Tags

Security: sanitize World Map link URLs (1.4.21)

The link of a country or pin went into the canvas data-map JSON as typed,
and the map script navigates to it with window.location, so a
"javascript:" URL saved by a Contributor ran in the visitor's session
(stored XSS, reported through Wordfence). The legend already used
esc_url(); the JSON path did not.

Repeater and term links now go through esc_url_raw() before they reach
the JSON, and the script refuses javascript:/data:/vbscript: links, which
also covers markup still held in a page cache.

Posts Grid: data-posts-grid was printed unescaped inside single quotes,
so a quote in the Read More text could close the attribute; it is
escaped now.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

World Map: bundle jsvectormap in lib/, not vendor/

.distignore lists a bare "vendor", which the WordPress.org deploy matches
at any depth, so the 1.4.20 build would have shipped the widget without
its library and map data.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

1.4.19

1.4.18

.

1.4.16: Portfolio Index hover intent — preview stays on the way to th…

…e panel

Moving the cursor from a title to the project panel no longer reverts the
preview to the first project, and titles crossed on the way are not previewed:
while the cursor travels inside the triangle between its last position and the
panel's near corners (Amazon mega-menu trick), a newly entered title waits
300 ms, renewed while the cursor keeps heading for the panel and cancelled when
it arrives. A cursor that stops on a title previews it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

1.4.15

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.

1.4.12

.