Release v5.1.14
Userpro – User Profiles With Social Login v5.1.14
Latest versionWhat's new in v5.1.14
Userpro – User Profiles With Social Login v5.1.14 was released on . The ultimate user profiles and community plugin for WordPress. See the full changelog below and compare with the complete version history.
Release details
Released
8.7 MB
File available
Changelog
Other
- Security and stability release. Full detail in `changelog.txt`.
- Security: SQL injection in the front-end publish flow (`functions/ajax.php`) and in the badges comment-count query, both now prepared.
- Security: self-service profile saves can no longer write trust/status meta (`userpro_verified`, account status, connections, secret key, badges, social ids); filter `userpro_protected_profile_meta`, compared case-insensitively. Role changes via profile save require `promote_users`.
- Security: `userpro_reset_option` and `userpro_user_invite` now require `manage_options` (were reachable by logged-out visitors via the public nonce).
- Security: `userpro_crop_picupload` requires a nonce and escapes its output; the front-end script now sends the nonce.
- Packaging: bundled `cacert.pem` files restored; `build-zip.py` guarantees a `userpro/` top-level folder (the previous upload unpacked to `userpro-main/` and installed as a second plugin).
Fixed
- custom-field member directory sort now sorts and paginates in SQL; malformed `userp`/`emd-page`/`searchuser` input no longer fatals on PHP 8.
- Enhanced Member Directory and collage use a COUNT query; badge user pickers show emails again; admin version label corrected.
Verified safe
Userpro – User Profiles With Social Login v5.1.14 scanned clean with no security threats detected.
View full scan report