Plugin releases

Stored-XSS in the ad manager removed.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide: AJAX/REST capability + nonce checks tightened, public REST hardened, secrets server-side. PHP 8.3 / WordPress 7.x.

• Security pass (P1): nonce/capability hardening on ad-unit endpoints.

• Security/hygiene pass (P1): REST + admin save hardening; compatibility.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• BYOK embeddings made provider-agnostic (OpenAI/Anthropic/Gemini/Groq/OpenRouter).
• Streaming + channel-send error handling hardened. Suite-FAB integrated.
• Strips shortcodes before ingestion to avoid third-party redirect side-effects.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Security: public REST routes hardened; Stripe secret kept server-side; P1 remediation.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Hygiene + compatibility pass.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Hygiene + hardening pass; compatibility.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Suite-FAB integration (trigger now builds immediately when merged, fixing a null click-target). Hygiene pass.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Security/hygiene (P1): submission + admin endpoint hardening.

• Security pass (P1): topic/reply endpoint hardening.

• Security (P0): closed an unauthenticated findings leak on the /checks endpoint.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Account Hub "Rewards" section + Tessera skin (coral balance hero, ref-link pill, premium ledger table). Suite-FAB integrated. Security/hygiene pass.

• Security/hygiene (P1): input sanitisation + capability checks on campaign/list endpoints; version + i18n cleanup.

Closed a login-as-admin bypass (unsigned Apple JWT).

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Account Hub "Membership" section + full Tessera skin across all portal sub-views (Home, My Courses, Discussions, Members, Account).
• OEngage consolidated as a bundled Engagement module (loader wired into bootstrap); standalone OEngage is now a self-deactivating deprecation shim; DB tables + shortcodes preserved.
• Security (P0): fixed a no-op public_or_capable access gate; tightened a regex (P1).
• Cron now schedules reliably on boot; course importer batches correctly; gamification claims corrected. Suite-FAB integrated.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• QR generator rewritten in pure PHP (reliably scannable, no external service). Hygiene pass.

• Fixed AJAX cross-origin failure and the Reset-Defaults button position.
• sanitise() no longer drops header_layout / footer data on save.
• Preset thumbnails corrected. P1 hardening.

• Hygiene + compatibility pass.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Fixed service-worker scope. Hygiene pass.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Hygiene + compatibility pass.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Security/hygiene pass (P1): nonce + capability hardening on block REST/AJAX; version + i18n cleanup.

Updater SSRF→RCE allowlisted; license keys now AES-encrypted; auto-updater revived.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Account Hub: unified customer self-service frame — plugins register sections (orravo_account_sections) and widgets (orravo_account_widgets); [orravo_account] shortcode + auto Account page + WooCommerce My-Account embedding; standalone plugin endpoints 302-redirect into the hub; duplicate Woo account tabs de-duplicated.
• Tessera dashboard design (new): premium coral-on-cream bento "Member Dashboard" wired to real widget data (XP, points, streak, level, plan, subs) — no fabricated numbers. Joins the hub and maison designs. Selectable in Hub Settings; live-preview via ?orv_hub_design=. Section bodies (Rewards/Subscriptions/Membership + all Membership sub-views: Discussions/Members/Account) restyled to the Tessera language (Bricolage/Hanken type, coral cards, premium tables/pills, coral progress).
• Suite FAB: four plugin launchers (OAssist/OLoyalty/OMembership/OFeedback) merge into a single bottom-right launcher via orravo_fab_actions; back-to-top moved bottom-left to avoid collisions.
• Platform: added OC_Crypto / OC_Net / OC_RateLimiter core services; persistent admin shell (OC_Shell) across the suite; v2 control-panel admin (rail + widget grid + dark/light).
• Fixes: admin-console SyntaxError resolved (heredoc was interpolating the JS $el token in stock-photos build_js()); shell anchor-button contrast via zero-specificity :where() resets; cross-plugin dependency checks deferred to plugins_loaded.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Hygiene + hardening pass.

Bundles its animation engine locally — no third-party CDN.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Animation primitives engine: built-in modules + extension API, multiple engine bundles, migration scanner (AOS/Animate.css/WOW), Block Bindings source, Gutenberg patterns, SRI hashes, Site Health tests.
• Version reconcile with Page Builder; per-query perf caps; integrity/size guards in release.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• orv/post-grid block (new): 6 display styles, AJAX load-more, sticky-first hero, hover effects, colour overlay, image-size control, CPT/taxonomy picker, filter bar, responsive column controls, 3 block patterns; a11y pass.
• Evolving toward the blocks + rows + columns + sections model (brick-by-brick).
• Fixed orv/col gutter math (multi-column rows no longer wrap the last column).
• Saved Blocks panel resolved (no more "coming soon" placeholder).
• Version reconcile + numberposts perf caps on query-driven blocks.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Hygiene + hardening pass.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• 5 engines (404 monitor, redirects, sitemap, robots, broken-links).
• Softened the hard Orravo-Core dependency gate (degrades gracefully). Hygiene pass.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Hygiene + hardening pass (slider REST/admin save paths).

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Honeypot + timing + blocklist anti-spam (CF7/WPForms/GravityForms/OForms/FluentForms), no CAPTCHA. Active-state UI fixes; filemtime cache-busting; P1 hardening.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Hygiene: version consistency, i18n, PHP 8.3 compatibility.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• WooCommerce My-Account tab consolidation with the Account Hub; hygiene pass.

Stripe / Paystack webhooks now fail-closed.

Security & hardening (readiness audit v2 · 2026-06-12). Suite-wide hardening; PHP 8.3 / WP 7.x.

• Account Hub Subscriptions / Team / Usage sections + Tessera skin (status pills, premium tables, "Manage" controls).
• Independent P0 verification pass; capability/nonce hardening.

Orravo theme — multi-purpose WordPress design system; pairs with Orravo Core + Page Builder. Security & hardening (audit v2 · 2026-06-12).