Dokan Pro (Business) history.

- **fix:** Ensured Store Support tickets can only reference the customer's own orders from that vendor. - **fix:** Patched a SQL injection in vendor verification request sorting by accepting only ascending or descending order. - **fix:** Prevented PHP object injection through product attributes meta when vendors save or open a product. - **fix:** Ensured vendors can only view and change their own MangoPay payout bank accounts. - **fix:** Hid unpublished and deleted product questions and answers from the public REST endpoint. - **fix:** Ensured vendors can only view their own Distance Rate Shipping settings. - **fix:** Prevented cross-site scripting through the staff ID on the vendor staff edit form.

- **new:** Replaced the profile completion bar on the new vendor dashboard and settings pages with a store setup checklist that links to each remaining step. - **update:** Removed the legacy YITH WooCommerce Brands integration and its migration tool, as brands now use WooCommerce's native product brands. - **update:** Allowed integrations to add their own summary cards to the Admin Earnings report. - **fix:** Applied global product add-ons only to the creating vendor's products, including on block-based cart and checkout pages. - **fix:** Ensured vendors can only save EU compliance details on their own product variations. - **fix:** Ensured vendors can only view their own global product add-ons. - **fix:** Ensured MangoPay saved cards at checkout can only be viewed or deactivated by their owner. - **fix:** Ensured vendors can only grant subscription download access to their own products.

- **fix:** Loaded product pages without a price normally when Stripe Connect is enabled, hiding Express Checkout for those products. - **fix:** Fixed the block editor opening blank when the Delivery Time module is active by loading its settings assets only on Dokan admin pages.

- **new:** Added multiple opening hours per day, biography, and store category to the new vendor Store Settings page. - **update:** Brought module store options to the new vendor Store Settings page, including vacation, store pickup, live chat, support, quotes, cart limits, and EU compliance details. - **fix:** Kept Dokan Pro modules active after the nightly license check whenever the license is valid. - **fix:** Saved new product tags that start with a number in the legacy product editor instead of dropping them. - **fix:** Loaded the vendor dashboard product pages normally with Dokan WPML active when the subscription pack has no category restriction. - **fix:** Preserved vendor cart minimum and maximum amounts when the store profile is saved without those fields. - **fix:** Restricted license refresh to administrators by updating the bundled Appsero client. - **fix:** Restricted customer account updates through the REST API so vendors can no longer change a customer's password. - **fix:** Prevented PHP object injection through product meta data in the REST API.

- **update:** Updated Composer files and dependencies for starter, professional, and liquid-web packages.

- **new:** Revamped the Dokan admin Settings with a redesigned layout and reorganized menus for easier navigation. - **new:** Moved all Dokan Pro settings into the redesigned admin Settings, with dedicated Shipment, Verification, and Social Onboarding pages. - **update:** Brought every module's settings into the new Settings pages, including payment and withdraw methods, Delivery Time, Geolocation, Live Chat, Vendor Verification, Vendor Subscription, RMA, Wholesale, Store Support, Request for Quotation, and Printful. - **update:** Carried existing settings over automatically, so nothing needs to be reconfigured after updating. - **fix:** Fixed vendor subscription expiry alert emails so the daily check sends an alert to every vendor who is due one. - **fix:** Ran scheduled withdraw disbursements on the date shown on the vendor dashboard for sites outside UTC, and updated existing schedules automatically.

- **fix:** Fixed the vendor statement report so its entries are counted and paginated correctly instead of rendering an empty table. - **fix:** Fixed PayPal Marketplace marking orders as paid when the PayPal capture was declined, and kept a later genuine payment able to complete the order. - **fix:** Honored the PayPal Marketplace "Standard Button" type on the WooCommerce checkout block, keeping the Place order button visible. - **fix:** Matched vendor shipping methods to the zone they belong to so a method is no longer offered in every shipping zone. - **fix:** Showed Delivery Time slots on the block checkout in the site's 12 or 24-hour time format. - **fix:** Aligned and sized the Create and Cancel buttons in the vendor verification method modal, and prevented duplicate methods from a double click. - **fix:** Cleared the React defaultProps warning on vendor dashboard analytics report tables. - **fix:** Loaded the Export/Import product listing data only on the seller dashboard instead of every front-end page. - **fix:** Prevented stored cross-site scripting in product Q&A answers by sanitizing them on save and on load. - **fix:** Prevented cross-site scripting through crafted route parameters in the legacy admin screens. - **fix:** Required login and order ownership before an order can be marked as received. - **fix:** Ensured vendors can only submit refund requests for their own orders. - **fix:** Ensured the Printful size guide can only be added to the current vendor's own products.

- **fix:** Included vendors whose selling is disabled in the admin Subscriptions list so their subscriptions can be managed and cancelled. - **fix:** Matched the All count to the rows shown on the Abuse Reports and Product Advertising screens by keeping orphaned entries out of both lists. - **fix:** Defaulted the AI Assist image Model setting to an image-capable model so the dropdown no longer renders blank. - **fix:** Restored the "Search similar products in this marketplace" panel on the new product editor, and limited cloning to published products. - **fix:** Removed the WooCommerce Admin bundle from storefront pages by rebuilding the Geolocation category filter as a lightweight component, and fixed category names containing HTML entities. - **fix:** Kept the Stripe secret API key out of vendor account meta, and cleaned up records that already contained it. - **fix:** Ensured product reviews can only be moderated or deleted by the vendor who owns the product, including bulk actions. - **fix:** Ensured product attributes can only be changed by an administrator or the vendor who owns the product. - **fix:** Ensured product variations can only be removed by the vendor who owns the product. - **fix:** Ensured product variations can only be saved by the vendor who owns the product. - **fix:** Ensured new verification requests are always created as pending until an administrator reviews them.

- **fix:** Ensured Table Rate Shipping rates can only be viewed, changed, or deleted by the vendor who owns the shipping method. - **fix:** Ensured Distance Rate Shipping settings can only be viewed, changed, or deleted by the vendor who owns the shipping method. - **fix:** Ensured vendor subscription schedule changes apply only to the vendor's own subscription. - **fix:** Ensured vendor subscription status changes apply only to the vendor's own subscription. - **fix:** Scoped the verification requests list to the current vendor so each vendor sees only their own identity documents.

- **new:** Added Stripe Payment Elements to Stripe Connect for classic and block checkout, bringing Apple Pay, Google Pay, Link, and other modern Stripe payment methods. - **update:** Migrated Stripe Connect payment processing from the legacy Tokens and Charges API to a unified PaymentIntents flow with built-in SCA support. - **fix:** Aligned the Germanized company and tax fields on the legacy Add Vendor form so they pair correctly across both columns.