Skip to content

Release#1340

Open
Soare-Robert-Daniel wants to merge 19 commits into
masterfrom
development
Open

Release#1340
Soare-Robert-Daniel wants to merge 19 commits into
masterfrom
development

Conversation

@Soare-Robert-Daniel

@Soare-Robert-Daniel Soare-Robert-Daniel commented Jul 15, 2026 •
edited by selul
Loading

Copy link
Copy Markdown
Contributor

Changelog

  • Security updates

Linked issues

This release will close the following issues once merged:

  • Closes Lazy-rendered charts can stay empty when Visualizer renderer scripts load out of order #1319 — Lazy-rendered charts can stay empty when Visualizer renderer scripts load out of order
  • Closes Codeinwp/visualizer-pro#590 — Scheduled CSV auto-sync does not update after visualizer-upload-data permission guard
  • Closes Codeinwp/visualizer-pro#591 — Visualizer: Tables and Charts Manager - Contributor+ SSRF via JSON import (unfixed in 4.0.4)
  • Closes Codeinwp/visualizer-pro#592 — [Security Analysis] dev code in AI builder
  • Closes Codeinwp/visualizer-pro#593 — Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
  • Closes Codeinwp/visualizer-pro#594 — [Security Analysis] Broken Access Control — nonce treated as authorization across chart handlers (Free + Pro)
  • Closes Codeinwp/visualizer-pro#596 — [Security Analysis] PHP Object Injection via unsafe unserialize() (Free + Pro)

lucadobrescu and others added 6 commits July 8, 2026 14:30
@lucadobrescu @claude
fix: preserve script order for lazy-rendered charts so the renderer r…
b8f343b 
…egisters before render-facade fires (#1319)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@lucadobrescu @claude
test: force lazy rendering in e2e env so the lazy-render spec exercis…
f7a18e6 
…es the delayed script loader

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@pirate-bot
Sync branch [skip ci]
8a24b7e
@pirate-bot
Sync branch [skip ci]
6bad282
@Alexia-Soare @claude
fix: scheduled CSV refresh runs without a logged-in user
99d4f52 
Background schedule/refresh invokes the upload handler with no logged-in
user and VISUALIZER_DO_NOT_DIE set. Since Feb 2026 uploadData() also
requires edit_posts/edit_post, so the scheduled import silently returned
and charts stopped auto-updating.

Gate the two capability checks on $can_die so they apply to real web
requests only; trusted internal calls (the only context that defines
VISUALIZER_DO_NOT_DIE, never from request input) proceed. Web path and
the nonce check are unchanged.

Fixes Codeinwp/visualizer-pro#590

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@Soare-Robert-Daniel
fix: centralize safe remote imports for SSRF (#1336)
41c7ec5
@pirate-bot

pirate-bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Make sure you've reviewed the themeisle_sdk_compatibilities filter of the plugin and updated it accordingly.

@pirate-bot

pirate-bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Plugin build for d70041e is ready 🛎️!

girishpanchal30 and others added 10 commits July 15, 2026 10:36
@girishpanchal30
fix: sanitize data to prevent XSS for $post_settings (#1338)
8699a77
@Soare-Robert-Daniel
test: cover settings sanitization in the chart save flow (#1341)
d25906b
@lucadobrescu
fix: harden unserialize() against PHP object injection (#1339)
09eaf4c
@Soare-Robert-Daniel
fix: preserve remote import compatibility (#1343)
2bad5f1
@lucadobrescu
fix: enforce chart-level authorization on AJAX handlers (#1342)
e42b4d7
@Soare-Robert-Daniel
fix: prevent D3 export action XSS via untrusted dataUrl (#1344)
fd96ea1
@Soare-Robert-Daniel
fix: reject cyclic serialized chart data in decode_content() (#1345)
766adef
@selul
Merge pull request #1333 from Codeinwp/fix/schedule-csv
d54a05a 
fix: scheduled CSV refresh runs without a logged-in user
@selul
Merge pull request #1332 from Codeinwp/fix/visualizer
d3f84d3 
Fix lazy-rendered charts staying blank on script load-order race
@dependabot
chore(deps): bump codeinwp/themeisle-sdk from 3.3.54 to 3.3.55
df56191 
Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.54 to 3.3.55.
- [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases)
- [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.55/CHANGELOG.md)
- [Commits](Codeinwp/themeisle-sdk@v3.3.54...v3.3.55)

---
updated-dependencies:
- dependency-name: codeinwp/themeisle-sdk
  dependency-version: 3.3.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@selul

selul commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Public changelog

  • Fixed: Fixed charts with lazy rendering enabled sometimes staying blank on the page until a full reload (Lazy-rendered charts can stay empty when Visualizer renderer scripts load out of order #1319)
  • Fixed: Fixed scheduled auto-refresh of charts that use a remote CSV file, which had stopped updating chart data (Codeinwp/visualizer-pro#590)
  • Fixed: Fixed a security issue where remote data imports could be abused to make the site fetch content from internal or private network addresses (Codeinwp/visualizer-pro#591)
  • Fixed: Fixed a security issue where the AI Chart Builder could be misused to read files stored on the server (Codeinwp/visualizer-pro#592)
  • Fixed: Fixed a security issue where the chart title field could be used to inject malicious scripts into pages (Codeinwp/visualizer-pro#593)
  • Fixed: Fixed a security issue where logged-in users could view, edit, delete, or export charts belonging to other users (Codeinwp/visualizer-pro#594)
  • Fixed: Fixed a security issue where specially crafted chart data could allow attackers to run malicious code on the site (Codeinwp/visualizer-pro#596)

selul and others added 2 commits July 21, 2026 12:06
@selul
Merge pull request #1347 from Codeinwp/dependabot/composer/developmen…
d70041e 
…t/codeinwp/themeisle-sdk-3.3.55

chore(deps): bump codeinwp/themeisle-sdk from 3.3.54 to 3.3.55
@selul @claude
chore: remove PR announcer workflow [skip ci]
efded60 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Lazy-rendered charts can stay empty when Visualizer renderer scripts load out of order

6 participants

@Soare-Robert-Daniel @pirate-bot @selul @lucadobrescu @Alexia-Soare @girishpanchal30