Fix: Removed UTF-8 Byte Order Marks (BOM) inadvertently introduced in the 1.2.3 release, which corrupted API key masking in the admin panel and could cause unexpected “Headers already sent” warnings.
1.2.3
Fix: Hardened same-origin checks across the REST proxy and events webhook to gracefully handle differing WordPress Address and Site Address configurations, and www. subdomain permutations.
Fix: Proxied requests now correctly forward the Origin and Referer headers to the try-on backend, supporting strict portal-level domain allowlists.
Fix: The OAuth handshake now includes the explicit storefront_url metadata to support headless WordPress setups.
1.2.2
Feature: Support for advanced Conversion Analytics. Added an internal events proxy to securely stream widget telemetry (funnel metrics) to your Genvoris dashboard while protecting API keys.
UI/UX: Added full customization settings for the try-on button (Background Color, Text Color, Border Radius) directly in the WordPress admin panel.
Compat: synchronised the readme Stable tag with the plugin file Version header (now 1.2.2).
1.2.1
UI/UX: Added full customization settings for the try-on button (Background Color, Text Color, Border Radius) directly in the WordPress admin panel.
1.2.0
Security: REST proxy permission_callback now uses a dedicated check_proxy_permission() method instead of __return_true. All access-control checks (plugin-connected, same-origin, path allow-list, per-IP rate limit) are enforced in the permission callback where WordPress expects them.
Security: Origin or Referer header is now required on every proxy request. Requests without either header (e.g. direct curl/scripted abuse) are rejected with 403. Previously, missing Origin/Referer was silently allowed.
Compat: synchronised the readme Stable tag with the plugin file Version header (now 1.2.0).
1.1.0
Auto-style detection: the widget now matches your store’s colors automatically.
Security: webhook deliveries are now de-duplicated by delivery id (X-Genvoris-Delivery), so a retried portal webhook can never re-apply the same side effect.
UX: all five monetization model labels are shown in plain English throughout the admin.
Improved error handling across the storefront loader and REST proxy.
Performance: storefront loader improvements.
Compat: synchronised the readme Stable tag and the plugin Version header at 1.1.0 (resolves the prior 1.0.9 header / 1.1.0 constant mismatch).
1.0.5
Security: REST proxy now sanitizes every forwarded query parameter and returns the upstream JSON via WP_REST_Response (no more raw echo), so all output is escaped by WordPress.
Security: REST proxy and per-user /status endpoint now require a valid wp_rest nonce in addition to the existing same-origin check; guests still get a generic status payload without a nonce.
Security: storefront widget config now ships wp_create_nonce(‘wp_rest’) so the bundle can attach X-WP-Nonce to every proxy/status call.
I18n: text domain renamed from genvoris-virtual-tryon to genvoris-virtual-try-on to match the plugin slug; affects all gettext calls and the Plugin Header.
Compat: Tested up to bumped to 6.9.
Docs: fixed a Plugin Header description that was split mid-word.
1.0.8
Fix: added a rest_authentication_errors filter at priority 200 (runs after WordPress core’s rest_cookie_check_errors at priority 100) to clear rest_cookie_invalid_nonce errors for the /wp-json/genvoris/v1/proxy/* route only. The widget bundle sends X-WP-Nonce on every call; on cached/guest pages that nonce could not be validated, causing a 403 that the widget surfaced as “This domain is not authorized for try-on. Please contact the store.”
Fix: relaxed the same-origin Origin/Referer check so that requests missing both headers (normal for same-origin simple GETs under a strict Referrer-Policy) are allowed through rather than rejected.
Compat: synchronised the readme Stable tag with the plugin file Version header (now 1.0.8).
1.0.7
Fix: removed the wp_rest nonce requirement from the same-origin /wp-json/genvoris/v1/proxy/* route. On cached storefront pages and in guest sessions, server-minted nonces frequently failed wp_verify_nonce(), so every widget call to /api/status, /api/config, /api/analyze, and /api/tryon returned 403 rest_cookie_invalid_nonce — surfaced to shoppers as “This domain is not authorized for try-on”. The proxy is still protected by the server-held API key, same-origin Origin/Referer check, per-IP rate limit, and an explicit upstream path allow-list, matching the v1.0.6 fix already applied to /wp-json/genvoris/v1/status.
Fix: added api/status to the proxy’s upstream allow-list so the widget’s status poll no longer 404s through the proxy after the nonce gate was lifted.
Compat: synchronised the readme Stable tag with the plugin file Version header (now 1.0.7).
1.0.6
Fix: removed X-WP-Nonce header from the public status endpoint request in the storefront widget; sending a nonce to a permission_callback: ‘__return_true’ endpoint caused WordPress to return 403 rest_cookie_invalid_nonce when the nonce was stale or guest-generated.
Compat: synchronised the readme Stable tag with the plugin file Version header (now 1.0.6).
1.0.4
Fix: PHP 8 TypeError when the session-mint REST endpoint received a WP_Error without status data.
Fix: dead code path in the front-end placement guard could trigger on themes that fired both the configured WC hook AND woocommerce_after_single_product_summary.
Tweak: hosted widget bundle cache-buster now tracks plugin version (no more drifting magic constant).
Docs: full WP.org-compliant readme with explicit External Services disclosure.
Compat: synchronised the readme Stable tag with the plugin file Version header (now 1.0.4).
1.0.3
Default widget position changed to “below Add to Cart” so the button is discoverable on themes that don’t render a floating fallback.
Activation hook now seeds defaults for every monetization-related option.
