | +### 9.1.1 (2026-09-08) | |
| 32 | +- **Fix:** Resolved issue where tours created with the new UI failed to render when embedded. | |
| 33 | +- **Fix:** Improved tour type detection and state synchronization across legacy and REST API services. | |
| 34 | +- **Fix:** Prevented WordPress `wptexturize` and content filters from corrupting tour inline scripts. | |
| 35 | +- **Fix:** Resolved container ID conflicts and script errors when embedding multiple tour instances on the same page. | |
| 36 | +- **Fix:** Resolved hotspot click and modal popup display issues across different content formats. | |
| 37 | +- **Fix:** Added safe fallbacks to prevent PHP undefined key warnings in scene and hotspot data validation. | |
| 38 | + | |
| 39 | +### 9.1.0 (2026-09-03) | |
| 40 | +- **New:** Added Breakdance page builder integration with dedicated WPVR block support. | |
| 41 | +- **New:** Added 360-degree video tour support with Video.js and VideoJS-VR integration in the modern tour editor and frontend. | |
| 42 | +- **Fix:** Resolved self-hosted 360-degree video dragging and touch navigation issues with robust deferred initialization. | |
| 43 | +- **Fix:** Resolved Gutenberg block inline script corruption caused by wptexturize modifying operators in the content filter. | |
| 44 | +- **Fix:** Improved video tour metadata handling, state synchronization, and toggle logic between UI modes and editor. | |
| 45 | + | |
| 46 | +### 9.0.3 (2026-09-01) | |
| 47 | +- **Security Fix:** Enforced object-level authorization (BOLA) checks on tour REST API and AJAX endpoints so users can no longer read, edit, or delete tours they don't own. | |
| 48 | +- **Security Fix:** Restricted the UI mode toggle endpoint to administrators only. | |
| 49 | +- **Security Fix:** Sanitized hotspot content (including FluentForm hotspots) on both server and client sides to prevent stored XSS. | |
| 50 | + | |
| 6 | 51 | ### 9.0.2 (2026-08-28) |
| 7 | 52 | - **Fix:** Resolved `wpvrhotspot is not defined` error when caching and JavaScript deferral plugins (such as Autoptimize, WP Rocket, LiteSpeed Cache) are active. |
| 8 | 53 | - **Fix:** Ensured frontend scripts and styles are reliably enqueued across Gutenberg blocks and page builder widgets. |
| 9 | 54 | - **Fix:** Resolved fatal error on `update.php` during plugin updates. |
