WP Bannerize Pro

2.0.0

Requires PHP 8.1 and WordPress 6.6. WordPress does not offer this update to sites on older versions: they stay on 1.13.4, which carries every security fix of this cycle.

• Breaking: PHP 8.1 or later is required (was 7.4). Bannerize now runs on version 2 of its framework, WP Bones, which requires it
• Breaking: WordPress 6.6 or later is required (was 6.2). The admin apps and the block are built with the current WordPress build tools, whose scripts depend on the JSX runtime WordPress ships from 6.6
• Chore: WP Bones framework 2.0.7 (was 1.9.6)
• Chore: the assets are built with webpack through @wordpress/scripts 31 instead of gulp; file names, script handles and translations are unchanged
• Fix: no PHP deprecation notice for banners without a MIME type (text and HTML banners) on PHP 8.1 and later

1.13.4

• Security: the order argument of the shortcode and of wp_bannerize_pro() only accepts ASC or DESC. Other values reached the database query unchanged, which let a user who can write posts (Contributor and above) run SQL of their own
• Security: the HTTP Basic Authentication handler inherited from the framework defaults is off — Bannerize never used it, and it accepted a username and password on every request of the site
• Security: the click and impression tracking requests record at most 50 banners each, and only published banners with tracking enabled
• Security: reordering banners requires the permission to edit other users’ banners and only affects banners; two unused admin actions were removed
• Security: the ipstack API key is only returned to users who can manage banners
• Security: banner image checks no longer contact private or local network addresses
• Security: CSV exports write cells that would start a spreadsheet formula (=, +, -, @) as text
• Fix: a banner with a maximum number of impressions or clicks is shown from the start; before, it stayed hidden until the banner list was opened in the admin, and disappeared again after every analytics cleanup
• Fix: analytics cleanups no longer reset the impression and click counters used by those limits, and deleting single records only adjusts the banners they belong to
• Fix: deleting a banner removes its impressions and clicks whatever the way it is deleted — including the automatic emptying of the trash
• Fix: the banner description (used as the image’s alt and title text) is saved as text, no longer turned into a slug
• Fix: the Importer page and three admin strings are translatable; translations updated for all five bundled languages
• Chore: bump “Tested up to” to WordPress 7.1

1.13.3

• Fix: naming a campaign that could not be found rendered an empty container rather than nothing at all, with no notice and no log entry — indistinguishable from a campaign with no banners. It now renders nothing, and names the unknown campaigns in an HTML comment and a _doing_it_wrong() notice
• Fix: campaigns migrated from the legacy WP Bannerize plugin never matched. The importer keeps the old group as the term name while prefixing its slug, so every migrated shortcode resolved to nothing. Campaign names are now accepted alongside slugs
• Fix: a campaign id matching no term no longer reaches the query, and a value like 007 is treated as a campaign slug instead of as id 7
• Fix: the legacy group attribute is accepted as an alias of campaigns, and the legacy [wp_bannerize] shortcode is registered when no other plugin owns that tag, so content migrated from the old plugin renders instead of showing the raw shortcode
• Fix: a campaign named 0 was treated as no campaign at all
• Fix: deprecated attributes raised their notice twice, and were ignored entirely when passed to select()
• Thanks to @emanueleemolo for the report and for diagnosing it down to the query builder

1.13.2

• Fix: the Importer page died with a fatal error on PHP 8 (Uncaught Error: Undefined constant "importer") — a missing $ on the “Total enabled” row of the summary table. The page now renders and the import from the legacy WP Bannerize plugin works again. Thanks to @emanueleemolo for the precise report

1.13.1

• Feature: add Italian (it_IT), Spanish (es_ES), French (fr_FR), German (de_DE), and Brazilian Portuguese (pt_BR) translations — 5 locales now bundled
• Chore: bump “Tested up to” to WordPress 7.0
• Chore: regenerate POT and per-locale PO/MO/JSON files

1.13.0

Feature, Security & Compatibility Update

New Features

• Added WebP image format support for local and remote banners
• WebP banners can now be uploaded from the media library or linked via external URLs
• Updated remote image validation to accept image/webp content type

Security

• Hardened analytics queries: campaign and banner ID filters now use $wpdb->prepare() placeholders instead of string interpolation
• Fixed invalid SQL placeholder (%1s) in analytics cleanup LIMIT clause, replaced with %d
• Hardened meta key JOINs in banner query builder with $wpdb->prepare() for all meta_key values
• Fixed SQL export using unescaped table name in INSERT statements
• Added capability check (manage_banners) to admin error notice display
• Used esc_html__() for translatable admin notice output

Bug Fixes

• Fixed PHP 8.0+ function str_starts_with() usage that broke compatibility with PHP 7.4
• Fixed duplicate entries in image MIME types array
• Fixed uninitialized $width and $height variables when image size detection fails
• Fixed potential fatal error when mime type is not detected during banner save
• Fixed string-to-integer comparison in banner list column for max impressions/clicks
• Fixed Gutenberg block missing “type” field for orderby attribute in block.json causing REST API warnings
• Fixed fatal error “read property ID on null” in getBannerClasses() when banner post is null
• Fixed esc_attr() used instead of esc_html() for impressions/clicks column output
• Fixed incorrect sanitization order (absint on esc_attr result) in pagination input

Improvements

• Redesigned horizontal layout with modern flexbox and responsive 2-column grid on wide screens, single column on mobile
• Vertical layout now uses flexbox with consistent gap spacing
• Banner images are fully responsive with max-width: 100% and auto height
• Refactored banner query meta key JOINs from repetitive code to loop-based construction
• Removed dead code: commented-out create_function() reference
• Refreshed readme.txt with structured description, expanded FAQ, and documentation links
• Rewrote README.md with badges, features, tech stack, and project structure

1.12.0

Security, Bug Fixes & Improvements

Security

• Fixed SQL injection vulnerabilities in analytics queries (impressions, clicks, CTR trends)
• Fixed SQL injection in the legacy importer controller
• Fixed XSS in banner rendering: added proper escaping for image src, alt, title, link href, and target attributes
• Fixed XSS in text banner rendering: added escaping for width/height style attributes
• Fixed stored XSS risk: sanitized IP address and User-Agent before saving to the database
• Fixed SSRF in image size detection: replaced raw cURL and getimagesize() with wp_remote_get()
• Fixed SSRF in remote image validation: replaced raw cURL with wp_remote_head()
• Hardened options update endpoint with schema validation, key whitelist, and sanitize_file_name() for template paths
• Hardened wp_loaded banner endpoint: added post type check, ID validation, null safety, and wp_kses_post() output filtering
• Removed full plugin options exposure from public frontend
• Used wp_json_encode() for all inline script output to prevent script injection

Bug Fixes

• Fixed Gutenberg block not filtering by campaign
• Fixed banner layout always forced to vertical regardless of the layout parameter
• Fixed banner preview meta box not appearing in the editor
• Fixed analytics data not deleted when a banner is permanently removed
• Fixed cron cleanup events not cleared when tracking is disabled or plugin is deactivated
• Fixed N+1 query issue: banner click/impression counts with value 0 no longer trigger unnecessary COUNT queries
• Fixed resetOptions calling a non-existent AJAX action
• Fixed DataTable crash when a banner has no campaigns assigned
• Fixed CSV export using incorrect escape sequence instead of RFC 4180 standard