New: “Xtreme Courses — Overview” dashboard widget — shows published course & lesson counts, quick actions (Create Course, All Courses, Settings), a Popular Features grid, a Pro upsell, and Docs / Support / Blog / Buy links.
2.1.9
WordPress.org reviewer feedback round (follow-up to the 2.1.8 submission) — addresses the two findings from the latest manual review.
REST permissions: the course publish endpoint (POST /xtreme-courses/v1/courses/{id}/publish) now uses a dedicated publish_course_permissions_check() gate. Publishing previously shared the editing gate (edit_post ownership only); it now additionally requires the publish-specific primitive capability for the course post type (publish_xtrc_courses, resolved from the CPT capability_type). An author who can edit a draft but lacks the publish capability is denied — the permission check now matches the strength of the action. includes/REST/class-courses-controller.php.
Certificate generator: the in-document PDF stylesheet block is now composed from a constant element name rather than a literal <style> element, with an expanded comment clarifying that this CSS is parsed by the bundled PDF engine (never streamed to the browser) so wp_enqueue_style() does not apply. Every browser-facing script and style in the plugin is registered/enqueued via wp_register_* / wp_enqueue_*; this block is PDF-document markup, not front-end output. Output is byte-identical. includes/Certificate/class-certificate-generator.php.
readme.txt: the == Changelog == section is trimmed below WordPress.org’s 5000-character limit (older per-version entries rolled up; full history retained in CHANGELOG.md).
No database changes, no schema changes. Safe to upgrade.
2.1.8
WordPress.org reviewer feedback round: updated the bundled Chart.js to v4.5.1 (MIT) with a matching filemtime()-busted enqueue; the optional mPDF autoloader now loads only from the plugin’s own vendor/ (the non-portable ABSPATH fallback was removed); lowered the top-level admin menu position from 2 to 58; hardened the drip-override nonces to fail closed and moved _wpnonce verification to the top of the set/remove handlers; bound the per-student override IN () lists via %d in wpdb::prepare(); sanitized the certificate-layout JSON ($_POST[‘xtrc_cert_layout’]) and $_SERVER[‘SCRIPT_NAME’] at the boundary; assembled the certificate PDF HTML as a returned string and escaped the Courses-list status row with wp_kses_post(); and removed the deprecated 2-character XC_* constant aliases (the XTREMECOURSES_* constants are now the only names). No database or schema changes.
2.1.x (2.1.0 – 2.1.7)
Admin UX and review-round fixes across the 2.1 line: first-run setup wizard, server-rendered Courses list page and dashboard refresh, plugin-row action/meta links, React builder save-error fixes (linked-quiz validation, type-aware lesson PATCH, full-text error banner, non-blocking quiz-on-Update warning), and successive Plugin Check / PHPCS hardening passes.
2.0.x
WordPress.org review and Plugin Check rounds: Chart.js bundled locally (no CDN), XC_* constants renamed to XTREMECOURSES_*, folder/slug/namespace normalized to xtreme-courses, certificate PDF CSS moved to a bundled file, plus numerous escaping, prefix, nonce, and $wpdb-suppression fixes.
1.x
Initial builds through 1.9.0: React course builder, lesson player, WooCommerce enrollment, drip scheduling, quiz engine, PDF certificates, gamification, live Zoom/Meet lessons, reviews, and analytics.
For the complete release notes for every individual version, see CHANGELOG.md in the source repository.
