HandL UTM Grabber / Tracker

Changelog

2.9.5

  • Fix Contact Form 7 admin list page redirecting to the last form’s editor

2.9.4

  • Ninja Form fixes

2.9.3

  • Ninja Form XSS vulnerability fix

2.9.2

  • Reduce size of the plugin

2.9.1

  • WP 7.0 compatibility

2.9.0

  • One click setup for Gravity / Contact Form 7 / Ninja / Elementor Form

2.8.4

  • Promotional updates & improvements

2.8.3

  • Security: Improved output escaping and sanitization
  • Security: Added direct file access protection

2.8.2

  • New: Added Elementor integration for tracking UTM parameters in forms

2.8.1

  • Security: Fixed reflected XSS vulnerabilities in shortcode output
  • Security: Improved input sanitization for UTM and tracking parameters following WordPress best practices
  • Security: Added context-aware output escaping using esc_html() and esc_url()
  • Security: Removed urldecode() from output to prevent double-encoding bypass attacks
  • Security: Implemented “sanitize early, escape late” pattern throughout the codebase

2.8

  • Brand new interface
  • Fixed UI bugs and improved user experience in Contact Form 7 integration

2.7.32

Contact Form 7 Bugfix for 6.1

2.7.31

  • Added shortcuts for Contact Form 7 integration and more documentation for CF7 and Gravity

2.7.30

  • Added httponly cookie setting (default is still httponly=false)

2.7.29

  • Fixed ninja form check for site status health check

2.7.28

  • Fixed append UTM to all the links bug (potential XSS vulnerability)

2.7.27

  • Fixed decoding problem

2.7.26

  • Added more to the knowledge base. Fixed PHP8.1 related bug as well.

2.7.25

  • Introduced knowledge base

2.7.24

  • Dr. UTM Lab release and other notifications.

2.7.23

  • Fixing the append utm feature bug

2.7.22

  • Fixing fatal error caused by 2.7.21

2.7.21

  • Gravity form improvements

2.7.19

  • Best practise for tracking on IOS 14 has been added. Dead links are corrected.

2.7.18

  • Plugin maintenance and cleanups

2.7.17

  • GCLID Reporter apps released.

2.7.16

  • Bugfix: Potential XSS fix. Big shout out to Marcos Oliveira (@marcosvixtor). Thanks for reporting it.

2.7.15

  • Bugfix: Subscribers can see UTM on the Toolbar. Thanks @risoedus for reporting

2.7.14

  • Some new seasonal notifications added.

2.7.13

  • UTM Grabber notifications added.

2.7.12

  • Health check and best practice of collecting UTMs in Ninja Forms

2.7.11

  • New domain update.

2.7.10

  • Health check and best practice of collecting UTMs related to caching. Check “site health” page to make sure you are not missing any data.

2.7.9

  • Health check and best practice of collecting UTMs in Gravity Forms

2.7.8

  • BugFix: UTM field values having % was breaking the JavScript.
  • Coming Soon: UTM Grabber smart troubleshooting / notifications

2.7.7

  • Health check and best practice of collecting UTMs in Contact Form 7

2.7.6

  • Adding new health check for website audit and tracking js bug fix for utm-out

2.7.5

  • Fixing WP CLI related problems.

2.7.4

  • Improvements, plugin page description change, screenshot added. PHP 5.4 fix for array notation.

2.7.3

  • Various improvements including menu bar for UTM and health check recommendations.

2.7.2

  • fix for headers already sent. Thanks for reporting @labatt

2.7.1

  • fix for null coalescing operator for PHP < 7.0 compatiblility

2.7

  • Zapier integration added for Contact Form 7, Ninja Form, Gravity Form

2.6.6

  • simple_html_dom.php dependency upgraded to the latest

2.6.5

  • Critical Bug Fix: Possible cross-site request forgery (CSRF) due to add_option, update_option usage

2.6.4

  • Varnish cache and WP Engine workaround fix (JS based COOKIE save)
  • 502 error fixed. Possibly caused by printed text before we set the COOKIES.
  • PHP 7.3 related warnings due to simple_html_dom.php fixed

2.6.3

  • BUG FIX: https://wordpress.org/support/topic/php-notice-undefined-index-ninja-php/ & https://wordpress.org/support/topic/php-deprecated-function/

2.6.2

2.6.1

  • Absolutely nothing, just trying to fix the version

2.6.0

  • Ninja Form Merge Tags implemented for all the variables used in HandL UTM Grabber / Tracker (e.g. {handl:utm_campaign})

2.5.13

  • localhost cookie problem fixed.

2.5.12

  • Bugfix for [handl_landing_page] and [handl_url]: the URL was not populating on secure sites (https://). Subdomain suport for all the UTM variables and other shortcodes. Special thanks to David W for sponsoring the update.

2.5.11

  • Security Bugfix: Potential XSS attack using cookies. Special thanks to Robert Tubridy for reporting.

2.5.10

  • Bugfix: Fix for append UTM variables to all the links: it was adding the UTMs even though the feature is turned off.

2.5.9

  • Bugfix: Initialize SERVER variables and fix nav_menu_link_attributes

2.5.8

  • Bugfix: Visual Composer Accordion/Tabs fix (Append UTM feature conflict). Thanks @radasonea

2.5.7

  • Bug-fix caused by v2.5.7.

2.5.6

  • Append UTM fix for WP menu, new shortcodes: [username] and [email]

2.5.5

  • Fix for the JS in footer for website uses minify JS (Thanks sylvainww)

2.5.4

  • Added CouponHut theme support (Thanks zizzi17)

2.5.3

  • WooCommerce support: All parameters (UTM and others) are appended to the corresponding order’s meta when available.

2.5

  • One click to aappend UTM variables to all the links on your site.

2.3

  • Fix for php close tag at the end of the file.

2.2

  • New shortcodes added for leads tracking (e.g. Original Referral URL, Referral URL, IP, Landing Page etc.)

2.1

  • Shortcode support for CF7 and Salesforce (Thanks to jenrstretch and wpkmi)

2.0

  • Hassle Free Implementation (No Shortcode)

1.4

1.3

1.2

  • BugFix for Contact Form 7 (Thanks wpkmi)

1.1

  • Shortcodes changed to support form input
  • World’s most effective written code 🙂

1.0

  • Hello World 🙂

Plugin Website
Visit website

Author
Haktan Suren
Version:
2.9.5
Last Updated
June 22, 2026
Active Installs
10000
Requires
WordPress 3.6.0
Tested Up To
WordPress 7.0
Requires PHP
5.4

Share Post

Join our newsletter.

Get insights into what’s happening at ChangelogWP right in your inbox. We don’t believe in spam.