Fix: the floating digital human avatar selector now only shows successfully generated avatars, preventing draft or failed avatars from being selected and hidden on the front end.
1.1.2
WordPress.org review: removed shortcode/admin inputs that accepted arbitrary button CSS or pasted icon markup.
Security: floating button background, color, size, position, modal dimensions, title tags, class names, and Elementor button appearance values now use stricter allowlists and sanitizers.
Security: Custom HTML blocks are no longer filtered through shortcode parsing; use the WordPress Shortcode block or normal shortcode-capable content areas instead.
Compatibility: existing navtalk_ options, shortcodes, CSS classes, JavaScript handles and AJAX actions are unchanged.
1.1.1
WordPress.org review: plugin display name, text domain, package root and main bootstrap file updated to navtalk-digital-human / navtalk-digital-human.php to match the approved slug.
Compatibility: existing navtalk_ options, shortcodes, CSS classes, JavaScript handles and AJAX actions are unchanged so current site settings and embedded shortcodes continue to work after update.
1.1.0
Packaging: plugin folder renamed to navtalk-digital-human to match the plugin slug and main bootstrap file, aligning with WordPress.org guidelines.
Encoding: source files normalized to UTF-8 (without BOM) and line endings standardized for better cross-platform compatibility and editor support.
Maintenance: documentation refreshed (README, install/shortcodes docs) and version metadata kept in sync across navtalk-digital-human.php, readme.txt and the installed-version option.
Compatibility: tested up to WordPress 7.0; verified shortcodes, admin settings, AJAX (test connection / refresh avatars), floating widget and Elementor widgets on WP 7.0. No breaking changes to existing shortcodes, settings or Elementor widgets.
1.0.7
Security: AJAX handlers (wp_ajax_navtalk_test_connection, wp_ajax_navtalk_refresh_avatars) now verify capability and nonce explicitly with current_user_can() + wp_verify_nonce() so Plugin Check can detect both checks statically.
Security: late escaping applied to all variable, option and generated output that was previously echoed via phpcs:ignore. render_overlay_layout() / render_bottom_layout() output is now passed through wp_kses() with a strict tag/attribute whitelist (NavTalk_Shortcode::allowed_avatar_card_html()); same fix applied to the Elementor avatar widget.
Security: remaining ternary echoes in admin/shortcode templates wrapped with esc_attr() / esc_html() (display:none toggles, status colors/badges, “Available/Unavailable” labels).
Refactor: the global floating-widget collapse-state script moved out of wp_add_inline_script into a registered file at public/js/navtalk-floating-collapse.js.
1.0.6
Plugin Check: limit readme tags to five; prefix globals in uninstall.php; icon preview handling hardened; drop redundant load_plugin_textdomain (WordPress.org-hosted translations load automatically since WP 4.6).
Note for scans: run Plugin Check with the plugin folder named navtalk-digital-human so the expected text domain matches the slug.
1.0.5
Release build for WordPress.org: Stable tag aligned with NAVTALK_VERSION; package root folder navtalk-digital-human with main file navtalk-digital-human.php (no functional change from 1.0.4).
1.0.4
WordPress.org review: plugin display name and text domain updated (NavTalk Digital Human / navtalk-digital-human); main bootstrap file renamed to navtalk-digital-human.php
Removed plugin settings field that stored custom CSS; use the theme Customizer “Additional CSS” (or Site Editor) instead
Elementor copy updated to clarify third-party NavTalk integration
Minor escaping and user-visible error label consistency
