Bulk SEO Meta Editor for AI Agents

1.9.0

• New: custom JSON-LD schema on taxonomy terms. /bulk items with kind: "term" accept the same schema and schema_mode fields as posts, stored in term meta under the same keys, and GET /schema?id=<term_id>&kind=term&taxonomy=<slug> reads them back. The schema renders on the first page of the term archive only. On Rank Math the archive keeps its CollectionPage type next to an injected FAQPage instead of losing it.
• New: schema output when no SEO plugin graph is printed. With no Yoast or Rank Math installed, or with their schema output switched off, stored schema is printed as the plugin’s own JSON-LD block (encoded with JSON_HEX_TAG and JSON_HEX_AMP, on top of the existing markup checks). When a graph is printed, nothing changes: the nodes still merge into it. Filter bulkseme_print_standalone_schema disables the standalone block.
• New: post_title accepted in /bulk items. Plain text only, slug untouched, edit_post required, empty values rejected with empty_post_title. /import keeps treating post_title as a read-only column.
• New: POST /sitemap/flush clears the Rank Math and Yoast sitemap caches (edit_others_posts required) so sitemaps pick up REST edits without a wp-admin save.
• New: invalid Product schema guard. Product nodes without offers, review or aggregateRating are removed from the Yoast and Rank Math graphs, together with any dangling @id references to them. Priced products are untouched. Disable with add_filter('bulkseme_drop_invalid_product_schema', '__return_false').
• /status now reports supports_term_schema, supports_post_title, supports_sitemap_flush and drops_invalid_product_schema.
• Requires WordPress 5.7 or later (was 5.6) for wp_print_inline_script_tag().

1.8.2

• Security: the custom JSON-LD schema field now rejects any value that contains a raw HTML angle bracket (< or >) when saved, and strips angle brackets from stored schema on output. This closes a stored cross-site scripting issue on Rank Math sites, where a crafted JSON-LD object key could break out of the schema script block. Yoast sites were not affected. No valid JSON-LD needs raw angle brackets, so normal schema is untouched. Reported responsibly by Junhui Mo (Guangzhou University).

1.8.1

• Security: GET /export now capability-filters every row it returns, using the same capability the matching write path enforces. Term rows require the edit_term meta capability on each term, so taxonomies registered with their own capabilities are respected. CPT archive rows require manage_options, matching the archive write path, because those values live in the SEO plugin’s site-wide settings rather than on an object. Post rows are checked with edit_post per post instead of relying on the edit_others_posts pre-filter, which covers only the core post capabilities and not custom post types that declare their own capability_type. Rows the caller cannot manage are omitted, so /export no longer returns SEO metadata for objects the caller could not open in wp-admin.
• Note: a caller who could previously export taxonomy terms or CPT archive settings without holding the matching capability will now receive fewer rows. Administrators, and Editors acting within their own capabilities, see no change. row_count still reports the number of rows actually emitted.

1.8.0

• Security: every bulk write now enforces a per-object capability check in addition to the route-level edit_posts gate. POST /bulk-alts checks edit_post on each resolved attachment, term updates check the edit_term meta capability on each term, and CPT archive updates now require manage_options (they change the SEO plugin’s site-wide settings, the same bar the global scopes already had). Authors and Contributors can no longer touch objects they could not edit in wp-admin.
• Changed: writes into Yoast SEO settings now go through Yoast’s own public API instead of updating its stored options directly. Term meta is saved with WPSEO_Taxonomy_Meta::set_values() (merged with the term’s current values so untouched fields are preserved) and archive/global titles with WPSEO_Options::set(), which routes each key to the right option group, validates it, and clears Yoast’s caches. Rank Math ships no public setter for its title settings, so those writes still read-modify-write the option array Rank Math reads back, through a single documented helper.
• Internal: the plugin version constant is now a plain define kept in sync with the plugin header, replacing the runtime header parse.

1.7.0

• Changed: GET /export now returns JSON in the shape { "filename", "row_count", "csv" } instead of streaming raw CSV bytes. The csv field holds the complete CSV content; save it to a file to open in a spreadsheet. The plugin no longer produces any direct output, so every response flows through the REST API serializer. Query parameters and the CSV column shape are unchanged, and /import accepts the same CSV as before.
• Upgraders: scripts that saved the old raw response body to a file should now read the csv field of the JSON response. The bundled MCP server 1.7.0 handles both shapes automatically.

1.6.1

• Fix: image alt updates now resolve far more image URLs to their media-library attachment. Previously the resolver only matched the exact stored file URL, so it missed the most common front-end forms and returned “not in media library” for images that were genuinely in the library. It now also resolves: size crops (foo-1024×683.jpg), the “-scaled” big-image original WordPress generates since 5.3 (whether the page references the scaled file or the plain original), cache-busting query strings, and images served from a CDN or alternate host that keep the /wp-content/uploads/ path. A safe filename fallback resolves year/month folder drift only when exactly one attachment owns that filename, so it never guesses between duplicates. Genuinely external or page-builder-hardcoded images (including most inline SVG icons) still report a clear “not an attachment” hint, since their alt lives in the builder, not the media library.