Security: Further hardened thank-you page output so invalid or missing booking access tokens show only generic confirmation text.
1.0.10
Security: Hardened thank-you page output so invalid or missing booking access tokens show only generic confirmation text.
1.0.9
Security: Added signed thank-you booking access tokens so public thank-you pages do not reveal booking status from booking_id alone.
1.0.8
Added explicit check_ajax_referer() validation to frontend AJAX booking and Stripe Checkout actions.
Clarified that Stripe integration creates Checkout sessions only and does not include a public webhook endpoint.
1.0.7
Strengthened AJAX nonce verification and request validation for frontend booking and Stripe Checkout actions.
Tightened admin action nonce/permission handling for reset and template apply actions.
Minor sanitization and internal cleanup improvements for WordPress.org review.
1.0.6
Final reviewer fix: no public Stripe webhook endpoint, no php://input webhook handling, and no webhook-based booking status update path in this WordPress.org build.
1.0.5
Removed the public Stripe webhook endpoint from the WordPress.org version and kept Stripe Checkout creation behind explicit customer action.
1.0.4
Cleaned internal prefixes to use the unique livequpa prefix.
1.0.3
Internal review cleanup: updated settings option/group naming and final sanitization consistency.
1.0.1
Improved settings sanitization and shortcode output escaping for WordPress.org review.
