Added: Character range (unicode-range) support per font in the Fonts module — limit which characters trigger a font download for faster page loads
Added: Quick-pick presets in the admin UI for common subsets (Latin, Latin Extended, Greek, Cyrillic, Vietnamese, Punctuation/Symbols)
Added: unicode-range is also emitted into the theme.json fontFace data layer so it propagates to the block editor
Security: Login Security no longer trusts X-Forwarded-For / Client-IP headers by default — these were spoofable on direct connections, allowing IP-based lockouts to be evaded or weaponized. Sites behind a trusted reverse proxy or CDN can opt in via the new “Trust Proxy Headers” setting.
Security: Login Security now validates client IPs through FILTER_VALIDATE_IP when proxy headers are in use, dropping malformed values rather than hashing them into transient keys.
Fixed: Block Cleanup XPath query now safely escapes class names via a proper XPath 1.0 string-literal builder (addcslashes was the wrong escape function and silently failed on classes containing quotes).
Fixed: Snippets kses_with_styles() placeholder collision — <style> extraction now uses a per-call random token so a snippet body containing the literal placeholder string can no longer corrupt the output.
Fixed: Fonts module admin badge now reflects the Style field (free-text input) instead of looking for a <select> that doesn’t exist.
Fixed: Fonts module options static cache is invalidated automatically on update_option_functionalities_fonts, preventing stale font lists when the option is updated mid-request.
Fixed: Task Manager AJAX handlers (Export, Delete, etc.) now register whenever in admin, so existing projects remain manageable even when the module is toggled off.
Fixed: Task Manager card layout — widget badge now sits above the action row, so Open/Export/Delete align consistently across cards.
Fixed: Help & Support buttons now have higher CSS specificity to defeat WP 7.0’s button reset.
1.4.5
Added: WOFF and WOFF2 font file uploads now supported in the WordPress media library
Security: Font uploads validated via binary magic-byte signatures to prevent malicious file uploads
1.4.4
Fixed: Schema module filter_article() now skips content with Vue/Alpine.js directives — prevents DOMDocument from corrupting JS framework templates
Fixed: Block Cleanup module filter_content_cleanup() now skips content with JS framework directives
Refactored: Extracted Vue-safe DOMDocument guard into shared Has_Dom_Parser trait used by Link Management, Schema, and Block Cleanup
All three the_content filters that use DOMDocument (priorities 12, 14, 999) are now protected against JS framework corruption
1.4.3
Fixed: Link Management process_content() now skips HTML containing Vue.js directives (v-cloak, v-if, v-show, :class, @click, {{ }})
Fixed: DOMDocument re-parsing was corrupting Vue/React template syntax in themes like MyListing, causing explore pages to flash and disappear
Improved: Early-exit check prevents unnecessary DOM parsing on content with JavaScript framework directives
1.4.2
Fixed: wp_kses now preserves data-* attributes on <script>, <style>, and <link> tags in Header & Footer snippets
Fixed: async, defer, nomodule, id, nonce, crossorigin, and as attributes no longer stripped from snippet tags for non-admin users
Fixed: Unified allowed-tags list between snippet output and save sanitization to prevent attribute drift
Fixed: README.md version was outdated (still showed 1.4.0)
1.4.1
Added: Opt-in “Delete all plugin data when uninstalling” checkbox on the dashboard — removes all options, post metadata, transients, and files on uninstall
Fixed: Replaced all direct file_put_contents calls with WP_Filesystem API across Task Manager, Redirect Manager, and JSON file creation
Fixed: Extracted duplicate CSS sanitization into a shared trait used by Components and Fonts modules
Fixed: Removed sslverify => false from loopback HTTP requests in Assumption Detection
Fixed: Disabled debug console logging in SVG Icons editor script
Fixed: Removed dead code in admin UI script
1.4.0
Added: Bricks Builder font integration — custom fonts appear in Bricks typography picker and load inside the builder canvas
Added: PWA module prefills app name, short name, description, and icons from WordPress Settings and Site Icon
