WpStream – Live Streaming, Video on Demand, Pay Per View

4.14.1

• Fix – Sites without Elementor no longer see a “WpStream Elementor requires Elementor” warning on every admin page. Elementor is an optional integration; the warning was reinstated by mistake in 4.14.0 and is now removed. Sites that run an outdated Elementor or PHP version still get their version warning

4.14.0

• Fix – Tooltips on the last icon row of the Live Streaming sidebar box were cut off on WooCommerce product edit pages; the box no longer clips them
• Fix – The channel ON/OFF button in the sidebar box now sizes to its content instead of a fixed height
• Fix – Multipart VOD uploads are capped at 1000 parts and the real upload error is shown when a part fails
• Security – Dashboard file uploads are now validated on the server: the uploaders accept only the allowed image, video and PDF types (profile pictures are limited to images) and reject oversized files, instead of trusting the browser to filter file types. Previously a crafted request could store other file types
• Security – Deleting an uploaded file now follows a single consistent rule across every dashboard endpoint: only the file’s owner (or a user permitted to delete it) can remove it, deletions are limited to genuine media attachments, and a missing or invalid request is handled safely without a PHP error or exposing the owner’s account id
• Security – An uploaded file can no longer be attached to a post the uploader is not allowed to edit
• Security – Saving WpStream settings and Default Channel Settings now requires administrator permissions; previously these admin actions accepted a valid form token alone. The generic settings saver is also limited to known plugin settings and can no longer be used to overwrite the stored WpStream API credentials
• Fix – Saving the Default Channel Settings no longer clears the site-wide “Use Sessions with Encryption” option; settings the form does not send are now preserved instead of being overwritten
• Security – The video player no longer executes callback strings from its configuration (eval removed). The theater-mode buttons now announce mode changes via a wpstream:theater-mode browser event (detail: action “enter”/”leave” and the player element id) that site code can listen for on the player element or document
• Security – Removed a leaked internal test harness from the player controls script; it called debug endpoints that are not part of the plugin and reflected URL parameters into the page unescaped (potential cross-site scripting)
• Security – Added CSRF (nonce) verification to admin actions that previously accepted forged requests: saving WpStream credentials, the one-click plugin update, dismissing admin notices, and downloading or deleting cloud recordings
• Security – Added CSRF (nonce) verification to logged-in front-end actions: the Watch Later toggle (which previously accepted any value as a “nonce”), the legacy dashboard attachment-delete endpoint, and the BuddyBoss channel-select and timeline-player actions
• Security – Posting a live player to the BuddyBoss timeline now requires owning the channel; previously any logged-in user could post any channel’s player
• Fix – Attachment-delete endpoints compared the owner id with the wrong type and always refused valid requests; the ownership check now works as intended
• Removed – The built-in beta live chat has been removed entirely: the [wpstream_chat] shortcode, the WpStream Chat Elementor and WPBakery elements, the chat template, and the bundled chat libraries (chat client, SockJS, emojione, linkify, material UI). Live chat is provided by the Better Messages integration in the Hello WpStream theme. Pages still containing the old shortcode render it as plain text and can simply remove it
• Removed – Dropping the bundled chat libraries also removes their outdated third-party code (old jQuery/jQuery UI builds, SockJS 0.3) from the public site, shrinking the plugin’s attack surface and page weight
• Fix – Deactivating the plugin no longer deletes the stored WpStream API credentials, so a temporary deactivation (conflict testing, auto-deactivation after an error) keeps the account connected
• Added – Uninstalling the plugin now removes the stored credentials, cached authentication tokens, and scheduled cleanup events
• Removed – The beta low-latency player has been retired: the [wpstream_player_low_latency] shortcode, its “WpStream Player – Low Latency” Elementor and WPBakery elements, and the bundled OvenPlayer library are gone. Low latency remains a channel setting – use the standard [wpstream_player] / WpStream Player element, which plays low-latency channels. Pages still containing the old shortcode render it as plain text and can simply switch to [wpstream_player]

4.13.2

• Security – Enforce channel-ownership checks on live/broadcast actions so a user can only start, stop, or read the credentials of channels they own
• Security – Restrict front-end dashboard profile saves to address fields only, and verify channel ownership (by author, not editable user meta) when saving channel data
• Security – Generate the Larix QR code locally in the browser with a bundled library, so the RTMP URL and stream key are no longer sent to a third-party QR service
• Security – Harden the live chat client against stored cross-site scripting: chat messages, usernames, and the user list are now rendered as text instead of HTML, and message ids are matched as plain data so a crafted id cannot affect other page elements
• Fix – Live chat now clears its keep-alive timer and reconnects reliably after a dropped connection (a stale connection can no longer interfere with the active one), and the “not live” notice no longer errors
• Fix – Fatal error on the WooCommerce email preview screen and in order emails when an order item’s product is missing (e.g. deleted after purchase)
• Fix – Fatal error on the order-received page when no order is available
• Fix – Purchase confirmation message now correctly detects live stream / VOD purchases regardless of the product type term name

4.13.1

• Fix – Price field on paid channel/VOD not visible
• Fix – Paid VOD player buttons not visible
• Fix – Fatal error on widget

4.13

• Fix – Updated the way the user quota is retrieved

4.12.5

• Fix – Live channel player state when the channel was never started