Skip to content

Release#1340

Merged
kushh23 merged 19 commits into
masterfrom
development
Jul 22, 2026
Merged

Release#1340
kushh23 merged 19 commits into
masterfrom
development

Conversation

@Soare-Robert-Daniel

@Soare-Robert-Daniel Soare-Robert-Daniel commented Jul 15, 2026 •
edited by selul
Loading

Copy link
Copy Markdown
Contributor

Changelog

  • Security updates

Linked issues

This release will close the following issues once merged:

  • Closes Lazy-rendered charts can stay empty when Visualizer renderer scripts load out of order #1319 — Lazy-rendered charts can stay empty when Visualizer renderer scripts load out of order
  • Closes Codeinwp/visualizer-pro#590 — Scheduled CSV auto-sync does not update after visualizer-upload-data permission guard
  • Closes Codeinwp/visualizer-pro#591 — Visualizer: Tables and Charts Manager - Contributor+ SSRF via JSON import (unfixed in 4.0.4)
  • Closes Codeinwp/visualizer-pro#592 — [Security Analysis] dev code in AI builder
  • Closes Codeinwp/visualizer-pro#593 — Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
  • Closes Codeinwp/visualizer-pro#594 — [Security Analysis] Broken Access Control — nonce treated as authorization across chart handlers (Free + Pro)
  • Closes Codeinwp/visualizer-pro#596 — [Security Analysis] PHP Object Injection via unsafe unserialize() (Free + Pro)

Public changelog

  • Fixed an issue where charts using lazy rendering could remain blank when their scripts finished loading in the wrong order.
  • Fixed scheduled imports from remote CSV files so charts continue to refresh automatically in the background.
  • Strengthened security when importing chart data from remote web addresses so requests can no longer be directed at private or internal network locations.
  • Improved the security of the AI Builder by removing leftover development functionality and requiring proper permissions to access chart data.
  • Fixed a security issue where the chart title field could be used to store malicious scripts.
  • Improved security so that users can only view, edit, delete, clone, or export charts they have permission to manage.
  • Strengthened the handling of stored chart data to block specially crafted content that could compromise the site.
  • Updated dependencies

lucadobrescu and others added 6 commits July 8, 2026 14:30
@lucadobrescu @claude
fix: preserve script order for lazy-rendered charts so the renderer r…
b8f343b 
…egisters before render-facade fires (#1319)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@lucadobrescu @claude
test: force lazy rendering in e2e env so the lazy-render spec exercis…
f7a18e6 
…es the delayed script loader

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@pirate-bot
Sync branch [skip ci]
8a24b7e
@pirate-bot
Sync branch [skip ci]
6bad282
@Alexia-Soare @claude
fix: scheduled CSV refresh runs without a logged-in user
99d4f52 
Background schedule/refresh invokes the upload handler with no logged-in
user and VISUALIZER_DO_NOT_DIE set. Since Feb 2026 uploadData() also
requires edit_posts/edit_post, so the scheduled import silently returned
and charts stopped auto-updating.

Gate the two capability checks on $can_die so they apply to real web
requests only; trusted internal calls (the only context that defines
VISUALIZER_DO_NOT_DIE, never from request input) proceed. Web path and
the nonce check are unchanged.

Fixes Codeinwp/visualizer-pro#590

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@Soare-Robert-Daniel
fix: centralize safe remote imports for SSRF (#1336)
41c7ec5
@pirate-bot

pirate-bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Make sure you've reviewed the themeisle_sdk_compatibilities filter of the plugin and updated it accordingly.

@pirate-bot

pirate-bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Plugin build for d70041e is ready 🛎️!

girishpanchal30 and others added 12 commits July 15, 2026 10:36
@girishpanchal30
fix: sanitize data to prevent XSS for $post_settings (#1338)
8699a77
@Soare-Robert-Daniel
test: cover settings sanitization in the chart save flow (#1341)
d25906b
@lucadobrescu
fix: harden unserialize() against PHP object injection (#1339)
09eaf4c
@Soare-Robert-Daniel
fix: preserve remote import compatibility (#1343)
2bad5f1
@lucadobrescu
fix: enforce chart-level authorization on AJAX handlers (#1342)
e42b4d7
@Soare-Robert-Daniel
fix: prevent D3 export action XSS via untrusted dataUrl (#1344)
fd96ea1
@Soare-Robert-Daniel
fix: reject cyclic serialized chart data in decode_content() (#1345)
766adef
@selul
Merge pull request #1333 from Codeinwp/fix/schedule-csv
d54a05a 
fix: scheduled CSV refresh runs without a logged-in user
@selul
Merge pull request #1332 from Codeinwp/fix/visualizer
d3f84d3 
Fix lazy-rendered charts staying blank on script load-order race
@dependabot
chore(deps): bump codeinwp/themeisle-sdk from 3.3.54 to 3.3.55
df56191 
Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.54 to 3.3.55.
- [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases)
- [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.55/CHANGELOG.md)
- [Commits](Codeinwp/themeisle-sdk@v3.3.54...v3.3.55)

---
updated-dependencies:
- dependency-name: codeinwp/themeisle-sdk
  dependency-version: 3.3.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@selul
Merge pull request #1347 from Codeinwp/dependabot/composer/developmen…
d70041e 
…t/codeinwp/themeisle-sdk-3.3.55

chore(deps): bump codeinwp/themeisle-sdk from 3.3.54 to 3.3.55
@selul @claude
chore: remove PR announcer workflow [skip ci]
efded60 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kushh23
kushh23 merged commit 0ffa3cc into master Jul 22, 2026
@pirate-bot

pirate-bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 4.0.6 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@pirate-bot pirate-bot added the released Indicate that an issue has been resolved and released in a particular version of the product. label Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

released Indicate that an issue has been resolved and released in a particular version of the product.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Lazy-rendered charts can stay empty when Visualizer renderer scripts load out of order

7 participants

@Soare-Robert-Daniel @pirate-bot @kushh23 @lucadobrescu @Alexia-Soare @girishpanchal30 @selul