Changeset 3447995

Timestamp:

01/27/2026 03:14:40 PM (2 months ago)

Author:

butterflymedia

Message:

Plugin update to address guidelines violation

Location:

property-drive/trunk

Files:

• assets/css/ui.css (modified) (3 diffs)
• assets/images/4property-logo.png (deleted)
• assets/images/foursquare-logotype.png (deleted)
• assets/images/foursquare.png (deleted)
• assets/images/fullscreen@2x.png (deleted)
• assets/images/heart-on.png (deleted)
• assets/images/heart.png (deleted)
• assets/js/init.js (modified) (10 diffs)
• includes/admin/build_admin_page.php (modified) (24 diffs)
• includes/helpers.php (modified) (41 diffs)
• includes/inline_styling.php (modified) (2 diffs)
• includes/meta.php (modified) (5 diffs)
• includes/property_search.php (modified) (2 diffs)
• includes/setup-plugin-options.php (modified) (2 diffs)
• modules/cpt-favourites.php (deleted)
• modules/init.php (modified) (1 diff)
• modules/slider/slider.php (modified) (12 diffs)
• modules/user_dashboard.php (modified) (9 diffs)
• modules/user_sign_up.php (modified) (3 diffs)
• property-drive.php (modified) (5 diffs)
• readme.txt (modified) (2 diffs)
• shortcodes/property-grid.php (modified) (5 diffs)
• shortcodes/property-map.php (modified) (5 diffs)
• shortcodes/search-form-results.php (modified) (17 diffs)
• shortcodes/search-form.php (modified) (15 diffs)
• templates/part-sidebar-classic.php (modified) (2 diffs)
• templates/single-property.php (modified) (21 diffs)
• templates/template-parts.php (modified) (2 diffs)

property-drive/trunk/assets/css/ui.css

@@ -961 +961 @@
     position: relative;
 }
-.property-card--image-count,
-.pd-box-favourite {
+.property-card--image-count {
     position: absolute;
     z-index: 0;
@@ -971 +970 @@
     font-size: 18px;
     color: #ffffff;
-}
-.pd-box-favourite {
-    right: 16px;
-    width: 24px;
-    height: 24px;
-    background: url('../images/heart.png') no-repeat center center;
-    cursor: pointer;
-}
-.pd-box-favourite.favourite,
-.pd-box-favourite:hover {
-    background: url('../images/heart-on.png') no-repeat center center;
 }
 
@@ -1676 +1664 @@
 @media (-webkit-min-device-pixel-ratio: 2), (min-resolution: 192dpi) {
     .leaflet-control-fullscreen a {
-        background-image:url(../images/fullscreen@2x.png);
+        background-image:url(../images/fullscreen-2x.png);
     }
 }

property-drive/trunk/assets/js/init.js

@@ -4 +4 @@
  * Licensed GPLv3
  */
-function roar(e,r,t){"use strict";if("object"!=typeof t&&(t={}),window.roarAlert)window.roarAlert.cancel&&(window.roarAlert.cancelElement.style=""),window.roarAlert.confirm&&(window.roarAlert.confirmElement.style=""),document.body.classList.add("roar-open"),window.roarAlert.element.style.display="block",a=window.roarAlert;else{var a={element:null,cancelElement:null,confirmElement:null};a.element=document.querySelector(".roar-alert")}if(a.cancel=void 0!==t.cancel?t.cancel:!1,a.cancelText=void 0!==t.cancelText?t.cancelText:"Cancel",a.cancelCallBack=function(e){return document.body.classList.remove("roar-open"),window.roarAlert.element.style.display="none","function"==typeof t.cancelCallBack&&t.cancelCallBack(e),!0},document.querySelector(".roar-alert-mask")&&document.querySelector(".roar-alert-mask").addEventListener("click",function(e){return document.body.classList.remove("roar-open"),window.roarAlert.element.style.display="none","function"==typeof t.cancelCallBack&&t.cancelCallBack(e),!0}),a.message=r,a.title=e,a.confirm=void 0!==t.confirm?t.confirm:!0,a.confirmText=void 0!==t.confirmText?t.confirmText:"Confirm",a.confirmCallBack=function(e){return document.body.classList.remove("roar-open"),window.roarAlert.element.style.display="none","function"==typeof t.confirmCallBack&&t.confirmCallBack(e),!0},!a.element){a.html='<div class="roar-alert" id="roar-alert" role="alertdialog"><div class="roar-alert-mask"></div><div class="roar-alert-message-body" role="alert" aria-relevant="all"><div class="roar-alert-message-tbf roar-alert-message-title">'+a.title+'</div><div class="roar-alert-message-tbf roar-alert-message-content">'+a.message+'</div><div class="roar-alert-message-tbf roar-alert-message-button">',a.cancel,a.html+='<a href="javascript:;" class="roar-alert-message-tbf roar-alert-message-button-cancel">'+a.cancelText+"</a>",a.confirm,a.html+='<a href="javascript:;" class="roar-alert-message-tbf roar-alert-message-button-confirm">'+a.confirmText+"</a>",a.html+="</div></div></div>";var l=document.createElement("div");l.id="roar-alert-wrap",l.innerHTML=a.html,document.body.appendChild(l),a.element=document.querySelector(".roar-alert"),a.cancelElement=document.querySelector(".roar-alert-message-button-cancel"),a.cancel?document.querySelector(".roar-alert-message-button-cancel").style.display="block":document.querySelector(".roar-alert-message-button-cancel").style.display="none",a.confirmElement=document.querySelector(".roar-alert-message-button-confirm"),a.confirm?document.querySelector(".roar-alert-message-button-confirm").style.display="block":document.querySelector(".roar-alert-message-button-confirm").style.display="none",a.cancelElement.onclick=a.cancelCallBack,a.confirmElement.onclick=a.confirmCallBack,window.roarAlert=a}document.querySelector(".roar-alert-message-title").innerHTML="",document.querySelector(".roar-alert-message-content").innerHTML="",document.querySelector(".roar-alert-message-button-cancel").innerHTML=a.cancelText,document.querySelector(".roar-alert-message-button-confirm").innerHTML=a.confirmText,a.cancelElement=document.querySelector(".roar-alert-message-button-cancel"),a.cancel?document.querySelector(".roar-alert-message-button-cancel").style.display="block":document.querySelector(".roar-alert-message-button-cancel").style.display="none",a.confirmElement=document.querySelector(".roar-alert-message-button-confirm"),a.confirm?document.querySelector(".roar-alert-message-button-confirm").style.display="block":document.querySelector(".roar-alert-message-button-confirm").style.display="none",a.cancelElement.onclick=a.cancelCallBack,a.confirmElement.onclick=a.confirmCallBack,a.title=a.title||"",a.message=a.message||"",document.querySelector(".roar-alert-message-title").innerHTML=a.title,document.querySelector(".roar-alert-message-content").innerHTML=a.message,window.roarAlert=a}
+function roar(e, r, t) { "use strict"; if ("object" != typeof t && (t = {}), window.roarAlert) window.roarAlert.cancel && (window.roarAlert.cancelElement.style = ""), window.roarAlert.confirm && (window.roarAlert.confirmElement.style = ""), document.body.classList.add("roar-open"), window.roarAlert.element.style.display = "block", a = window.roarAlert; else { var a = { element: null, cancelElement: null, confirmElement: null }; a.element = document.querySelector(".roar-alert") } if (a.cancel = void 0 !== t.cancel ? t.cancel : !1, a.cancelText = void 0 !== t.cancelText ? t.cancelText : "Cancel", a.cancelCallBack = function (e) { return document.body.classList.remove("roar-open"), window.roarAlert.element.style.display = "none", "function" == typeof t.cancelCallBack && t.cancelCallBack(e), !0 }, document.querySelector(".roar-alert-mask") && document.querySelector(".roar-alert-mask").addEventListener("click", function (e) { return document.body.classList.remove("roar-open"), window.roarAlert.element.style.display = "none", "function" == typeof t.cancelCallBack && t.cancelCallBack(e), !0 }), a.message = r, a.title = e, a.confirm = void 0 !== t.confirm ? t.confirm : !0, a.confirmText = void 0 !== t.confirmText ? t.confirmText : "Confirm", a.confirmCallBack = function (e) { return document.body.classList.remove("roar-open"), window.roarAlert.element.style.display = "none", "function" == typeof t.confirmCallBack && t.confirmCallBack(e), !0 }, !a.element) { a.html = '<div class="roar-alert" id="roar-alert" role="alertdialog"><div class="roar-alert-mask"></div><div class="roar-alert-message-body" role="alert" aria-relevant="all"><div class="roar-alert-message-tbf roar-alert-message-title">' + a.title + '</div><div class="roar-alert-message-tbf roar-alert-message-content">' + a.message + '</div><div class="roar-alert-message-tbf roar-alert-message-button">', a.cancel, a.html += '<a href="javascript:;" class="roar-alert-message-tbf roar-alert-message-button-cancel">' + a.cancelText + "</a>", a.confirm, a.html += '<a href="javascript:;" class="roar-alert-message-tbf roar-alert-message-button-confirm">' + a.confirmText + "</a>", a.html += "</div></div></div>"; var l = document.createElement("div"); l.id = "roar-alert-wrap", l.innerHTML = a.html, document.body.appendChild(l), a.element = document.querySelector(".roar-alert"), a.cancelElement = document.querySelector(".roar-alert-message-button-cancel"), a.cancel ? document.querySelector(".roar-alert-message-button-cancel").style.display = "block" : document.querySelector(".roar-alert-message-button-cancel").style.display = "none", a.confirmElement = document.querySelector(".roar-alert-message-button-confirm"), a.confirm ? document.querySelector(".roar-alert-message-button-confirm").style.display = "block" : document.querySelector(".roar-alert-message-button-confirm").style.display = "none", a.cancelElement.onclick = a.cancelCallBack, a.confirmElement.onclick = a.confirmCallBack, window.roarAlert = a } document.querySelector(".roar-alert-message-title").innerHTML = "", document.querySelector(".roar-alert-message-content").innerHTML = "", document.querySelector(".roar-alert-message-button-cancel").innerHTML = a.cancelText, document.querySelector(".roar-alert-message-button-confirm").innerHTML = a.confirmText, a.cancelElement = document.querySelector(".roar-alert-message-button-cancel"), a.cancel ? document.querySelector(".roar-alert-message-button-cancel").style.display = "block" : document.querySelector(".roar-alert-message-button-cancel").style.display = "none", a.confirmElement = document.querySelector(".roar-alert-message-button-confirm"), a.confirm ? document.querySelector(".roar-alert-message-button-confirm").style.display = "block" : document.querySelector(".roar-alert-message-button-confirm").style.display = "none", a.cancelElement.onclick = a.cancelCallBack, a.confirmElement.onclick = a.confirmCallBack, a.title = a.title || "", a.message = a.message || "", document.querySelector(".roar-alert-message-title").innerHTML = a.title, document.querySelector(".roar-alert-message-content").innerHTML = a.message, window.roarAlert = a }
 
 
@@ -39 +39 @@
 
     location.search = query.join("&");
-}
-
-
-
-function get_favourites() {
-    // Get favorites from local storage or empty array
-    var favourites = JSON.parse(localStorage.getItem('favourites')) || [];
-
-    // Add class 'fav' to each favorite
-    favourites.forEach(function (favourite) {
-        if (document.querySelector('.pd-box-favourite[data-property-id="' + favourite + '"]')) {
-            document.querySelector('.pd-box-favourite[data-property-id="' + favourite + '"]').classList.add('favourite');
-        }
-    });
-
-    // Register click event listener
-    document.querySelector('body').addEventListener('click', function (e) {
-        var id = parseInt(e.target.dataset.propertyId, 10),
-            index = favourites.indexOf(id);
-
-        if (index == -1) {
-            if (!isNaN(id)) {
-                favourites.push(id);
-                document.querySelector('h1.single-property-title .pd-box-favourite[data-property-id="' + id + '"]').classList.add('favourite');
-            }
-        } else {
-            favourites.splice(index, 1);
-            document.querySelector('h1.single-property-title .pd-box-favourite[data-property-id="' + id + '"]').classList.remove('favourite');
-        }
-        localStorage.setItem('favourites', JSON.stringify(favourites));
-
-        // Save to database if user is logged in
-        var request = new XMLHttpRequest();
-
-        request.open('POST', wp4pmAjaxVar.ajaxurl, true);
-        request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
-        request.onload = function () {
-            if (this.status >= 200 && this.status < 400) {
-                // Response success
-            }
-        };
-        request.send('action=save_user_favourite&property_id=' + id);
-    });
 }
 
@@ -109 +66 @@
         }
     };
-    request.onerror = function() {
+    request.onerror = function () {
         // Connection error
     };
@@ -201 +158 @@
     //    a = addressPoints[i];
     //    title = a[2];
-        //marker = L.marker(new L.LatLng(a[0], a[1]), {
-        //    title: title,
-        //    icon: icon
-        //});
-        //marker.bindPopup(getDetailsById(title));
-        //marker.addTo(osmMap); // Regular marker
-        //markers.addLayer(marker); // Marker clusterer
-
-        /**
-        circleMarker = L.circleMarker(new L.LatLng(a[0], a[1]), {
-            color: '#000000',
-            fillColor: '#3388ff',
-            weight: 1,
-            radius: 10,
-            fillOpacity: 0.5,
-            title: title
-        });
-        circleMarker.bindPopup(getDetailsById(title));
-        circleMarker.addTo(osmMap);
-        /**/
+    //marker = L.marker(new L.LatLng(a[0], a[1]), {
+    //    title: title,
+    //    icon: icon
+    //});
+    //marker.bindPopup(getDetailsById(title));
+    //marker.addTo(osmMap); // Regular marker
+    //markers.addLayer(marker); // Marker clusterer
+
+    /**
+    circleMarker = L.circleMarker(new L.LatLng(a[0], a[1]), {
+        color: '#000000',
+        fillColor: '#3388ff',
+        weight: 1,
+        radius: 10,
+        fillOpacity: 0.5,
+        title: title
+    });
+    circleMarker.bindPopup(getDetailsById(title));
+    circleMarker.addTo(osmMap);
+    /**/
     //}
     //osmMap.addLayer(markers); // Marker clusterer
@@ -296 +253 @@
         }
     };
-    request.onerror = function() {
+    request.onerror = function () {
         // Connection error
     };
@@ -545 +502 @@
 
 
-    /**
-     * Basic favourites engine
-     *
-     * Local storage stores strings so we use JSON to stringify for storage and parse to get out of storage
-     */
-    if (document.querySelector('.pd-box-favourite')) {
-        get_favourites();
-    }
-
-
-
-    if (document.getElementById('pd-favourites')) {
-        var favouritesFetch = JSON.parse(localStorage.getItem('favourites')) || [],
-            favouritesArray = [];
-
-        document.getElementById('pd-favourites').innerHTML = 'Loading your favourite properties...';
-        favouritesFetch.forEach(function (favouriteFetch) {
-            favouritesArray.push(favouriteFetch);
-        });
-
-        // Fetch favourites
-        var request = new XMLHttpRequest(),
-            favourites = favouritesArray;
-
-        request.open('POST', wp4pmAjaxVar.ajaxurl, true);
-        request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
-        request.onload = function () {
-            if (this.status >= 200 && this.status < 400) {
-                document.getElementById('pd-favourites').innerHTML = this.response;
-
-                get_favourites();
-            }
-        };
-        request.send('action=pd_favourites_fetch_public&favourites=' + favourites);
-    }
-
-
-    if (document.querySelector('.remove-user-favourite')) {
-        [].forEach.call(document.querySelectorAll('.remove-user-favourite'), function (favourite) {
-            favourite.addEventListener('click', function (event) {
-                event.preventDefault();
-
-                var request = new XMLHttpRequest(),
-                    favouriteId = favourite.dataset.favouriteId;
-
-                request.open('POST', wp4pmAjaxVar.ajaxurl, true);
-                request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
-                request.onload = function () {
-                    if (this.status >= 200 && this.status < 400) {
-                        document.getElementById('favourite-row-' + favouriteId).remove();
-                    }
-                };
-                request.send('action=remove_user_favourite&favourite_id=' + favouriteId);
-            });
-        });
-    }
-
-
-
     document.querySelector('body').addEventListener('click', function (e) {
         /**
@@ -618 +516 @@
                     '<input type="text" id="contact-phone" placeholder="Phone"><br>' +
                     '<textarea id="contact-message" rows="3"></textarea>' +
-                '</p>';
+                    '</p>';
 
             var options = {
@@ -646 +544 @@
                     request.onload = function () {
                         if (this.status >= 200 && this.status < 400) {
-                            roar('Quick Contact', 'Thank you for your request! We will contact you shortly.', {confirmText: 'Close'});
+                            roar('Quick Contact', 'Thank you for your request! We will contact you shortly.', { confirmText: 'Close' });
                         }
                     };
@@ -670 +568 @@
             request.onload = function () {
                 if (this.status >= 200 && this.status < 400) {
-                    roar('Quick Contact', 'Thank you for your request! We will contact you shortly.', {confirmText: 'Close'});
+                    roar('Quick Contact', 'Thank you for your request! We will contact you shortly.', { confirmText: 'Close' });
 
                     // Reset fields on success
@@ -701 +599 @@
         });
 
-        window.addEventListener('click', function(event) {
+        window.addEventListener('click', function (event) {
             if (event.target == modal) {
                 modal.style.display = 'none';

property-drive/trunk/includes/admin/build_admin_page.php

@@ -1 +1 @@
 <?php
-function pm_menu_links() {
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
+function wppd_menu_links() {
     add_menu_page('Property Drive Settings', 'Property Drive', 'manage_options', 'property_drive', 'wppd_build_admin_page', 'dashicons-admin-home', 4);
 }
 
-add_action('admin_menu', 'pm_menu_links');
+add_action('admin_menu', 'wppd_menu_links');
 
 function wppd_dashboard_help() {
@@ -18 +22 @@
     $propertyArgs = [
         'post_type' => 'property',
-        'meta_query' => [
-            [
-                'key' => 'property_view_count'
-            ]
-        ]
+        'meta_key'  => 'property_view_count',
     ];
 
@@ -61 +61 @@
     $nonce = wp_create_nonce('wppd_property_admin');
 
-    $jtg_plugin_logo = plugin_dir_url(dirname(__DIR__)) . 'assets/images/4property-logo.png';
-
     $plugin_version_dir = plugin_dir_path(dirname(__DIR__)).'property-drive.php';
     $plugin_version = get_plugin_data($plugin_version_dir, 'Version');
@@ -73 +71 @@
 
         <h2 class="nav-tab-wrapper">
-            <a href="<?php echo $section; ?>dashboard" class="nav-tab <?php echo $tab === 'dashboard' ? 'nav-tab-active' : ''; ?>">Dashboard</a>
-            <a href="<?php echo $section; ?>agency" class="nav-tab <?php echo $tab === 'agency' ? 'nav-tab-active' : ''; ?>">Agency Details</a>
-            <a href="<?php echo $section; ?>general" class="nav-tab <?php echo $tab === 'general' ? 'nav-tab-active' : ''; ?>">Settings</a>
-            <a href="<?php echo $section; ?>design" class="nav-tab <?php echo $tab === 'design' ? 'nav-tab-active' : ''; ?>">Design</a>
-            <a href="<?php echo $section; ?>search" class="nav-tab <?php echo $tab === 'search' ? 'nav-tab-active' : ''; ?>">Search</a>
-            <a href="<?php echo $section; ?>users" class="nav-tab <?php echo $tab === 'users' ? 'nav-tab-active' : ''; ?>">Users</a>
-            <a href="<?php echo $section; ?>pro" class="nav-tab nav-tab--pro <?php echo $tab === 'pro' ? 'nav-tab-active' : ''; ?>">Pro</a>
+            <a href="<?php echo esc_url( $section ); ?>dashboard" class="nav-tab <?php echo esc_attr( $tab === 'dashboard' ? 'nav-tab-active' : '' ); ?>">Dashboard</a>
+            <a href="<?php echo esc_url( $section ); ?>agency" class="nav-tab <?php echo esc_attr( $tab === 'agency' ? 'nav-tab-active' : '' ); ?>">Agency Details</a>
+            <a href="<?php echo esc_url( $section ); ?>general" class="nav-tab <?php echo esc_attr( $tab === 'general' ? 'nav-tab-active' : '' ); ?>">Settings</a>
+            <a href="<?php echo esc_url( $section ); ?>design" class="nav-tab <?php echo esc_attr( $tab === 'design' ? 'nav-tab-active' : '' ); ?>">Design</a>
+            <a href="<?php echo esc_url( $section ); ?>search" class="nav-tab <?php echo esc_attr( $tab === 'search' ? 'nav-tab-active' : '' ); ?>">Search</a>
+            <a href="<?php echo esc_url( $section ); ?>users" class="nav-tab <?php echo esc_attr( $tab === 'users' ? 'nav-tab-active' : '' ); ?>">Users</a>
+            <a href="<?php echo esc_url( $section ); ?>pro" class="nav-tab nav-tab--pro <?php echo esc_attr( $tab === 'pro' ? 'nav-tab-active' : '' ); ?>">Pro</a>
         </h2>
 
         <?php if ($tab === 'dashboard') { ?>
-            <h3 class="identityblock">WP Property<br>Drive <code class="codeblock"><?php echo $plugin_version['Version']; ?></code></h3>
+            <h3 class="identityblock">WP Property<br>Drive <code class="codeblock"><?php echo esc_html( $plugin_version['Version'] ); ?></code></h3>
 
             <h2 class="titleblock">Welcome to WP Property Drive! Get the most out of your properties.</h2>
 
             <?php wppd_dashboard_help(); ?>
-
-            <p>
-                <a href="https://www.4property.com/"><img src="<?php echo $jtg_plugin_logo; ?>" width="100" alt="4Property"></a>
-            </p>
         <?php } else if ($tab === 'agency') { ?>
-            <h2><?php _e('Agency Details', 'property-drive'); ?></h2>
+            <h2><?php esc_html_e('Agency Details', 'property-drive'); ?></h2>
 
             <?php
             if (isset($_POST['save_agency_settings'])) {
-                update_option('agency_name', sanitize_text_field(trim($_POST['agency_name'])));
-                update_option('agency_email', sanitize_email($_POST['agency_email']));
-                update_option('agency_phone', sanitize_text_field($_POST['agency_phone']));
-
-                update_option('force_agency_name', (int) $_POST['force_agency_name']);
-                update_option('force_agency_email', (int) $_POST['force_agency_email']);
-                update_option('force_agency_phone', (int) $_POST['force_agency_phone']);
-                update_option('mask_agency_email', (int) $_POST['mask_agency_email']);
-                update_option('mask_agency_phone', (int) $_POST['mask_agency_phone']);
-
-                update_option('agency_logo', $_POST['agency_logo']);
+                if ( ! isset( $_POST['wppd_property_admin_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wppd_property_admin_nonce'] ) ), 'wppd_property_admin' ) ) {
+                    wp_die( esc_html__( 'Security check failed.', 'property-drive' ) );
+                }
+                $agency_name = isset( $_POST['agency_name'] ) ? sanitize_text_field( wp_unslash( $_POST['agency_name'] ) ) : '';
+                update_option('agency_name', $agency_name);
+                update_option('agency_email', isset( $_POST['agency_email'] ) ? sanitize_email( wp_unslash( $_POST['agency_email'] ) ) : '');
+                update_option('agency_phone', isset( $_POST['agency_phone'] ) ? sanitize_text_field( wp_unslash( $_POST['agency_phone'] ) ) : '');
+
+                update_option('force_agency_name', isset( $_POST['force_agency_name'] ) ? absint( $_POST['force_agency_name'] ) : 0);
+                update_option('force_agency_email', isset( $_POST['force_agency_email'] ) ? absint( $_POST['force_agency_email'] ) : 0);
+                update_option('force_agency_phone', isset( $_POST['force_agency_phone'] ) ? absint( $_POST['force_agency_phone'] ) : 0);
+                update_option('mask_agency_email', isset( $_POST['mask_agency_email'] ) ? absint( $_POST['mask_agency_email'] ) : 0);
+                update_option('mask_agency_phone', isset( $_POST['mask_agency_phone'] ) ? absint( $_POST['mask_agency_phone'] ) : 0);
+
+                update_option('agency_logo', isset( $_POST['agency_logo'] ) ? esc_url_raw( wp_unslash( $_POST['agency_logo'] ) ) : '');
 
                 echo '<div class="updated notice is-dismissible"><p>Settings updated successfully!</p></div>';
@@ -117 +115 @@
 
             <form method="post">
+                <?php wp_nonce_field( 'wppd_property_admin', 'wppd_property_admin_nonce' ); ?>
                 <table class="form-table">
                     <tbody>
@@ -122 +121 @@
                             <th scope="row"><label>Estate Agency Name</label></th>
                             <td>
-                                <input type="text" name="agency_name" value="<?php echo stripslashes(get_option('agency_name')); ?>" class="regular-text">
+                                <input type="text" name="agency_name" value="<?php echo esc_attr( get_option('agency_name') ); ?>" class="regular-text">
                                 <input type="checkbox" name="force_agency_name" value="1" <?php checked(1, (int) get_option('force_agency_name')); ?>> Force this information, regardless of feed data
                             </td>
@@ -129 +128 @@
                             <th scope="row"><label>Estate Agency Email Address</label></th>
                             <td>
-                                <input type="email" name="agency_email" value="<?php echo get_option('agency_email'); ?>" class="regular-text">
+                                <input type="email" name="agency_email" value="<?php echo esc_attr( get_option('agency_email') ); ?>" class="regular-text">
                                 <input type="checkbox" name="force_agency_email" value="1" <?php checked(1, (int) get_option('force_agency_email')); ?>> Force this information, regardless of feed data
                                 <input type="checkbox" name="mask_agency_email" value="1" <?php checked(1, (int) get_option('mask_agency_email')); ?>> Mask this information
@@ -137 +136 @@
                             <th scope="row"><label>Estate Agency Phone Number</label></th>
                             <td>
-                                <input type="text" name="agency_phone" value="<?php echo get_option('agency_phone'); ?>" class="regular-text">
+                                <input type="text" name="agency_phone" value="<?php echo esc_attr( get_option('agency_phone') ); ?>" class="regular-text">
                                 <input type="checkbox" name="force_agency_phone" value="1" <?php checked(1, (int) get_option('force_agency_phone')); ?>> Force this information, regardless of feed data
                                 <input type="checkbox" name="mask_agency_phone" value="1" <?php checked(1, (int) get_option('mask_agency_phone')); ?>> Mask this information
@@ -151 +150 @@
                                     if (get_option('agency_logo')) {
                                         $image_url = get_option('agency_logo');
-                                        echo '<p><img src="' . $image_url . '" style="max-width: 400px;" alt=""></p>';
+                                        echo '<p><img src="' . esc_url( $image_url ) . '" style="max-width: 400px;" alt=""></p>';
                                     } else {
                                         echo '<p>No image selected.</p>';
@@ -157 +156 @@
 
                                     if (!empty($_POST['image'])) {
-                                        $image_url = esc_url($_POST['image']);
+                                        $image_url = esc_url_raw( wp_unslash( $_POST['image'] ) );
                                     }
 
                                     wp_enqueue_media();
                                     ?>
-                                    <input id="pm-image-url" type="hidden" name="agency_logo" value="<?php echo get_option('agency_logo'); ?>">
+                                    <input id="pm-image-url" type="hidden" name="agency_logo" value="<?php echo esc_attr( get_option('agency_logo') ); ?>">
                                     <input id="pm-upload-image-btn" type="button" class="jtg-logo-upload-btn button button-secondary" value="Upload Logo">
                                 </div>
@@ -208 +207 @@
             </script>
         <?php } else if ($tab === 'general') { ?>
-            <h2><?php _e('General Settings', 'property-drive'); ?></h2>
+            <h2><?php esc_html_e('General Settings', 'property-drive'); ?></h2>
 
             <?php
             if (isset($_POST['save_general_settings'])) {
-                update_option('default_property_order', sanitize_text_field($_POST['default_property_order']));
-                update_option('jtg_currency', sanitize_text_field($_POST['jtg_currency']));
-
-                update_option('map_provider', sanitize_text_field($_POST['map_provider']));
-                update_option('osm_scrollzoom', (int) $_POST['osm_scrollzoom']);
-
-                update_option('allow_favourites', (int) $_POST['allow_favourites']);
-
-                update_option('allow_quick_contact', (int) $_POST['allow_quick_contact']);
-
-                update_option('show_related_properties', (int) $_POST['show_related_properties']);
-
-                update_option('inactive_not_clickable', (int) $_POST['inactive_not_clickable']);
-
-                update_option('use_single_sidebar', (int) $_POST['use_single_sidebar']);
-                update_option('reusable_sidebar_id', (int) $_POST['reusable_sidebar_id']);
-                update_option('use_single_content_accordion', (int) $_POST['use_single_content_accordion']);
-
-                // Delete old options
-                delete_option('use_single_sidebar_widgets');
+                if ( ! isset( $_POST['wppd_property_admin_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wppd_property_admin_nonce'] ) ), 'wppd_property_admin' ) ) {
+                    wp_die( esc_html__( 'Security check failed.', 'property-drive' ) );
+                }
+                update_option('default_property_order', isset( $_POST['default_property_order'] ) ? sanitize_text_field( wp_unslash( $_POST['default_property_order'] ) ) : '');
+                update_option('jtg_currency', isset( $_POST['jtg_currency'] ) ? sanitize_text_field( wp_unslash( $_POST['jtg_currency'] ) ) : '');
+
+                update_option('map_provider', isset( $_POST['map_provider'] ) ? sanitize_text_field( wp_unslash( $_POST['map_provider'] ) ) : '');
+                update_option('osm_scrollzoom', isset( $_POST['osm_scrollzoom'] ) ? absint( $_POST['osm_scrollzoom'] ) : 0);
+
+                update_option('allow_quick_contact', isset( $_POST['allow_quick_contact'] ) ? absint( $_POST['allow_quick_contact'] ) : 0);
+
+                update_option('show_related_properties', isset( $_POST['show_related_properties'] ) ? absint( $_POST['show_related_properties'] ) : 0);
+
+                update_option('inactive_not_clickable', isset( $_POST['inactive_not_clickable'] ) ? absint( $_POST['inactive_not_clickable'] ) : 0);
+
+                update_option('use_single_sidebar', isset( $_POST['use_single_sidebar'] ) ? absint( $_POST['use_single_sidebar'] ) : 0);
+                update_option('reusable_sidebar_id', isset( $_POST['reusable_sidebar_id'] ) ? absint( $_POST['reusable_sidebar_id'] ) : 0);
+                update_option('use_single_content_accordion', isset( $_POST['use_single_content_accordion'] ) ? absint( $_POST['use_single_content_accordion'] ) : 0);
 
                 echo '<div class="updated notice is-dismissible"><p>Settings updated successfully!</p></div>';
@@ -256 +253 @@
                                     <input type="checkbox" id="allow_quick_contact" name="allow_quick_contact" value="1" <?php echo ((int) get_option('allow_quick_contact') === 1) ? 'checked' : ''; ?>>
                                     <label for="allow_quick_contact">Allow quick contact (property enquiry)</label>
-                                </p>
-                                <p>
-                                    <input type="checkbox" id="allow_favourites" name="allow_favourites" value="1" <?php echo ((int) get_option('allow_favourites') === 1) ? 'checked' : ''; ?>>
-                                    <label for="allow_favourites">Allow favourite properties</label>
                                 </p>
                             </td>
@@ -329 +322 @@
                                 <br><small>Select your reusable sidebar or <a href="' . admin_url('edit.php?post_type=wp_block') . '">create one now</a>.</small>';
 
-                                echo $out;
+                                echo wp_kses_post( $out );
                                 ?>
                             </td>
@@ -375 +368 @@
             <?php
             if (isset($_POST['save_design_settings'])) {
-                update_option('status_overlay_style', sanitize_text_field($_POST['status_overlay_style']));
-
-                update_option('show_status_badge', (int) $_POST['show_status_badge']);
-                update_option('show_property_card_description', (int) $_POST['show_property_card_description']);
-
-                update_option('ribbon_colour_sale', sanitize_text_field($_POST['ribbon_colour_sale']));
-                update_option('ribbon_colour_sale_agreed', sanitize_text_field($_POST['ribbon_colour_sale_agreed']));
-                update_option('ribbon_colour_sold', sanitize_text_field($_POST['ribbon_colour_sold']));
-
-                update_option('property_map_id', (int) $_POST['property_map_id']);
-                update_option('property_map_ajax', (int) $_POST['property_map_ajax']);
+                if ( ! isset( $_POST['wppd_property_admin_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wppd_property_admin_nonce'] ) ), 'wppd_property_admin' ) ) {
+                    wp_die( esc_html__( 'Security check failed.', 'property-drive' ) );
+                }
+                update_option('status_overlay_style', isset( $_POST['status_overlay_style'] ) ? sanitize_text_field( wp_unslash( $_POST['status_overlay_style'] ) ) : '');
+
+                update_option('show_status_badge', isset( $_POST['show_status_badge'] ) ? absint( $_POST['show_status_badge'] ) : 0);
+                update_option('show_property_card_description', isset( $_POST['show_property_card_description'] ) ? absint( $_POST['show_property_card_description'] ) : 0);
+
+                update_option('ribbon_colour_sale', isset( $_POST['ribbon_colour_sale'] ) ? sanitize_text_field( wp_unslash( $_POST['ribbon_colour_sale'] ) ) : '');
+                update_option('ribbon_colour_sale_agreed', isset( $_POST['ribbon_colour_sale_agreed'] ) ? sanitize_text_field( wp_unslash( $_POST['ribbon_colour_sale_agreed'] ) ) : '');
+                update_option('ribbon_colour_sold', isset( $_POST['ribbon_colour_sold'] ) ? sanitize_text_field( wp_unslash( $_POST['ribbon_colour_sold'] ) ) : '');
+
+                update_option('property_map_id', isset( $_POST['property_map_id'] ) ? absint( $_POST['property_map_id'] ) : 0);
+                update_option('property_map_ajax', isset( $_POST['property_map_ajax'] ) ? absint( $_POST['property_map_ajax'] ) : 0);
 
                 // Property brochure
-                update_option('cinematic_overlay', (int) $_POST['cinematic_overlay']);
+                update_option('cinematic_overlay', isset( $_POST['cinematic_overlay'] ) ? absint( $_POST['cinematic_overlay'] ) : 0);
 
                 // Flickity options
-                update_option('flickity_wrapAround', (int) $_POST['flickity_wrapAround']);
-                update_option('flickity_groupCells', (int) $_POST['flickity_groupCells']);
-                update_option('flickity_groupCellsValue', (int) $_POST['flickity_groupCellsValue']);
-                update_option('flickity_autoPlay', (int) $_POST['flickity_autoPlay']);
+                update_option('flickity_wrapAround', isset( $_POST['flickity_wrapAround'] ) ? absint( $_POST['flickity_wrapAround'] ) : 0);
+                update_option('flickity_groupCells', isset( $_POST['flickity_groupCells'] ) ? absint( $_POST['flickity_groupCells'] ) : 0);
+                update_option('flickity_groupCellsValue', isset( $_POST['flickity_groupCellsValue'] ) ? absint( $_POST['flickity_groupCellsValue'] ) : 0);
+                update_option('flickity_autoPlay', isset( $_POST['flickity_autoPlay'] ) ? absint( $_POST['flickity_autoPlay'] ) : 0);
                 //
 
-                if ((int) $_POST['force_cinematic_overlay'] === 1) {
+                if (isset( $_POST['force_cinematic_overlay'] ) && absint( $_POST['force_cinematic_overlay'] ) === 1) {
                     $tempArgs = [
                         'fields' => 'ids',
@@ -415 +411 @@
 
                 // General design
-                update_option('flex_grid_size', (int) $_POST['flex_grid_size']);
+                update_option('flex_grid_size', isset( $_POST['flex_grid_size'] ) ? absint( $_POST['flex_grid_size'] ) : 0);
 
                 echo '<div class="updated notice is-dismissible"><p>Settings updated successfully!</p></div>';
@@ -422 +418 @@
 
             <form method="post">
+                <?php wp_nonce_field( 'wppd_property_admin', 'wppd_property_admin_nonce' ); ?>
                 <div class="flex-container">
                     <div class="flex-item flex-item-half flex-item-box">
@@ -474 +471 @@
                                         <p>
                                             <label>Ribbon colour (<b>For Sale</b> and <b>To Let</b>)</label>
-                                            <input class="color-picker" data-default-color="#1abc9c" name="ribbon_colour_sale" type="text" value="<?php echo get_option('ribbon_colour_sale'); ?>">
+                                            <input class="color-picker" data-default-color="#1abc9c" name="ribbon_colour_sale" type="text" value="<?php echo esc_attr( get_option('ribbon_colour_sale') ); ?>">
                                         </p>
                                         <p>
                                             <label>Ribbon colour (<b>Sale Agreed</b> and <b>Let Agreed</b>)</label>
-                                            <input class="color-picker" data-default-color="#e67e22" name="ribbon_colour_sale_agreed" type="text" value="<?php echo get_option('ribbon_colour_sale_agreed'); ?>">
+                                            <input class="color-picker" data-default-color="#e67e22" name="ribbon_colour_sale_agreed" type="text" value="<?php echo esc_attr( get_option('ribbon_colour_sale_agreed') ); ?>">
                                         </p>
                                         <p>
                                             <label>Ribbon colour (<b>Sold</b>, <b>Let</b> and <b>Has Been Let</b>)</label>
-                                            <input class="color-picker" data-default-color="#e74c3c" name="ribbon_colour_sold" type="text" value="<?php echo get_option('ribbon_colour_sold'); ?>">
+                                            <input class="color-picker" data-default-color="#e74c3c" name="ribbon_colour_sold" type="text" value="<?php echo esc_attr( get_option('ribbon_colour_sold') ); ?>">
                                         </p>
                                     </td>
@@ -496 +493 @@
                                             wp_dropdown_pages([
                                                 'name' => 'property_map_id',
-                                                'selected' => get_option('property_map_id')
+                                                'selected' => (int) get_option('property_map_id')
                                             ]);
                                             ?>
@@ -571 +568 @@
             <?php
             if (isset($_POST['save_search_settings'])) {
-                update_option('search_field_array', sanitize_text_field($_POST['search_field_array']));
-
-                update_option('search_field_group', (int) $_POST['search_field_group']);
-                update_option('search_field_type', (int) $_POST['search_field_type']);
-                update_option('search_field_status', (int) $_POST['search_field_status']);
-                update_option('search_field_status_group', (int) $_POST['search_field_status_group']);
-                update_option('search_field_price', (int) $_POST['search_field_price']);
-                update_option('search_field_beds', (int) $_POST['search_field_beds']);
-                update_option('search_field_baths', (int) $_POST['search_field_baths']);
-                update_option('search_field_keyword', (int) $_POST['search_field_keyword']);
-
-                update_option('search_field_location', (int) $_POST['search_field_location']);
-                update_option('search_field_multitype', (int) $_POST['search_field_multitype']);
-
-                update_option('search_field_features', (int) $_POST['search_field_features']);
-
-                update_option('search_results_page', (int) $_POST['search_results_page']);
+                if ( ! isset( $_POST['wppd_property_admin_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wppd_property_admin_nonce'] ) ), 'wppd_property_admin' ) ) {
+                    wp_die( esc_html__( 'Security check failed.', 'property-drive' ) );
+                }
+                update_option('search_field_array', isset( $_POST['search_field_array'] ) ? sanitize_text_field( wp_unslash( $_POST['search_field_array'] ) ) : '');
+
+                update_option('search_field_group', isset( $_POST['search_field_group'] ) ? absint( $_POST['search_field_group'] ) : 0);
+                update_option('search_field_type', isset( $_POST['search_field_type'] ) ? absint( $_POST['search_field_type'] ) : 0);
+                update_option('search_field_status', isset( $_POST['search_field_status'] ) ? absint( $_POST['search_field_status'] ) : 0);
+                update_option('search_field_status_group', isset( $_POST['search_field_status_group'] ) ? absint( $_POST['search_field_status_group'] ) : 0);
+                update_option('search_field_price', isset( $_POST['search_field_price'] ) ? absint( $_POST['search_field_price'] ) : 0);
+                update_option('search_field_beds', isset( $_POST['search_field_beds'] ) ? absint( $_POST['search_field_beds'] ) : 0);
+                update_option('search_field_baths', isset( $_POST['search_field_baths'] ) ? absint( $_POST['search_field_baths'] ) : 0);
+                update_option('search_field_keyword', isset( $_POST['search_field_keyword'] ) ? absint( $_POST['search_field_keyword'] ) : 0);
+
+                update_option('search_field_location', isset( $_POST['search_field_location'] ) ? absint( $_POST['search_field_location'] ) : 0);
+                update_option('search_field_multitype', isset( $_POST['search_field_multitype'] ) ? absint( $_POST['search_field_multitype'] ) : 0);
+
+                update_option('search_field_features', isset( $_POST['search_field_features'] ) ? absint( $_POST['search_field_features'] ) : 0);
+
+                update_option('search_results_page', isset( $_POST['search_results_page'] ) ? absint( $_POST['search_results_page'] ) : 0);
 
                 echo '<div class="updated notice is-dismissible"><p>Settings updated successfully!</p></div>';
@@ -594 +594 @@
 
             <form method="post">
-                <input type="hidden" class="regular-text" name="search_field_array" id="form-items-order" value="<?php echo get_option('search_field_array'); ?>">
+                <?php wp_nonce_field( 'wppd_property_admin', 'wppd_property_admin_nonce' ); ?>
+                <input type="hidden" class="regular-text" name="search_field_array" id="form-items-order" value="<?php echo esc_attr( get_option('search_field_array') ); ?>">
                 <table class="form-table">
                     <tbody>
@@ -645 +646 @@
                                         }
 
-                                        echo '<li data-id="' . $searchFieldItem . '">
-                                            <svg class="svg-inline--fa fa-bars fa-w-14 fa-fw" aria-hidden="true" focusable="false" data-prefix="fa" data-icon="bars" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512" data-fa-i2svg="" height="16"><path fill="currentColor" d="M16 132h416c8.837 0 16-7.163 16-16V76c0-8.837-7.163-16-16-16H16C7.163 60 0 67.163 0 76v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16z"></path></svg> <input type="checkbox" id="search_field_' . $searchFieldItem . '" name="search_field_' . $searchFieldItem . '" value="1" ' . (((int) get_option('search_field_' . $searchFieldItem) === 1) ? 'checked' : '') . '>
-                                            <label for="search_field_' . $searchFieldItem . '">' . $fieldType . '</label>
+                                        echo '<li data-id="' . esc_attr( $searchFieldItem ) . '">
+                                            <svg class="svg-inline--fa fa-bars fa-w-14 fa-fw" aria-hidden="true" focusable="false" data-prefix="fa" data-icon="bars" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512" data-fa-i2svg="" height="16"><path fill="currentColor" d="M16 132h416c8.837 0 16-7.163 16-16V76c0-8.837-7.163-16-16-16H16C7.163 60 0 67.163 0 76v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16z"></path></svg> <input type="checkbox" id="search_field_' . esc_attr( $searchFieldItem ) . '" name="search_field_' . esc_attr( $searchFieldItem ) . '" value="1" ' . checked( 1, (int) get_option('search_field_' . $searchFieldItem), false ) . '>
+                                            <label for="search_field_' . esc_attr( $searchFieldItem ) . '">' . esc_html( $fieldType ) . '</label>
                                         </li>';
                                     }
@@ -676 +677 @@
         <?php } else if ($tab === 'users') {
             if (isset($_POST['save_users_settings'])) {
-                update_option('supernova_account_page_id', (int) $_POST['supernova_account_page_id']);
+                if ( ! isset( $_POST['wppd_property_admin_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wppd_property_admin_nonce'] ) ), 'wppd_property_admin' ) ) {
+                    wp_die( esc_html__( 'Security check failed.', 'property-drive' ) );
+                }
+                update_option('supernova_account_page_id', isset( $_POST['supernova_account_page_id'] ) ? absint( $_POST['supernova_account_page_id'] ) : 0);
 
                 echo '<div class="updated notice is-dismissible"><p>Settings updated successfully!</p></div>';
@@ -684 +688 @@
 
             <form method="post" action="">
+                <?php wp_nonce_field( 'wppd_property_admin', 'wppd_property_admin_nonce' ); ?>
                 <table class="form-table">
                     <tbody>
@@ -705 +710 @@
                                 <p>
                                     <input type="checkbox" checked disabled> Profile Editor<br>
-                                    <input type="checkbox" checked disabled> Favourite Properties<br>
                                 </p>
                             </td>

property-drive/trunk/includes/helpers.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 function wppd_show_property_images( $property_id ) {
     $image_array = get_post_meta( $property_id, 'detail_images_array', true );
@@ -121 +125 @@
 
     if ( isset( $linkedProperties ) && (string) $linkedProperties !== '' ) {
-        $out .= get_combined_property_ber( $linkedProperties );
+        $out .= wppd_get_combined_property_ber( $linkedProperties );
     } elseif ( in_array( $berRating, [ 'A1', 'A2', 'A3', 'B1', 'B2', 'B3', 'C1', 'C2', 'C3', 'D1', 'D2', 'E1', 'E2', 'F', 'G' ] ) ) {
         $out = '<div class="bercrumb ber-' . $berRatingClass . '">
@@ -151 +155 @@
  * @return string $out
  */
-function get_combined_property_ber( $linkedProperties ) {
+function wppd_get_combined_property_ber( $linkedProperties ) {
     if ( (string) $linkedProperties !== '' ) {
         $linkedPropertiesArray = explode( ',', $linkedProperties );
@@ -160 +164 @@
                 'post_type'      => 'property',
                 'posts_per_page' => 1,
-                'meta_query'     => [
-                    [
-                        'key'     => 'importer_id',
-                        'value'   => $linkedProperty,
-                        'compare' => '=',
-                    ],
-                ],
+                'meta_key'       => 'importer_id',
+                'meta_value'     => $linkedProperty,
             ];
             $linkedPropertyObject = new WP_Query( $linkedPropertyArgs );
@@ -237 +236 @@
     }
 
-    if ( isset( $propertyMarket ) && $propertyMarket === 'New Developments' && (string) getLinkedPropertiesBedroomRange( $linkedProperties ) !== '' ) {
-        return $iconString . getLinkedPropertiesBedroomRange( $linkedProperties );
+    if ( isset( $propertyMarket ) && $propertyMarket === 'New Developments' && (string) wppd_get_linked_properties_bedroom_range( $linkedProperties ) !== '' ) {
+        return $iconString . wppd_get_linked_properties_bedroom_range( $linkedProperties );
     } elseif ( $bedrooms > 0 ) {
         return $iconString . $bedrooms;
@@ -280 +279 @@
 function wp4pm_get_property_price( $property_id ) {
     $price     = (int) get_post_meta( $property_id, 'price', true );
-    $priceFrom = (string) getLinkedPropertiesPriceRange( $property_id );
+    $priceFrom = (string) wppd_get_linked_properties_price_range( $property_id );
 
     $currency        = get_option( 'jtg_currency' );
-    $currency_info   = jtg_currency_symbol( $currency );
+    $currency_info   = wppd_currency_symbol( $currency );
     $currency_symbol = $currency_info['symbol'];
 
@@ -577 +576 @@
 
 /**
- * Get favourite icon.
- *
- * @since 2.1.6
- *
- * @param  int    $property_id Property ID.
- * @return string
- */
-function wp4pm_get_favourite_icon( $property_id ) {
-    if ( (int) get_option( 'allow_favourites' ) === 1 ) {
-        return '<span class="property-card--favourite pd-box-favourite" data-property-id="' . $property_id . '" tooltip="Save property" flow="left"></span>';
-    }
-}
-
-
-
-/**
  * Get property image count.
  *
@@ -617 +600 @@
 
 
-function jtg_currency_symbol( $currency ) {
+function wppd_currency_symbol( $currency ) {
     $currency_symbol = [
         'symbol'     => '&euro;',
@@ -646 +629 @@
 }
 
-function pd_property_view_count( $post_id, $update = false ) {
+function wppd_property_view_count( $post_id, $update = false ) {
     $viewsCount = get_post_meta( $post_id, 'property_view_count', true ) ?? 0;
 
@@ -666 +649 @@
  * @return null
  */
-function pd_property_view_increment() {
-    $property_id = $_POST['propertyId'];
+function wppd_property_view_increment() {
+    // Verify nonce if provided
+    if ( isset( $_POST['nonce'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wp4pm_ajax_nonce' ) ) {
+        wp_send_json_error( 'Invalid nonce' );
+        return;
+    }
+    
+    $property_id = isset( $_POST['propertyId'] ) ? absint( $_POST['propertyId'] ) : 0;
+
+    if ( $property_id <= 0 ) {
+        wp_send_json_error( 'Invalid property ID' );
+        return;
+    }
 
     $viewsCount = get_post_meta( $property_id, 'property_view_count', true );
@@ -674 +668 @@
     update_post_meta( $property_id, 'property_view_count', $viewsCount );
 
-    wp_die();
-}
-add_action( 'wp_ajax_pd_property_view_increment', 'pd_property_view_increment' );
-add_action( 'wp_ajax_nopriv_pd_property_view_increment', 'pd_property_view_increment' );
-
-
-
-function get_subtypes( $typeSlug, $typeName ) {
-    $subtypes = '';
-
-    $livingTypes = [
-        'Not applicable',
-        'With planning',
-        'With Fore Court',
-        'With residence',
-        'Full license',
-        'Residential only',
-        'Commercial only',
-        'Residential & Commercial',
-        'Residential &amp; Commercial',
-        'Residential units only',
-        'Residential & Commercial units',
-        'Residential &amp; Commercial units',
-        'With Offices',
-        'Block',
-        'Residential & Commercial',
-        'Residential &amp; Commercial',
-        'not-applicable',
-    ];
-
-    $linkedPropertyArgs   = [
-        'post_type'      => 'property',
-        'posts_per_page' => -1,
-        'tax_query'      => [
-            [
-                'taxonomy' => 'property_type',
-                'field'    => 'slug',
-                'terms'    => [ $typeSlug ],
-            ],
-        ],
-    ];
-    $linkedPropertyObject = new WP_Query( $linkedPropertyArgs );
-    if ( $linkedPropertyObject->have_posts() ) {
-        while ( $linkedPropertyObject->have_posts() ) {
-            $linkedPropertyObject->the_post();
-
-            $livingType = get_post_meta( $linkedPropertyObject->post->ID, 'living_type', true );
-
-            if ( empty( $livingType ) || in_array( $livingType, $livingTypes ) ) {
-                $subtypes .= '';
-            } else {
-                $subtypes .= '<option value="' . sanitize_title( $typeName ) . '|' . $livingType . '" data-description="">' . $typeName . ' (' . $livingType . ')</option>';
-            }
-        }
-    }
-
-    return $subtypes;
-}
-
-
-
-function pd_favourites_fetch_public() {
-    $posts = $_POST['favourites'];
-
-    if ( ! empty( $posts ) ) {
-        echo do_shortcode( '[property-grid in="' . $posts . '" more="no" columns="3" pagination="no"]' );
-    }
-
-    die();
-}
-add_action( 'wp_ajax_pd_favourites_fetch_public', 'pd_favourites_fetch_public' );
-add_action( 'wp_ajax_nopriv_pd_favourites_fetch_public', 'pd_favourites_fetch_public' );
-
-
-
-function pd_favourites_fetch() {
-    $out = '<div id="pd-favourites"></div>';
-
-    return $out;
-}
-add_shortcode( 'favourites', 'pd_favourites_fetch' );
-
-
-function save_user_favourite() {
-    if ( is_user_logged_in() ) {
-        $userId      = get_current_user_id();
-        $property_id = (int) $_POST['property_id'];
-
-        // Check if favourite exists
-        $existingFavouriteArgs   = [
-            'author'         => $userId,
-            'post_type'      => 'favourite',
-            'posts_per_page' => 1,
-            'meta_query'     => [
-                [
-                    'key'     => '_property_id',
-                    'value'   => $property_id,
-                    'compare' => '=',
-                ],
-            ],
-        ];
-        $existingFavouriteObject = new WP_Query( $existingFavouriteArgs );
-
-        if ( (int) $existingFavouriteObject->found_posts <= 0 ) {
-            // Save favourite
-            if ( $property_id > 0 ) {
-                $favouriteId = wp_insert_post(
-                    [
-                        'post_title'  => 'Favourite #' . $property_id . ' - ' . uniqid() . ' - ' . date( 'Y-m-d, H:i' ),
-                        'post_type'   => 'favourite',
-                        'post_status' => 'private',
-                        'post_author' => $userId,
-                    ]
-                );
-                if ( $favouriteId ) {
-                    add_post_meta( $favouriteId, '_property_id', $property_id );
-                }
-            }
-        }
-    }
-
-    wp_die();
-}
-add_action( 'wp_ajax_save_user_favourite', 'save_user_favourite' );
-add_action( 'wp_ajax_nopriv_save_user_favourite', 'save_user_favourite' );
-
-function remove_user_favourite() {
-    if ( is_user_logged_in() ) {
-        $userId      = get_current_user_id();
-        $favouriteId = (int) $_POST['favourite_id'];
-
-        wp_delete_post( $favouriteId, true );
-    }
-
-    wp_die();
-}
-add_action( 'wp_ajax_remove_user_favourite', 'remove_user_favourite' );
-add_action( 'wp_ajax_nopriv_remove_user_favourite', 'remove_user_favourite' );
-
-
-
-function pd_request_contact() {
-    $pid = (int) $_POST['id'];
-
-    $to      = sanitize_email( $_POST['to'] );
-    $name    = sanitize_text_field( $_POST['name'] );
-    $email   = sanitize_email( $_POST['email'] );
-    $phone   = sanitize_text_field( $_POST['phone'] );
-    $message = wpautop( $_POST['message'] );
+    wp_send_json_success();
+}
+add_action( 'wp_ajax_pd_property_view_increment', 'wppd_property_view_increment' );
+add_action( 'wp_ajax_nopriv_pd_property_view_increment', 'wppd_property_view_increment' );
+
+
+
+function wppd_request_contact() {
+    // Verify nonce if provided
+    if ( isset( $_POST['nonce'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wp4pm_ajax_nonce' ) ) {
+        wp_send_json_error( 'Invalid nonce' );
+        return;
+    }
+    
+    $pid = isset( $_POST['id'] ) ? absint( $_POST['id'] ) : 0;
+
+    $to      = isset( $_POST['to'] ) ? sanitize_email( wp_unslash( $_POST['to'] ) ) : '';
+    $name    = isset( $_POST['name'] ) ? sanitize_text_field( wp_unslash( $_POST['name'] ) ) : '';
+    $email   = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( $_POST['email'] ) ) : '';
+    $phone   = isset( $_POST['phone'] ) ? sanitize_text_field( wp_unslash( $_POST['phone'] ) ) : '';
+    $message = isset( $_POST['message'] ) ? wp_kses_post( wp_unslash( $_POST['message'] ) ) : '';
+    $message = wpautop( $message );
 
     $subjectLine = 'Contact Request (ACQ)';
@@ -829 +696 @@
     <p>Contact details:</p>
     <ul>
-        <li><b>Name:</b> ' . $name . '</li>
-        <li><b>Email:</b> ' . $email . '</li>
-        <li><b>Phone:</b> ' . $phone . '</li>
-        <li><b>Sent from:</b> <a href="' . get_permalink( $pid ) . '">' . get_the_title( $pid ) . '</a></li>
-        <li><b>Message:</b> ' . $message . '</li>
+        <li><b>Name:</b> ' . esc_html( $name ) . '</li>
+        <li><b>Email:</b> ' . esc_html( $email ) . '</li>
+        <li><b>Phone:</b> ' . esc_html( $phone ) . '</li>
+        <li><b>Sent from:</b> <a href="' . esc_url( get_permalink( $pid ) ) . '">' . esc_html( get_the_title( $pid ) ) . '</a></li>
+        <li><b>Message:</b> ' . wp_kses_post( $message ) . '</li>
     </ul>';
 
     $headers[] = 'Content-Type: text/html;';
     $headers[] = 'X-Mailer: WordPress/PropertyDrive;';
-    $headers[] = "Reply-To: $name <$email>;";
+    $headers[] = 'Reply-To: ' . sanitize_email( $name ) . ' <' . sanitize_email( $email ) . '>';
 
     wp_mail( $to, $subjectLine, $body, $headers );
 }
-add_action( 'wp_ajax_pd_request_contact', 'pd_request_contact' );
-add_action( 'wp_ajax_nopriv_pd_request_contact', 'pd_request_contact' );
-
-
-
-function get_properties_by_id() {
-    $ids = (string) $_POST['ids'];
+add_action( 'wp_ajax_pd_request_contact', 'wppd_request_contact' );
+add_action( 'wp_ajax_nopriv_pd_request_contact', 'wppd_request_contact' );
+
+
+
+function wppd_get_properties_by_id() {
+    // Verify nonce if provided
+    if ( isset( $_POST['nonce'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wp4pm_ajax_nonce' ) ) {
+        wp_send_json_error( 'Invalid nonce' );
+        return;
+    }
+    
+    $ids = isset( $_POST['ids'] ) ? sanitize_text_field( wp_unslash( $_POST['ids'] ) ) : '';
 
     if ( ! empty( $ids ) ) {
-        echo do_shortcode( '[property-grid property-type="residential" count="-1" pagination="no" views="no" in="' . $ids . '"]' );
+        echo wp_kses_post( do_shortcode( '[property-grid property-type="residential" count="-1" pagination="no" views="no" in="' . esc_attr( $ids ) . '"]' ) );
     }
 
     wp_die();
 }
-add_action( 'wp_ajax_get_properties_by_id', 'get_properties_by_id' );
-add_action( 'wp_ajax_nopriv_get_properties_by_id', 'get_properties_by_id' );
+add_action( 'wp_ajax_get_properties_by_id', 'wppd_get_properties_by_id' );
+add_action( 'wp_ajax_nopriv_get_properties_by_id', 'wppd_get_properties_by_id' );
 
 
@@ -871 +744 @@
  * @param int $parentId WordPress property (CPT) ID.
  */
-function getLinkedPropertiesPriceRange( $parentId ) {
+function wppd_get_linked_properties_price_range( $parentId ) {
     if ( get_post_meta( $parentId, 'property_market', true ) == 'New Developments' ) {
         $currency        = get_option( 'jtg_currency' );
-        $currency_info   = jtg_currency_symbol( $currency );
+        $currency_info   = wppd_currency_symbol( $currency );
         $currency_symbol = $currency_info['symbol'];
 
@@ -887 +760 @@
                     'post_type'      => 'property',
                     'posts_per_page' => 1,
-                    'meta_query'     => [
-                        [
-                            'key'     => 'importer_id',
-                            'value'   => $linkedProperty,
-                            'compare' => '=',
-                        ],
-                    ],
+                    'meta_key'       => 'importer_id',
+                    'meta_value'     => $linkedProperty,
                 ];
                 $linkedPropertyObject = new WP_Query( $linkedPropertyArgs );
@@ -924 +792 @@
  * @param string $propertyList A list of importer_ids.
  */
-function getLinkedPropertiesBedroomRange( $propertyList ) {
+function wppd_get_linked_properties_bedroom_range( $propertyList ) {
     if ( (string) $propertyList !== '' ) {
         $linkedPropertiesArray = explode( ',', $propertyList );
@@ -933 +801 @@
                 'post_type'      => 'property',
                 'posts_per_page' => 1,
-                'meta_query'     => [
-                    [
-                        'key'     => 'importer_id',
-                        'value'   => $linkedProperty,
-                        'compare' => '=',
-                    ],
-                ],
+                'meta_key'       => 'importer_id',
+                'meta_value'     => $linkedProperty,
             ];
             $linkedPropertyObject = new WP_Query( $linkedPropertyArgs );
@@ -991 +854 @@
 
 
-function show_property_attachments( $property_id ) {
+function wppd_show_property_attachments( $property_id ) {
     /**
      * Get all post attachments and exclude featured image
@@ -1017 +880 @@
 }
 
-function get_sharing_buttons( $property_id ) {
+function wppd_get_sharing_buttons( $property_id ) {
     $property_id = (int) $property_id;
 
@@ -1030 +893 @@
  * Register property meta box
  */
-function pd_add_meta_box() {
-    add_meta_box( 'pd_meta_box', 'Property Details', 'property_metabox_callback', [ 'property' ] );
-}
-add_action( 'add_meta_boxes', 'pd_add_meta_box' );
+function wppd_add_meta_box() {
+    add_meta_box( 'pd_meta_box', 'Property Details', 'wppd_property_metabox_callback', [ 'property' ] );
+}
+add_action( 'add_meta_boxes', 'wppd_add_meta_box' );
 
 /**
  * eCards meta box Callback
  */
-function property_metabox_callback( $post ) {
+function wppd_property_metabox_callback( $post ) {
     wp_nonce_field( 'property', 'property_nonce' );
 
@@ -1053 +916 @@
     <p>
         <label>Property Importer ID</label>
-        <br><input type="text" name="importer_id" value="<?php echo intval( get_post_meta( $post_id, 'importer_id', true ) ); ?>">
+        <br><input type="text" name="importer_id" value="<?php echo esc_attr( intval( get_post_meta( $post_id, 'importer_id', true ) ) ); ?>">
     </p>
 
@@ -1067 +930 @@
     <h3>Property Media</h3>
     <div class="admin-gallery">
-        <?php echo show_property_attachments( get_the_ID() ); ?>
+        <?php echo wp_kses_post( wppd_show_property_attachments( get_the_ID() ) ); ?>
     </div>
 
     <p>
         <label>Property Tour</label>
-        <br><input type="text" name="tour" value="<?php echo get_post_meta( $post_id, 'tours', true ); ?>">
+        <br><input type="text" name="tour" value="<?php echo esc_attr( get_post_meta( $post_id, 'tours', true ) ); ?>">
     </p>
 
@@ -1082 +945 @@
                 <br>
                 <?php
-                function selectPropertyStatus( $post_id, $status ) {
+                function wppd_select_property_status( $post_id, $status ) {
                     $propertyStatusDb = (string) get_post_meta( $post_id, 'property_status', true );
 
@@ -1090 +953 @@
                 <select name="property_status" id="property-status" required>
                     <optgroup label="Active">
-                        <option <?php echo selectPropertyStatus( $post_id, 'For Sale' ); ?>>For Sale</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'To Let' ); ?>>To Let</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'For Sale' ) ); ?>>For Sale</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'To Let' ) ); ?>>To Let</option>
                     </optgroup>
                     <optgroup label="Inactive">
-                        <option <?php echo selectPropertyStatus( $post_id, 'Sale Agreed' ); ?>>Sale Agreed</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Sold' ); ?>>Sold</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Has Been Let' ); ?>>Has Been Let</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Sale Agreed' ) ); ?>>Sale Agreed</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Sold' ) ); ?>>Sold</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Has Been Let' ) ); ?>>Has Been Let</option>
                     </optgroup>
                     <optgroup label="In Progress/Other">
-                        <option <?php echo selectPropertyStatus( $post_id, 'For Sale/To Let' ); ?>>For Sale/To Let</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Coming Soon' ); ?>>Coming Soon</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Under Offer' ); ?>>Under Offer</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Open To Offers' ); ?>>Open To Offers</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Reserved' ); ?>>Reserved</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'For Auction' ); ?>>For Auction</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Seeking' ); ?>>Seeking</option>
-                        <option <?php echo selectPropertyStatus( $post_id, 'Let' ); ?>>Let</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'For Sale/To Let' ) ); ?>>For Sale/To Let</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Coming Soon' ) ); ?>>Coming Soon</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Under Offer' ) ); ?>>Under Offer</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Open To Offers' ) ); ?>>Open To Offers</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Reserved' ) ); ?>>Reserved</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'For Auction' ) ); ?>>For Auction</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Seeking' ) ); ?>>Seeking</option>
+                        <option <?php echo esc_attr( wppd_select_property_status( $post_id, 'Let' ) ); ?>>Let</option>
                     </optgroup>
                 </select>
@@ -1113 +976 @@
             <p>
                 <label>Property Market</label>
-                <br><input type="text" class="regular-text" name="market" value="<?php echo get_post_meta( $post_id, 'property_market', true ); ?>">
+                <br><input type="text" class="regular-text" name="market" value="<?php echo esc_attr( get_post_meta( $post_id, 'property_market', true ) ); ?>">
             </p>
 
             <p>
                 <label>Property Category</label>
-                <br><input type="text" class="regular-text" name="property_category" value="<?php echo get_post_meta( $post_id, 'property_category', true ); ?>">
+                <br><input type="text" class="regular-text" name="property_category" value="<?php echo esc_attr( get_post_meta( $post_id, 'property_category', true ) ); ?>">
                 <br><small>e.g. Investment, Waterfront, Urban, Coastal</small>
             </p>
@@ -1124 +987 @@
             <p>
                 <label>Price</label>
-                <br><input id="jtg_price" type="text" class="regular-text" name="price" value="<?php echo get_post_meta( $post_id, 'price', true ); ?>">
+                <br><input id="jtg_price" type="text" class="regular-text" name="price" value="<?php echo esc_attr( get_post_meta( $post_id, 'price', true ) ); ?>">
                 <br>
                 <label>Price Term</label>
-                <br><input id="jtg_price_term" type="text" class="regular-text" name="price_term" value="<?php echo get_post_meta( $post_id, 'price_term', true ); ?>">
+                <br><input id="jtg_price_term" type="text" class="regular-text" name="price_term" value="<?php echo esc_attr( get_post_meta( $post_id, 'price_term', true ) ); ?>">
             </p>
             <p>
                 <label>Bedrooms</label>
-                <br><input id="jtg_bedrooms" type="text" class="regular-text" name="bedrooms" value="<?php echo get_post_meta( $post_id, 'bedrooms', true ); ?>">
+                <br><input id="jtg_bedrooms" type="text" class="regular-text" name="bedrooms" value="<?php echo esc_attr( get_post_meta( $post_id, 'bedrooms', true ) ); ?>">
                 <br>
                 <label>Bathrooms</label>
-                <br><input id="jtg_bathrooms" type="text" class="regular-text" name="bathrooms" value="<?php echo get_post_meta( $post_id, 'bathrooms', true ); ?>">
+                <br><input id="jtg_bathrooms" type="text" class="regular-text" name="bathrooms" value="<?php echo esc_attr( get_post_meta( $post_id, 'bathrooms', true ) ); ?>">
             </p>
             <p>
                 <label>Property Size</label>
-                <br><input id="jtg_property_size" type="text" class="regular-text" name="property_size" value="<?php echo get_post_meta( $post_id, 'property_size', true ); ?>">
+                <br><input id="jtg_property_size" type="text" class="regular-text" name="property_size" value="<?php echo esc_attr( get_post_meta( $post_id, 'property_size', true ) ); ?>">
                 <br>
                 <label>Property Floors</label>
-                <br><input id="jtg_property_floors" type="text" class="regular-text" name="property_floors" value="<?php echo get_post_meta( $post_id, 'property_floors', true ); ?>">
+                <br><input id="jtg_property_floors" type="text" class="regular-text" name="property_floors" value="<?php echo esc_attr( get_post_meta( $post_id, 'property_floors', true ) ); ?>">
             </p>
             <p>
                 <label>BER Rating</label>
-                <br><input id="jtg_ber_rating" type="text" class="regular-text" name="ber_rating" value="<?php echo get_post_meta( $post_id, 'ber_rating', true ); ?>">
+                <br><input id="jtg_ber_rating" type="text" class="regular-text" name="ber_rating" value="<?php echo esc_attr( get_post_meta( $post_id, 'ber_rating', true ) ); ?>">
                 <bR>
                 <label>Energy Details</label>
-                <br><input id="jtg_energy_details" type="text" class="regular-text" name="energy_details" value="<?php echo get_post_meta( $post_id, 'energy_details', true ); ?>">
+                <br><input id="jtg_energy_details" type="text" class="regular-text" name="energy_details" value="<?php echo esc_attr( get_post_meta( $post_id, 'energy_details', true ) ); ?>">
             </p>
 
@@ -1160 +1023 @@
             <p>
                 <label>Latitude</label>
-                <br><input id="jtg_latitude" type="text" class="regular-text" name="latitude" value="<?php echo get_post_meta( $post_id, 'latitude', true ); ?>">
+                <br><input id="jtg_latitude" type="text" class="regular-text" name="latitude" value="<?php echo esc_attr( get_post_meta( $post_id, 'latitude', true ) ); ?>">
                 <br>
                 <label>Longitude</label>
-                <br><input id="jtg_longitude" type="text" class="regular-text" name="longitude" value="<?php echo get_post_meta( $post_id, 'longitude', true ); ?>">
+                <br><input id="jtg_longitude" type="text" class="regular-text" name="longitude" value="<?php echo esc_attr( get_post_meta( $post_id, 'longitude', true ) ); ?>">
             </p>
 
@@ -1169 +1032 @@
             <p>
                 <label>Agent ID</label>
-                <br><input id="jtg_agent_id" type="text" class="regular-text" name="agent_id" value="<?php echo get_post_meta( $post_id, 'agent_id', true ); ?>">
+                <br><input id="jtg_agent_id" type="text" class="regular-text" name="agent_id" value="<?php echo esc_attr( get_post_meta( $post_id, 'agent_id', true ) ); ?>">
                 <br>
                 <label>Agent Name</label>
-                <br><input id="jtg_agent_name" type="text" class="regular-text" name="agent_name" value="<?php echo get_post_meta( $post_id, 'agent_name', true ); ?>">
+                <br><input id="jtg_agent_name" type="text" class="regular-text" name="agent_name" value="<?php echo esc_attr( get_post_meta( $post_id, 'agent_name', true ) ); ?>">
                 <br>
                 <label>Agent Email</label>
-                <br><input id="jtg_agent_email" type="text" class="regular-text" name="agent_email" value="<?php echo get_post_meta( $post_id, 'agent_email', true ); ?>">
+                <br><input id="jtg_agent_email" type="text" class="regular-text" name="agent_email" value="<?php echo esc_attr( get_post_meta( $post_id, 'agent_email', true ) ); ?>">
                 <br>
                 <label>Agent Phone</label>
-                <br><input id="jtg_agent_number" type="text" class="regular-text" name="agent_number" value="<?php echo get_post_meta( $post_id, 'agent_number', true ); ?>">
+                <br><input id="jtg_agent_number" type="text" class="regular-text" name="agent_number" value="<?php echo esc_attr( get_post_meta( $post_id, 'agent_number', true ) ); ?>">
                 <br>
                 <label>Agent Mobile</label>
-                <br><input id="jtg_agent_mobile" type="text" class="regular-text" name="agent_mobile" value="<?php echo get_post_meta( $post_id, 'agent_mobile', true ); ?>">
+                <br><input id="jtg_agent_mobile" type="text" class="regular-text" name="agent_mobile" value="<?php echo esc_attr( get_post_meta( $post_id, 'agent_mobile', true ) ); ?>">
                 <br>
                 <label>Agent Qualification</label>
-                <br><input id="jtg_agent_qualification" type="text" class="regular-text" name="agent_qualification" value="<?php echo get_post_meta( $post_id, 'agent_qualification', true ); ?>">
+                <br><input id="jtg_agent_qualification" type="text" class="regular-text" name="agent_qualification" value="<?php echo esc_attr( get_post_meta( $post_id, 'agent_qualification', true ) ); ?>">
             </p>
 
@@ -1190 +1053 @@
             <p>
                 <label>Brochure 1</label>
-                <br><input id="jtg_brochure_1" type="text" class="regular-text" name="brochure_1" value="<?php echo get_post_meta( $post_id, 'brochure_1', true ); ?>">
+                <br><input id="jtg_brochure_1" type="text" class="regular-text" name="brochure_1" value="<?php echo esc_url( get_post_meta( $post_id, 'brochure_1', true ) ); ?>">
                 <br>
                 <label>Brochure 2</label>
-                <br><input id="jtg_brochure_2" type="text" class="regular-text" name="brochure_2" value="<?php echo get_post_meta( $post_id, 'brochure_2', true ); ?>">
+                <br><input id="jtg_brochure_2" type="text" class="regular-text" name="brochure_2" value="<?php echo esc_url( get_post_meta( $post_id, 'brochure_2', true ) ); ?>">
                 <br>
                 <label>Brochure 3</label>
-                <br><input id="jtg_brochure_3" type="text" class="regular-text" name="brochure_3" value="<?php echo get_post_meta( $post_id, 'brochure_3', true ); ?>">
+                <br><input id="jtg_brochure_3" type="text" class="regular-text" name="brochure_3" value="<?php echo esc_url( get_post_meta( $post_id, 'brochure_3', true ) ); ?>">
             </p>
         </div>
@@ -1207 +1070 @@
  * Save property meta box
  */
-function property_save_postdata( $post_id ) {
+function wppd_property_save_postdata( $post_id ) {
     if ( ! isset( $_POST['property_nonce'] ) ) {
         return $post_id;
     }
 
-    $nonce = $_POST['property_nonce'];
+    $nonce = sanitize_text_field( wp_unslash( $_POST['property_nonce'] ) );
 
     if ( ! wp_verify_nonce( $nonce, 'property' ) ) {
@@ -1224 +1087 @@
     $propertyLock = isset( $_POST['property_lock'] ) ? 1 : 0;
 
-    $propertyImporterId = isset( $_POST['importer_id'] ) ? (int) $_POST['importer_id'] : '';
-    $propertyTour       = isset( $_POST['tour'] ) ? $_POST['tour'] : '';
-    $propertyStatus     = isset( $_POST['property_status'] ) ? sanitize_text_field( $_POST['property_status'] ) : '';
-    $propertyMarket     = isset( $_POST['market'] ) ? sanitize_text_field( $_POST['market'] ) : '';
-    $propertyCategory   = isset( $_POST['property_category'] ) ? sanitize_text_field( $_POST['property_category'] ) : '';
-
-    $propertyPrice         = isset( $_POST['price'] ) ? sanitize_text_field( $_POST['price'] ) : '';
-    $propertyPriceTerm     = isset( $_POST['price_term'] ) ? sanitize_text_field( $_POST['price_term'] ) : '';
-    $propertyBedrooms      = isset( $_POST['bedrooms'] ) ? (int) $_POST['bedrooms'] : '';
-    $propertyBathrooms     = isset( $_POST['bathrooms'] ) ? (int) $_POST['bathrooms'] : '';
-    $propertySize          = isset( $_POST['property_size'] ) ? sanitize_text_field( $_POST['property_size'] ) : '';
-    $propertyFloors        = isset( $_POST['property_floors'] ) ? sanitize_text_field( $_POST['property_floors'] ) : '';
-    $propertyBerRating     = isset( $_POST['ber_rating'] ) ? sanitize_text_field( $_POST['ber_rating'] ) : '';
-    $propertyEnergyDetails = isset( $_POST['energy_details'] ) ? sanitize_text_field( $_POST['energy_details'] ) : '';
+    $propertyImporterId = isset( $_POST['importer_id'] ) ? absint( $_POST['importer_id'] ) : '';
+    $propertyTour       = isset( $_POST['tour'] ) ? sanitize_text_field( wp_unslash( $_POST['tour'] ) ) : '';
+    $propertyStatus     = isset( $_POST['property_status'] ) ? sanitize_text_field( wp_unslash( $_POST['property_status'] ) ) : '';
+    $propertyMarket     = isset( $_POST['market'] ) ? sanitize_text_field( wp_unslash( $_POST['market'] ) ) : '';
+    $propertyCategory   = isset( $_POST['property_category'] ) ? sanitize_text_field( wp_unslash( $_POST['property_category'] ) ) : '';
+
+    $propertyPrice         = isset( $_POST['price'] ) ? sanitize_text_field( wp_unslash( $_POST['price'] ) ) : '';
+    $propertyPriceTerm     = isset( $_POST['price_term'] ) ? sanitize_text_field( wp_unslash( $_POST['price_term'] ) ) : '';
+    $propertyBedrooms      = isset( $_POST['bedrooms'] ) ? absint( $_POST['bedrooms'] ) : '';
+    $propertyBathrooms     = isset( $_POST['bathrooms'] ) ? absint( $_POST['bathrooms'] ) : '';
+    $propertySize          = isset( $_POST['property_size'] ) ? sanitize_text_field( wp_unslash( $_POST['property_size'] ) ) : '';
+    $propertyFloors        = isset( $_POST['property_floors'] ) ? sanitize_text_field( wp_unslash( $_POST['property_floors'] ) ) : '';
+    $propertyBerRating     = isset( $_POST['ber_rating'] ) ? sanitize_text_field( wp_unslash( $_POST['ber_rating'] ) ) : '';
+    $propertyEnergyDetails = isset( $_POST['energy_details'] ) ? sanitize_text_field( wp_unslash( $_POST['energy_details'] ) ) : '';
 
     $propertyIsFeatured = isset( $_POST['is_featured'] ) ? 'true' : 'false';
 
-    $propertyLatitude           = isset( $_POST['latitude'] ) ? sanitize_text_field( $_POST['latitude'] ) : '';
-    $propertyLongitude          = isset( $_POST['longitude'] ) ? sanitize_text_field( $_POST['longitude'] ) : '';
-    $propertyAgentId            = isset( $_POST['agent_id'] ) ? (int) $_POST['agent_id'] : '';
-    $propertyAgentName          = isset( $_POST['agent_name'] ) ? sanitize_text_field( $_POST['agent_name'] ) : '';
-    $propertyAgentEmail         = isset( $_POST['agent_email'] ) ? sanitize_email( $_POST['agent_email'] ) : '';
-    $propertyAgentNumber        = isset( $_POST['agent_number'] ) ? sanitize_text_field( $_POST['agent_number'] ) : '';
-    $propertyAgentMobile        = isset( $_POST['agent_mobile'] ) ? sanitize_text_field( $_POST['agent_mobile'] ) : '';
-    $propertyAgentQualification = isset( $_POST['agent_qualification'] ) ? sanitize_text_field( $_POST['agent_qualification'] ) : '';
-
-    $propertyBrochure1 = isset( $_POST['brochure_1'] ) ? sanitize_text_field( $_POST['brochure_1'] ) : '';
-    $propertyBrochure2 = isset( $_POST['brochure_2'] ) ? sanitize_text_field( $_POST['brochure_2'] ) : '';
-    $propertyBrochure3 = isset( $_POST['brochure_3'] ) ? sanitize_text_field( $_POST['brochure_3'] ) : '';
+    $propertyLatitude           = isset( $_POST['latitude'] ) ? sanitize_text_field( wp_unslash( $_POST['latitude'] ) ) : '';
+    $propertyLongitude          = isset( $_POST['longitude'] ) ? sanitize_text_field( wp_unslash( $_POST['longitude'] ) ) : '';
+    $propertyAgentId            = isset( $_POST['agent_id'] ) ? absint( $_POST['agent_id'] ) : 0;
+    $propertyAgentName          = isset( $_POST['agent_name'] ) ? sanitize_text_field( wp_unslash( $_POST['agent_name'] ) ) : '';
+    $propertyAgentEmail         = isset( $_POST['agent_email'] ) ? sanitize_email( wp_unslash( $_POST['agent_email'] ) ) : '';
+    $propertyAgentNumber        = isset( $_POST['agent_number'] ) ? sanitize_text_field( wp_unslash( $_POST['agent_number'] ) ) : '';
+    $propertyAgentMobile        = isset( $_POST['agent_mobile'] ) ? sanitize_text_field( wp_unslash( $_POST['agent_mobile'] ) ) : '';
+    $propertyAgentQualification = isset( $_POST['agent_qualification'] ) ? sanitize_text_field( wp_unslash( $_POST['agent_qualification'] ) ) : '';
+
+    $propertyBrochure1 = isset( $_POST['brochure_1'] ) ? esc_url_raw( wp_unslash( $_POST['brochure_1'] ) ) : '';
+    $propertyBrochure2 = isset( $_POST['brochure_2'] ) ? esc_url_raw( wp_unslash( $_POST['brochure_2'] ) ) : '';
+    $propertyBrochure3 = isset( $_POST['brochure_3'] ) ? esc_url_raw( wp_unslash( $_POST['brochure_3'] ) ) : '';
 
     update_post_meta( $post_id, 'property_lock', $propertyLock );
@@ -1309 +1172 @@
     update_post_meta( $post_id, 'property_order', $propertyOrder );
 }
-add_action( 'save_post', 'property_save_postdata' );
+add_action( 'save_post', 'wppd_property_save_postdata' );
 
 
@@ -1316 +1179 @@
  * Convert a multi-dimensional array into a single-dimensional array.
  */
-function array_flatten( $array ) {
+function wppd_array_flatten( $array ) {
     if ( ! is_array( $array ) ) {
         return false;
@@ -1324 +1187 @@
     foreach ( $array as $key => $value ) {
         if ( is_array( $value ) ) {
-            $result = array_merge( $result, array_flatten( $value ) );
+            $result = array_merge( $result, wppd_array_flatten( $value ) );
         } else {
             $result[ $key ] = $value;
@@ -1353 +1216 @@
 add_action( 'wp_footer', 'wp4pm_analytics_footer' );
 function wp4pm_analytics_footer() {
-    echo '<span id="pd-ip" data-ip="' . wp4pm_get_pd_user_ip() . '"></span>';
-}
-
-
-
-
-add_action( 'admin_init', 'supernova_add_property_menu_order' );
-
-function supernova_add_property_menu_order() {
+    echo '<span id="pd-ip" data-ip="' . esc_attr( wp4pm_get_pd_user_ip() ) . '"></span>';
+}
+
+
+
+
+add_action( 'admin_init', 'wppd_add_property_menu_order' );
+
+function wppd_add_property_menu_order() {
     add_post_type_support( 'property', 'page-attributes' );
 }
@@ -1368 +1231 @@
 
 
-function supernova_accordion_item( $atts, $content = null ) {
+function wppd_accordion_item( $atts, $content = null ) {
     $attributes = shortcode_atts(
         [
@@ -1386 +1249 @@
 }
 
-add_shortcode( 'supernova-accordion-item', 'supernova_accordion_item' );
+add_shortcode( 'supernova-accordion-item', 'wppd_accordion_item' );
 
 
@@ -1405 +1268 @@
             }
 
-            echo '<img src="' . $post_thumbnail_url . '" height="60" alt="' . get_the_title( $post_id ) . '">';
+            echo '<img src="' . esc_url( $post_thumbnail_url ) . '" height="60" alt="' . esc_attr( get_the_title( $post_id ) ) . '">';
 
             break;
         case 'views':
-            $viewCounter = (int) pd_property_view_count( get_the_ID(), false );
+            $viewCounter = (int) wppd_property_view_count( get_the_ID(), false );
 
             echo number_format( $viewCounter );
@@ -1424 +1287 @@
             }
 
-            echo $status;
+            echo esc_html( $status );
 
             break;
@@ -1430 +1293 @@
             $m_orig    = get_post_field( 'post_modified', $post_id, 'raw' );
             $m_stamp   = strtotime( $m_orig );
-            $modified  = date( get_option( 'date_format' ) . ', ' . get_option( 'time_format' ), $m_stamp );
+            $modified  = gmdate( get_option( 'date_format' ) . ', ' . get_option( 'time_format' ), $m_stamp );
             $modr_id   = get_post_meta( $post_id, '_edit_last', true );
             $auth_id   = get_post_field( 'post_author', $post_id, 'raw' );
@@ -1436 +1299 @@
             $user_info = get_userdata( $user_id );
 
-            echo $modified . '<br>by <strong>' . $user_info->display_name . '<strong>';
+            echo esc_html( $modified ) . '<br>by <strong>' . esc_html( $user_info->display_name ) . '</strong>';
 
             break;
         case 'modified_source':
-            echo date( get_option( 'date_format' ) . ', ' . get_option( 'time_format' ), strtotime( get_post_meta( $post_id, 'date_modified', true ) ) ) . '<br>by <strong>' . get_post_meta( $post_id, 'source', true ) . '<strong>';
+            $date_modified = get_post_meta( $post_id, 'date_modified', true );
+            $source = get_post_meta( $post_id, 'source', true );
+            echo esc_html( gmdate( get_option( 'date_format' ) . ', ' . get_option( 'time_format' ), strtotime( $date_modified ) ) ) . '<br>by <strong>' . esc_html( $source ) . '</strong>';
 
             break;
@@ -1465 +1330 @@
 
 /**/
-add_action( 'init', 'supernova_access_init' );
-function supernova_access_init() {
+add_action( 'init', 'wppd_access_init' );
+function wppd_access_init() {
     if ( is_admin() && ! current_user_can( 'administrator' ) && ! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) ) {
-        wp_redirect( home_url() );
+        wp_safe_redirect( home_url() );
 
         exit;
     }
 }
-add_action( 'after_setup_theme', 'supernova_remove_admin_bar' );
-
-function supernova_remove_admin_bar() {
+add_action( 'after_setup_theme', 'wppd_remove_admin_bar' );
+
+function wppd_remove_admin_bar() {
     if ( ! current_user_can( 'administrator' ) && ! is_admin() ) {
         show_admin_bar( false );

property-drive/trunk/includes/inline_styling.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 function wp4pm_add_plugin_styles() {
     $ribbonColourSale = get_option('ribbon_colour_sale');
@@ -11 +15 @@
     }';
 
-    wp_register_style('ui-custom', false);
+    wp_register_style('ui-custom', false, array(), WPPD_VERSION);
     wp_add_inline_style('ui-custom', $css);
 }

property-drive/trunk/includes/meta.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 /**
  * Add meta box
@@ -6 +10 @@
  */
 function wppd_add_meta_boxes($post) {
-    add_meta_box('featured_property_meta_box', 'Advanced Property Settings', 'featured_property_build_meta_box', ['property'], 'side', 'low');
+    add_meta_box('featured_property_meta_box', 'Advanced Property Settings', 'wppd_featured_property_build_meta_box', ['property'], 'side', 'low');
 }
 
@@ -18 +22 @@
  * @param post $post The post object
  */
-function featured_property_build_meta_box($post) {
+function wppd_featured_property_build_meta_box($post) {
     wp_nonce_field(basename(__FILE__), 'featured_property_meta_box_nonce');
 
@@ -45 +49 @@
  * @param int $post_id The post ID.
  */
-function featured_property_save_meta_box_data($post_id) {
-    if (!isset($_POST['featured_property_meta_box_nonce']) || !wp_verify_nonce($_POST['featured_property_meta_box_nonce'], basename(__FILE__))) {
+function wppd_featured_property_save_meta_box_data($post_id) {
+    if (!isset($_POST['featured_property_meta_box_nonce']) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['featured_property_meta_box_nonce'] ) ), basename(__FILE__))) {
         return;
     }
@@ -56 +60 @@
     }
 
-    $propertyTemplate = isset($_POST['property_template']) ? (int) $_POST['property_template'] : '';
+    $propertyTemplate = isset($_POST['property_template']) ? absint( $_POST['property_template'] ) : '';
 
     update_post_meta($post_id, '_property_template', $propertyTemplate);
 }
 
-add_action('save_post', 'featured_property_save_meta_box_data');
+add_action('save_post', 'wppd_featured_property_save_meta_box_data');

property-drive/trunk/includes/property_search.php

@@ -1 +1 @@
 <?php
-function jtg_add_query_vars($public_query_vars) {
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
+function wppd_add_query_vars($public_query_vars) {
     $public_query_vars[] = 'property_status';
     $public_query_vars[] = 'property_type';
@@ -14 +18 @@
     return $public_query_vars;
 }
-add_filter('query_vars', 'jtg_add_query_vars');
+add_filter('query_vars', 'wppd_add_query_vars');

property-drive/trunk/includes/setup-plugin-options.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 /**
  * Build property custom post type
@@ -155 +159 @@
 
     add_option( 'allow_quick_contact', 1 );
-    add_option( 'allow_favourites', 0 );
     add_option( 'show_related_properties', 1 );
 

property-drive/trunk/modules/init.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 require_once 'user_sign_up.php';
 require_once 'user_dashboard.php';
 
-require_once 'cpt-favourites.php';
-
 require_once 'slider/slider.php';

property-drive/trunk/modules/slider/slider.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 function wp4pm_slider_enqueue() {
     wp_enqueue_style('slider', plugins_url('/slider.css', __FILE__), [], '1.0.1');
@@ -7 +11 @@
     wp_enqueue_script('slider', plugins_url('/slider.js', __FILE__), ['flickity'], '1.0.1', true);
     wp_localize_script('slider', 'ajaxVar', [
-        'ajaxurl' => admin_url('admin-ajax.php')
+        'ajaxurl' => admin_url('admin-ajax.php'),
+        'nonce' => wp_create_nonce('slider_nonce')
     ]);
 }
@@ -15 +20 @@
 
 function wp4pm_show_slider($atts) {
+    // Sanitize and validate attributes
     $attributes = shortcode_atts([
         'type' => 'slide',
@@ -26 +32 @@
     ], $atts);
 
-    $out = '<div class="slider-wrap" data-controls="' . $attributes['controls'] . '" data-type="' . $attributes['type'] . '" data-mobile="' . $attributes['mobile'] . '" data-fullheight="' . $attributes['fullheight'] . '" data-fullwidth="' . $attributes['fullwidth'] . '" data-zoom="' . $attributes['zoom'] . '" data-ids="' . $attributes['ids'] . '" data-interval="' . $attributes['interval'] . '"><div class="slider-wrap-spinner"></div></div>';
+    // Validate numeric values
+    $attributes['mobile'] = absint($attributes['mobile']);
+    $attributes['interval'] = absint($attributes['interval']);
+    
+    // Validate boolean values
+    $attributes['controls'] = in_array($attributes['controls'], ['yes', 'no']) ? $attributes['controls'] : 'yes';
+    $attributes['fullheight'] = in_array($attributes['fullheight'], ['yes', 'no']) ? $attributes['fullheight'] : 'no';
+    $attributes['fullwidth'] = in_array($attributes['fullwidth'], ['yes', 'no']) ? $attributes['fullwidth'] : 'yes';
+    $attributes['zoom'] = in_array($attributes['zoom'], ['yes', 'no']) ? $attributes['zoom'] : 'no';
+    
+    // Sanitize type
+    $attributes['type'] = sanitize_title($attributes['type']);
+    
+    // Sanitize IDs
+    $attributes['ids'] = sanitize_text_field($attributes['ids']);
+
+    $out = '<div class="slider-wrap" data-controls="' . esc_attr($attributes['controls']) . '" data-type="' . esc_attr($attributes['type']) . '" data-mobile="' . esc_attr($attributes['mobile']) . '" data-fullheight="' . esc_attr($attributes['fullheight']) . '" data-fullwidth="' . esc_attr($attributes['fullwidth']) . '" data-zoom="' . esc_attr($attributes['zoom']) . '" data-ids="' . esc_attr($attributes['ids']) . '" data-interval="' . esc_attr($attributes['interval']) . '"><div class="slider-wrap-spinner"></div></div>';
 
     return $out;
@@ -36 +58 @@
 
 function wp4pm_simple_slider_helper() {
+    // Verify nonce
+    if (!isset($_POST['nonce']) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'slider_nonce')) {
+        wp_send_json_error('Invalid nonce');
+    }
+
     $out = '';
 
-    $ids = sanitize_text_field($_POST['ids']);
+    // Sanitize and validate input
+    $ids = isset($_POST['ids']) ? sanitize_text_field( wp_unslash( $_POST['ids'] ) ) : '';
+    $type = isset($_POST['type']) ? sanitize_title( wp_unslash( $_POST['type'] ) ) : '';
+    $zoom = isset($_POST['zoom']) ? sanitize_title( wp_unslash( $_POST['zoom'] ) ) : '';
+    $fullheight = isset($_POST['fullheight']) ? sanitize_title( wp_unslash( $_POST['fullheight'] ) ) : '';
+    $fullwidth = isset($_POST['fullwidth']) ? sanitize_title( wp_unslash( $_POST['fullwidth'] ) ) : '';
+
+    // Validate boolean values
+    $zoom = in_array($zoom, ['yes', 'no']) ? $zoom : 'no';
+    $fullheight = in_array($fullheight, ['yes', 'no']) ? $fullheight : 'no';
+    $fullwidth = in_array($fullwidth, ['yes', 'no']) ? $fullwidth : 'yes';
 
     if ((string) $ids !== '') {
         $idArray = array_map('trim', explode(',', $ids));
         $idArray = array_filter($idArray);
+        $idArray = array_map('intval', $idArray); // Ensure all IDs are integers
     }
-
-    $type = sanitize_title($_POST['type']);
-    $zoom = sanitize_title($_POST['zoom']);
-
-    $fullheight = sanitize_title($_POST['fullheight']);
-    $fullwidth = sanitize_title($_POST['fullwidth']);
 
     $homepageHeroHeight = ((string) $fullheight === 'yes') ? 'fullvh' : '';
     $homepageHeroWidth = ((string) $fullwidth === 'yes') ? 'supernova-fullwidth' : '';
 
-    $out .= '<div class="slider ' . $homepageHeroWidth . ' homepage-hero ' . $homepageHeroHeight . '">
+    $out .= '<div class="slider ' . esc_attr($homepageHeroWidth) . ' homepage-hero ' . esc_attr($homepageHeroHeight) . '">
         <div class="homepage-hero-slider">';
             $args = [
@@ -76 +108 @@
                     $hero = $hero[0];
                     if ((string) get_post_meta(get_the_ID(), '_hero_property_image', true) !== '') {
-                        $hero = get_post_meta(get_the_ID(), '_hero_property_image', true);
+                        $hero = esc_url(get_post_meta(get_the_ID(), '_hero_property_image', true));
                     }
 
@@ -82 +114 @@
                     $slideContent = do_shortcode(get_the_content(get_the_ID()));
                     if (!empty(get_post_meta(get_the_ID(), 'slide-video', true))) {
-                        $dataVideo = '<video playsinline autoplay muted loop src="' . trim(get_post_meta(get_the_ID(), 'slide-video', true)) . '" type="video/mp4" width="100%" height="100%"></video>';
+                        $dataVideo = '<video playsinline autoplay muted loop src="' . esc_url(trim(get_post_meta(get_the_ID(), 'slide-video', true))) . '" type="video/mp4" width="100%" height="100%"></video>';
                     }
-                    $zoomContent = ((string) $zoom === 'yes') ? '<div class="slide-inner-zoom" style="background: url(' . $hero . ') no-repeat center center; background-size: cover;"></div>' : '';
+                    $zoomContent = ((string) $zoom === 'yes') ? '<div class="slide-inner-zoom" style="background: url(' . esc_url($hero) . ') no-repeat center center; background-size: cover;"></div>' : '';
 
-                    $out .= '<div class="slide slide-' . get_the_ID() . ' block" style="background: url(' . $hero . ') no-repeat center center; background-size: cover;">' .
+                    $out .= '<div class="slide slide-' . esc_attr(get_the_ID()) . ' block" style="background: url(' . esc_url($hero) . ') no-repeat center center; background-size: cover;">' .
                         $zoomContent .
                         $dataVideo .
-
                         '<div class="wrap">' .
-                            $slideContent .
+                            wp_kses_post($slideContent) .
                         '</div>
                     </div>';
@@ -100 +131 @@
     </div>';
 
-    echo $out;
+    echo wp_kses_post( $out );
 
     wp_die();
@@ -120 +151 @@
     $autoPlay = ((int) get_option('flickity_autoPlay') > 0) ? (int) get_option('flickity_autoPlay') : 'false';
 
-    $out = '<div class="flickity-carousel supernova-fullwidth" data-flickity=\'{ "contain": true, "imagesLoaded": true, "adaptiveHeight": false, "lazyLoad": true, "pageDots": false, "wrapAround": ' . $wrapAround . ', "groupCells": ' . $groupCells . ', "groupCells": ' . $groupCellsValue . ', "fullscreen": true, "autoplay": ' . $autoPlay . ' }\'>';
+    $out = '<div class="flickity-carousel supernova-fullwidth" data-flickity=\'{ "contain": true, "imagesLoaded": true, "adaptiveHeight": false, "lazyLoad": true, "pageDots": false, "wrapAround": ' . esc_attr($wrapAround) . ', "groupCells": ' . esc_attr($groupCells) . ', "groupCells": ' . esc_attr($groupCellsValue) . ', "fullscreen": true, "autoplay": ' . esc_attr($autoPlay) . ' }\'>';
         foreach ($imageArray as $imageUri) {
             $out .= '<div class="carousel-cell">
-                <img loading="eager" src="' . $imageUri . '" height="480" alt="">
+                <img loading="eager" src="' . esc_url($imageUri) . '" height="480" alt="' . esc_attr__('Property Image', 'property-drive') . '">
             </div>';
         }
     $out .= '</div>';
 
-    echo $out;
+    echo wp_kses_post( $out );
 }
 
@@ -140 +171 @@
     $out = '<div class="flickity-carousel-parsley--wrap">';
 
-    $out .= '<div class="flickity-carousel flickity-carousel-parsley supernova-fullwidth" data-flickity=\'{ "contain": true, "imagesLoaded": true, "adaptiveHeight": false, "lazyLoad": true, "pageDots": false, "wrapAround": true, "groupCells": true, "groupCells": 1, "fullscreen": true, "autoplay": ' . $autoPlay . ' }\'>';
+    $out .= '<div class="flickity-carousel flickity-carousel-parsley supernova-fullwidth" data-flickity=\'{ "contain": true, "imagesLoaded": true, "adaptiveHeight": false, "lazyLoad": true, "pageDots": false, "wrapAround": true, "groupCells": true, "groupCells": 1, "fullscreen": true, "autoplay": ' . esc_attr($autoPlay) . ' }\'>';
         foreach ($imageArray as $imageUri) {
             $imageUri = wppd_remove_var($imageUri, 'w');
@@ -148 +179 @@
 
             $out .= '<div class="carousel-cell">
-                <img loading="eager" src="' . $imageUri . '" height="720" alt="">
+                <img loading="eager" src="' . esc_url($imageUri) . '" height="720" alt="' . esc_attr__('Property Image', 'property-drive') . '">
             </div>';
         }
@@ -154 +185 @@
     $out .= '<div class="flickity-carousel-parsley--elements">
         <ul>
-            <li><a href="#" id="flickity-view-fullscreen">Gallery</a></li>
+            <li><a href="#" id="flickity-view-fullscreen">' . esc_html__('Gallery', 'property-drive') . '</a></li>
         </ul>
     </div>';
     $out .= '</div>';
 
-    echo $out;
+    echo wp_kses_post( $out );
 }

property-drive/trunk/modules/user_dashboard.php

@@ -1 +1 @@
 <?php
-function jtg_user_dashboard() {
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
+function wppd_user_dashboard() {
     $out = '';
 
@@ -12 +16 @@
         // Save user details
         if (isset($_POST['supernova-save-user-profile'])) {
-            wp_update_user([
-                'ID' => $userData->ID,
-                'first_name' => sanitize_text_field($_POST['first_name']),
-                'last_name' => sanitize_text_field($_POST['last_name']),
-                'user_email' => sanitize_email($_POST['user_email'])
-            ]);
-            update_user_meta($userData->ID, 'user_phone', sanitize_text_field($_POST['user_phone']));
+            if ( ! isset( $_POST['user_profile_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['user_profile_nonce'] ) ), 'user_profile_update' ) ) {
+                $out .= '<p>Security check failed.</p>';
+            } else {
+                wp_update_user([
+                    'ID' => $userData->ID,
+                    'first_name' => isset( $_POST['first_name'] ) ? sanitize_text_field( wp_unslash( $_POST['first_name'] ) ) : '',
+                    'last_name' => isset( $_POST['last_name'] ) ? sanitize_text_field( wp_unslash( $_POST['last_name'] ) ) : '',
+                    'user_email' => isset( $_POST['user_email'] ) ? sanitize_email( wp_unslash( $_POST['user_email'] ) ) : ''
+                ]);
+                update_user_meta($userData->ID, 'user_phone', isset( $_POST['user_phone'] ) ? sanitize_text_field( wp_unslash( $_POST['user_phone'] ) ) : '');
 
-            $out .= '<p>Profile updated successfully.</p>';
+                $out .= '<p>Profile updated successfully.</p>';
+            }
         }
 
-        $out .= '<h2>' . $userData->first_name . ' ' . $userData->last_name;
+        $out .= '<h2>' . esc_html( $userData->first_name ) . ' ' . esc_html( $userData->last_name );
         $out .= '</h2>';
 
-        $out .= '<p>Hi '. $userData->first_name . ', you can manage your profile and account settings. <a href="' . wp_logout_url(home_url()) . '">Logout</a>.</p>';
+        $out .= '<p>Hi ' . esc_html( $userData->first_name ) . ', you can manage your profile and account settings. <a href="' . esc_url( wp_logout_url(home_url()) ) . '">Logout</a>.</p>';
 
         $out .= '<details class="user-dashboard-menu-item">
@@ -36 +44 @@
             <h3>My Profile</h3>
             <form class="supernova-profile-form" method="post">
+                ' . wp_nonce_field( 'user_profile_update', 'user_profile_nonce', true, false ) . '
                 <div class="wp-block-columns has-2-columns">
                     <div class="wp-block-column">
                         <p>
                             First Name<br>
-                            <input type="text" id="first_name" name="first_name" value="' . $userData->first_name . '" size="48">
+                            <input type="text" id="first_name" name="first_name" value="' . esc_attr( $userData->first_name ) . '" size="48">
                         </p>
                         <p>
                             Last Name<br>
-                            <input type="text" id="last_name" name="last_name" value="' . $userData->last_name . '" size="48">
+                            <input type="text" id="last_name" name="last_name" value="' . esc_attr( $userData->last_name ) . '" size="48">
                         </p>
                     </div>
@@ -50 +59 @@
                         <p>
                             Phone Number<br>
-                            <input type="text" id="user_phone" name="user_phone" value="' . get_the_author_meta('user_phone', $userData->ID) . '" size="48">
+                            <input type="text" id="user_phone" name="user_phone" value="' . esc_attr( get_the_author_meta('user_phone', $userData->ID) ) . '" size="48">
                         </p>
                         <p>
                             Email Address<br>
-                            <input type="email" id="user_email" name="user_email" value="' . $userData->user_email . '" size="48">
+                            <input type="email" id="user_email" name="user_email" value="' . esc_attr( $userData->user_email ) . '" size="48">
                         </p>
                         <p>
@@ -65 +74 @@
 
         <details class="user-dashboard-menu-item">
-            <summary title="Click to expand this section">
-                My Favourite Properties
-                <small>Save favourite properties in a shortlist.</small>
-            </summary>
-
-            <h3>Favourite Properties</h3>';
-
-            $property_favourites = get_posts([
-                'post_type' => 'favourite',
-                'posts_per_page' => -1,
-                'post_status' => 'private',
-                'author' => get_current_user_id(),
-            ]);
-
-            if ($property_favourites) {
-                $out .= '<div>
-                    <table width="100%">
-                        <thead>
-                            <tr>
-                                <th></th>
-                                <th>Property Name</th>
-                                <th>Added</th>
-                            </tr>
-                        </thead>
-                        <tbody>';
-
-                            foreach ($property_favourites as $favourite) {
-                                $propertyId = get_post_meta($favourite->ID, '_property_id', true);
-                                $property_title = get_the_title($propertyId);
-                                $property_url = get_permalink($propertyId);
-
-                                $out .= '<tr data-property-id="' . $propertyId . '" id="favourite-row-' . $favourite->ID . '">
-                                    <td>
-                                        <a href="#" class="remove-user-favourite" data-favourite-id="' . $favourite->ID . '">
-                                            Delete
-                                        </a>
-                                    </td>
-                                    <td>
-                                        <a href="'.$property_url.'" target="_blank">'.$property_title.'</a>
-                                    </td>
-                                    <td>' . $favourite->post_date . '</td>
-                                </tr>';
-                            }
-
-                        $out .= '</tbody>
-                    </table>
-                </div>';
-            } else {
-                $out .= '<p>You have not saved any properties to your favourites list yet, you can do this by visiting a property and clicking the red heart.</p>
-                <p>To remove a favourite, you can do so from here or clicking the empty heart on the property.</p>';
-            }
-        $out .= '</details>';
-
-        $out .= '<details class="user-dashboard-menu-item">
             <summary title="Click to expand this section">
                 My Documents
@@ -142 +97 @@
                             $attachmentsQuery->the_post();
                             $out .= '<div>
-                                <a href="' . $attachmentsQuery->post->guid . '" class="ui-button" target="_blank">View document</a>' . $attachmentsQuery->post->post_title .
+                                <a href="' . esc_url( $attachmentsQuery->post->guid ) . '" class="ui-button" target="_blank">View document</a>' . esc_html( $attachmentsQuery->post->post_title ) .
                             '</div>';
                         }
@@ -179 +134 @@
 
                 '<p>
-                    <small>Your account gives you access to alerts, notifications, favourites and more.</small>
+                    <small>Your account gives you access to alerts, notifications and more.</small>
                 </p>
             </div>
@@ -185 +140 @@
                 <h4>Sign Up</h4>' .
 
-                supernova_custom_registration() . '
+                wppd_custom_registration() . '
             </div>
         </div>
@@ -195 +150 @@
 }
 
-add_shortcode('user-dashboard', 'jtg_user_dashboard');
+add_shortcode('user-dashboard', 'wppd_user_dashboard');

property-drive/trunk/modules/user_sign_up.php

@@ -1 +1 @@
 <?php
-function supernova_custom_registration() {
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
+function wppd_custom_registration() {
     $out = '';
 
     if (isset($_POST['supernova_register'])) {
-        global $registrationErrors;
+        if ( ! isset( $_POST['user_registration_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['user_registration_nonce'] ) ), 'user_registration' ) ) {
+            $out .= '<div class="ui-notification ui-notification--error">Security check failed.</div>';
+            return $out;
+        }
+        
+        global $wppd_registration_errors;
 
-        $registrationErrors = new WP_Error;
+        $wppd_registration_errors = new WP_Error;
 
-        $username = sanitize_user($_POST['username']);
-        $password = esc_attr($_POST['password']);
-        $email = sanitize_email($_POST['email']);
-        $firstName = sanitize_text_field($_POST['fname']);
-        $lastName = sanitize_text_field($_POST['lname']);
+        $username = isset( $_POST['username'] ) ? sanitize_user( wp_unslash( $_POST['username'] ) ) : '';
+        $password_raw = isset( $_POST['password'] ) ? sanitize_text_field( wp_unslash( $_POST['password'] ) ) : '';
+        // Passwords should not be sanitized as it would strip special characters needed for security
+        // Only validate that it's a string and doesn't contain null bytes
+        $password = is_string( $password_raw ) ? str_replace( "\0", '', $password_raw ) : '';
+        $email = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( $_POST['email'] ) ) : '';
+        $firstName = isset( $_POST['fname'] ) ? sanitize_text_field( wp_unslash( $_POST['fname'] ) ) : '';
+        $lastName = isset( $_POST['lname'] ) ? sanitize_text_field( wp_unslash( $_POST['lname'] ) ) : '';
 
         if (empty($username) || empty($password) || empty($email)) {
-            $registrationErrors->add('field', 'You have to fill in all the required fields.');
+            $wppd_registration_errors->add('field', 'You have to fill in all the required fields.');
         }
         if (!validate_username($username) || username_exists($username) || 4 > strlen($username)) {
-            $registrationErrors->add('username_invalid', 'The username is invalid or already in use.');
+            $wppd_registration_errors->add('username_invalid', 'The username is invalid or already in use.');
         }
         if (5 > strlen($password)) {
-            $registrationErrors->add('password', 'Your password needs to be longer than 5 characters.');
+            $wppd_registration_errors->add('password', 'Your password needs to be longer than 5 characters.');
         }
         if (!is_email($email) || email_exists($email)) {
-            $registrationErrors->add('email_invalid', 'The email address is invalid or already in use.');
+            $wppd_registration_errors->add('email_invalid', 'The email address is invalid or already in use.');
         }
-        if (is_wp_error($registrationErrors)) {
-            foreach ($registrationErrors->get_error_messages() as $error) {
+        if (is_wp_error($wppd_registration_errors)) {
+            foreach ($wppd_registration_errors->get_error_messages() as $error) {
                 $out .= '<div class="ui-notification ui-notification--warning">' . $error . '</div>';
             }
         }
 
-        if (1 > count($registrationErrors->get_error_messages())) {
+        if (1 > count($wppd_registration_errors->get_error_messages())) {
             $userData = [
                 'user_login' => $username,
@@ -48 +60 @@
     $out .= '<div class="supernova-registration-form">
         <form method="post">
+            ' . wp_nonce_field( 'user_registration', 'user_registration_nonce', true, false ) . '
             <p>
                 <label for="username">Username <b>*</b></label>
@@ -77 +90 @@
 }
 
-add_shortcode('supernova-registration', 'supernova_custom_registration');
+add_shortcode('supernova-registration', 'wppd_custom_registration');

property-drive/trunk/property-drive.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 /**
  * Plugin Name: Property Drive
@@ -9 +13 @@
  * License: GNU General Public License v3 or later
  * License URI: https://www.gnu.org/licenses/gpl-3.0.html
+ * Text Domain: property-drive
  */
 
@@ -81 +86 @@
         array(
             'ajaxurl' => admin_url( 'admin-ajax.php' ),
+            'nonce' => wp_create_nonce( 'wp4pm_ajax_nonce' ),
         )
     );
@@ -88 +94 @@
     wp_enqueue_style( 'wp-color-picker' );
 
-    wp_enqueue_style( 'admin-ui', plugins_url( 'assets/css/ui-admin.css', __FILE__ ) );
+    wp_enqueue_style( 'admin-ui', plugins_url( 'assets/css/ui-admin.css', __FILE__ ), array(), WPPD_VERSION );
 
     wp_enqueue_script( 'sortable', plugins_url( 'assets/js/Sortable.min.js', __FILE__ ), array(), '1.7.0', true );
 
-    wp_enqueue_script( 'jtg-admin-ui-js', plugins_url( 'assets/js/admin_ui.js', __FILE__ ), array( 'sortable', 'wp-color-picker', 'jquery' ), '', true );
+    wp_enqueue_script( 'jtg-admin-ui-js', plugins_url( 'assets/js/admin_ui.js', __FILE__ ), array( 'sortable', 'wp-color-picker', 'jquery' ), WPPD_VERSION, true );
     wp_localize_script(
         'jtg-admin-ui-js',
@@ -141 +147 @@
             $out .= wp4pm_get_property_status_ribbon( $property_id );
             $out .= wp4pm_get_property_image_count( $property_id, true );
-            $out .= wp4pm_get_favourite_icon( $property_id );
 
             // Thumbnail

property-drive/trunk/readme.txt

@@ -3 +3 @@
 Tags: property, real estate, estate agents, house, home
 Requires at least: 5.6
-Tested up to: 6.5
+Tested up to: 6.9
 Requires PHP: 7.0
 Stable tag: 1.1.2
@@ -16 +16 @@
 
 Property Drive uses custom embedded icons with no external dependencies, Google Maps (API key required), Google Street View, OpenStreetMap, multiselect filters, a full page Map Navigator and more.
+
+== Third-Party Services ==
+
+This plugin uses the following third-party services:
+
+* **Google Maps**: This plugin may use Google Maps API to display property locations on maps. When enabled, property location data may be sent to Google Maps servers. Google Maps requires an API key to be configured in the plugin settings.
+  * Service: https://www.google.com/maps
+  * Terms of Service: https://www.google.com/intl/en_us/help/terms_maps.html
+  * Privacy Policy: https://policies.google.com/privacy
+
+* **YouTube**: This plugin may embed YouTube videos when property content contains YouTube video links. When YouTube videos are embedded, data may be sent to YouTube servers.
+  * Service: https://www.youtube.com
+  * Terms of Service: https://www.youtube.com/static?template=terms
+  * Privacy Policy: https://policies.google.com/privacy
 
 If you have a Property Drive account, you can hook up to the API and synchronize your existing properties.

property-drive/trunk/shortcodes/property-grid.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 function wp4pm_property_grid($atts) {
     $attributes = shortcode_atts([
@@ -32 +36 @@
         'post_type' => 'property',
         'post_status' => 'publish',
-        'suppress_filters' => true,
         'paged' => $paged,
     ];
@@ -236 +239 @@
             'taxonomy' => 'property_type',
             'field' => 'slug',
-            'terms' => array_flatten($propertyTypeArray)
+            'terms' => wppd_array_flatten($propertyTypeArray)
         ]);
     }
@@ -253 +256 @@
     }
 
-
-
+    // Read-only GET params for display sort order; no state change — nonce not required.
+    // phpcs:disable WordPress.Security.NonceVerification.Recommended
     if (isset($_GET['orderby'])) {
-        $orderBy = (string) sanitize_text_field($_GET['orderby']);
-        $order = (string) sanitize_text_field($_GET['order_direction']);
+        $orderBy = (string) sanitize_text_field( wp_unslash( $_GET['orderby'] ) );
+        $order = isset( $_GET['order_direction'] ) ? (string) sanitize_text_field( wp_unslash( $_GET['order_direction'] ) ) : 'ASC';
 
         if ($orderBy === 'price') {
@@ -314 +317 @@
         }
     }
+    // phpcs:enable WordPress.Security.NonceVerification.Recommended
 
     $query = new WP_Query($queryArgsMeta);

property-drive/trunk/shortcodes/property-map.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 function wp4pm_property_map($atts) {
     $attributes = shortcode_atts([
@@ -26 +30 @@
         'post_type' => 'property',
         'post_status' => 'publish',
-        'suppress_filters' => true,
         'paged' => $paged,
     ];
@@ -211 +214 @@
             'taxonomy' => 'property_type',
             'field' => 'slug',
-            'terms' => array_flatten($propertyTypeArray)
+            'terms' => wppd_array_flatten($propertyTypeArray)
         ]);
     }
@@ -228 +231 @@
     }
 
-
-
+    // Read-only GET params for display sort order; no state change — nonce not required.
+    // phpcs:disable WordPress.Security.NonceVerification.Recommended
     if (isset($_GET['orderby'])) {
-        $orderBy = (string) sanitize_text_field($_GET['orderby']);
-        $order = (string) sanitize_text_field($_GET['order_direction']);
+        $orderBy = (string) sanitize_text_field( wp_unslash( $_GET['orderby'] ) );
+        $order = isset( $_GET['order_direction'] ) ? (string) sanitize_text_field( wp_unslash( $_GET['order_direction'] ) ) : 'ASC';
 
         if ($orderBy === 'price') {
@@ -289 +292 @@
         }
     }
+    // phpcs:enable WordPress.Security.NonceVerification.Recommended
 
     $query = new WP_Query($queryArgsMeta);

property-drive/trunk/shortcodes/search-form-results.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 /**
  * Display property search results
@@ -32 +36 @@
      * Check if this is a search
      */
+    // Read-only GET params from search form; used only to filter/order display — nonce not required.
+    // phpcs:disable WordPress.Security.NonceVerification.Recommended
     if (isset($_GET['property_type']) || isset($_GET['property_status']) || isset($_GET['group_type']) || isset($_GET['location']) || isset($_GET['property_keyword'])) {
         $paged = (get_query_var('paged')) ? get_query_var('paged') : 1;
@@ -38 +44 @@
 
         // Build search query arguments
-        if (isset($_GET['group_type']) && (string) sanitize_text_field($_GET['group_type']) !== '') {
-            if (sanitize_text_field($_GET['group_type']) === 'pm_commercial') {
+        if (isset($_GET['group_type']) && (string) sanitize_text_field( wp_unslash( $_GET['group_type'] ) ) !== '') {
+            if (sanitize_text_field( wp_unslash( $_GET['group_type'] ) ) === 'pm_commercial') {
                 $tax_query[] = [[
                     'taxonomy' => 'property_type',
@@ -56 +62 @@
                     ]
                 ]];
-            } else if ((string) sanitize_text_field( $_GET['group_type'] ) === 'pm_residential') {
+            } else if ((string) sanitize_text_field( wp_unslash( $_GET['group_type'] ) ) === 'pm_residential') {
                 $tax_query[] = [[
                     'taxonomy' => 'property_type',
@@ -68 +74 @@
                     ]
                 ]];
-            } else if ((string) sanitize_text_field( $_GET['group_type'] ) === 'pm_land') {
+            } else if ((string) sanitize_text_field( wp_unslash( $_GET['group_type'] ) ) === 'pm_land') {
                 $tax_query[] = [[
                     'taxonomy' => 'property_type',
@@ -84 +90 @@
         }
 
-        if (isset($_GET['property_type']) && (string) sanitize_text_field($_GET['property_type']) !== '') {
+        if (isset($_GET['property_type']) && (string) sanitize_text_field( wp_unslash( $_GET['property_type'] ) ) !== '') {
             $tax_query[] = [[
                 'taxonomy' => 'property_type',
                 'field' => 'slug',
-                'terms' => sanitize_text_field($_GET['property_type'])
+                'terms' => sanitize_text_field( wp_unslash( $_GET['property_type'] ) )
             ]];
         }
 
-        if (isset($_GET['property_status']) && sanitize_text_field($_GET['property_status']) !== '') {
-            $propertyStatusArray = array_map('trim', explode(',', sanitize_text_field($_GET['property_status'])));
+        if (isset($_GET['property_status']) && sanitize_text_field( wp_unslash( $_GET['property_status'] ) ) !== '') {
+            $propertyStatusArray = array_map('trim', explode(',', sanitize_text_field( wp_unslash( $_GET['property_status'] ) )));
             $propertyStatusArray = array_filter($propertyStatusArray);
 
@@ -104 +110 @@
 
         if (isset($_GET['location'])) {
-            $locationAreas = sanitize_text_field($_GET['location']);
+            $locationAreas = sanitize_text_field( wp_unslash( $_GET['location'] ) );
 
             $meta_query[] = [
@@ -113 +119 @@
         }
         if (isset($_GET['t'])) {
-            $multiType = sanitize_text_field($_GET['t']);
+            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Unslashed here, then sanitized via array_map(sanitize_text_field) below.
+            $t_raw = isset( $_GET['t'] ) ? wp_unslash( $_GET['t'] ) : [];
+            $t_raw = is_array( $t_raw ) ? $t_raw : [ $t_raw ];
+            $multiType = array_map( 'sanitize_text_field', $t_raw );
             $propertyType = $propertyLivingType = [];
 
@@ -140 +149 @@
 
         if (isset($_GET['location_area'])) {
-            $locationAreas = sanitize_text_field($_GET['location_area']);
+            $locationAreas = sanitize_text_field( wp_unslash( $_GET['location_area'] ) );
 
             $meta_query[] = [
@@ -151 +160 @@
         $locationCounty = 0;
 
-        if (isset($_GET['location_county']) && sanitize_text_field($_GET['location_county']) !== '') {
+        if (isset($_GET['location_county']) && sanitize_text_field( wp_unslash( $_GET['location_county'] ) ) !== '') {
             $locationArray = [
                 1 => 'Dublin',
@@ -181 +190 @@
             ];
 
-            $locationId = absint($_GET['location_county']);
+            $locationId = isset( $_GET['location_county'] ) ? absint( $_GET['location_county'] ) : 0;
             $locationCounty = (string) $locationArray[$locationId];
 
@@ -195 +204 @@
                 'key' => 'bedrooms',
                 'type' => 'NUMERIC',
-                'value' => (int) $_GET['beds'],
+                'value' => absint( $_GET['beds'] ),
                 'compare' => '>='
             ];
         }
         if (isset($_GET['min_price']) || isset($_GET['max_price'])) {
-            $minPrice = isset($_GET['min_price']) ? (int) $_GET['min_price'] : 0;
-            $maxPrice = isset($_GET['max_price']) ? (int) $_GET['max_price'] : 10000000;
+            $minPrice = isset($_GET['min_price']) ? absint( $_GET['min_price'] ) : 0;
+            $maxPrice = isset($_GET['max_price']) ? absint( $_GET['max_price'] ) : 10000000;
 
             $meta_query[] = [
@@ -213 +222 @@
         $order_direction = 'ASC';
         if (isset($_GET['order_direction']) ) {
-            if ($_GET['order_direction'] == 'ASC') {
+            $order_direction_input = sanitize_text_field( wp_unslash( $_GET['order_direction'] ) );
+            if ($order_direction_input === 'ASC') {
                 $order_direction = 'ASC';
             } else {
@@ -220 +230 @@
         }
 
-        if (isset($_GET['orderby']) && (string) $_GET['orderby'] === 'date') {
+        if (isset($_GET['orderby']) && (string) sanitize_text_field( wp_unslash( $_GET['orderby'] ) ) === 'date') {
             $args = [
                 'paged' => $paged,
@@ -230 +240 @@
                 'meta_query' => $meta_query
             ];
-        } else if (!$_GET) {
+        } else if (empty($_GET)) {
             $args = [
                 'paged' => $paged,
@@ -260 +270 @@
 
         if (isset($_GET['orderby'])) {
-            $orderBy = (string) sanitize_text_field($_GET['orderby']);
+            $orderBy = (string) sanitize_text_field( wp_unslash( $_GET['orderby'] ) );
             if ($orderBy === 'price') {
                 $args['orderby'] = 'meta_value';
@@ -273 +283 @@
         }
 
-        if (isset($_GET['property_keyword']) && sanitize_text_field($_GET['property_keyword']) !== '') {
-            $args['s'] = sanitize_text_field($_GET['property_keyword']);
+        if (isset($_GET['property_keyword']) && sanitize_text_field( wp_unslash( $_GET['property_keyword'] ) ) !== '') {
+            $args['s'] = sanitize_text_field( wp_unslash( $_GET['property_keyword'] ) );
         }
     } else {
 
     }
+    // phpcs:enable WordPress.Security.NonceVerification.Recommended
 
     $query = new WP_Query($args);

property-drive/trunk/shortcodes/search-form.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 function wp4pm_get_pd_user_ip() {
+    $ipAddress = '';
     if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
-        $ipAddress = $_SERVER['HTTP_CLIENT_IP'];
+        $ipAddress = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CLIENT_IP'] ) );
     } else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-        $ipAddress = $_SERVER['HTTP_X_FORWARDED_FOR'];
-    } else {
-        $ipAddress = $_SERVER['REMOTE_ADDR'];
+        $ipAddress = sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) );
+    } else if (!empty($_SERVER['REMOTE_ADDR'])) {
+        $ipAddress = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
     }
 
@@ -31 +36 @@
 }
 
-function jtg_search_type_4_shortcode($atts) {
+function wppd_search_type_4_shortcode($atts) {
+    // Add nonce field to the form
+    $nonce = wp_create_nonce('property_search_nonce');
+    
     $resultsPage = get_permalink((int) get_option('search_results_page'));
     if (!get_option('search_results_page')) {
@@ -53 +61 @@
     $jtg_table_name = $wpdb->prefix . 'postmeta';
 
-    $termsType = get_terms('property_type', 'hide_empty=1');
+    // Sanitize and validate input parameters
+    $termsType = get_terms(['taxonomy' => 'property_type', 'hide_empty' => false]);
     $termsStatus = wp4pm_get_meta_values('property_status');
-    $counties = $wpdb->get_results("SELECT DISTINCT meta_value from $jtg_table_name where meta_key='county' ORDER BY meta_value ASC");
-    $max_price_in_db = $wpdb->get_results("SELECT max(cast(meta_value as unsigned)) as meta_value FROM $jtg_table_name WHERE meta_key='price'");
-
-    /**
-     * Get search form builder options
-     */
-    $searchFieldGroup = (int) get_option('search_field_group');
-    $searchFieldType = (int) get_option('search_field_type');
-    $searchFieldStatus = (int) get_option('search_field_status');
-    $searchFieldStatusGroup = (int) get_option('search_field_status_group');
-    $searchFieldPrice = (int) get_option('search_field_price');
-    $searchFieldBeds = (int) get_option('search_field_beds');
-    $searchFieldBaths = (int) get_option('search_field_baths');
-    $searchFieldKeyword = (int) get_option('search_field_keyword');
-
-    $searchFieldLocation = (int) get_option('search_field_location');
-    $searchFieldMultiType = (int) get_option('search_field_multitype');
-
-    $searchFieldFeatures = (int) get_option('search_field_features');
-
+    // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Distinct counties and max price for search form options; prepared, read-only.
+    $counties = $wpdb->get_results($wpdb->prepare("SELECT DISTINCT meta_value FROM {$wpdb->prefix}postmeta WHERE meta_key = %s ORDER BY meta_value ASC", 'county'));
+    $max_price_in_db = $wpdb->get_results($wpdb->prepare("SELECT max(cast(meta_value as unsigned)) as meta_value FROM {$wpdb->prefix}postmeta WHERE meta_key = %s", 'price'));
+    // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+
+    // Sanitize search field options
+    $searchFieldGroup = absint(get_option('search_field_group'));
+    $searchFieldType = absint(get_option('search_field_type'));
+    $searchFieldStatus = absint(get_option('search_field_status'));
+    $searchFieldStatusGroup = absint(get_option('search_field_status_group'));
+    $searchFieldPrice = absint(get_option('search_field_price'));
+    $searchFieldBeds = absint(get_option('search_field_beds'));
+    $searchFieldBaths = absint(get_option('search_field_baths'));
+    $searchFieldKeyword = absint(get_option('search_field_keyword'));
+    $searchFieldLocation = absint(get_option('search_field_location'));
+    $searchFieldMultiType = absint(get_option('search_field_multitype'));
+    $searchFieldFeatures = absint(get_option('search_field_features'));
+
+    // Read-only GET params to pre-fill form defaults (e.g. from search results URL); no state change — nonce not required.
+    // phpcs:disable WordPress.Security.NonceVerification.Recommended
     if ($searchFieldGroup === 1 && (string) $show_type !== 'no') {
-        $checkedGroupType = (isset($_GET['group_type'])) ? sanitize_text_field($_GET['group_type']) : 'pm_residential';
+        $checkedGroupType = (isset($_GET['group_type'])) ? sanitize_text_field( wp_unslash( $_GET['group_type'] ) ) : 'pm_residential';
 
         if ((string) $default_type !== '') {
@@ -85 +94 @@
             <div class="property-group-switch">
                 <input type="radio" id="pm_residential" name="group_type" value="pm_residential" ' . checked($checkedGroupType, 'pm_residential', false) . '>
-                <label for="pm_residential">Residential</label>
+                <label for="pm_residential">' . esc_html__('Residential', 'property-drive') . '</label>
 
                 <input type="radio" id="pm_commercial" name="group_type" value="pm_commercial" ' . checked($checkedGroupType, 'pm_commercial', false) . '>
-                <label for="pm_commercial">Commercial</label>';
+                <label for="pm_commercial">' . esc_html__('Commercial', 'property-drive') . '</label>';
 
                 if ((string) $land === 'yes') {
                     $show .= '<input type="radio" id="pm_land" name="group_type" value="pm_land" ' . checked($checkedGroupType, 'pm_land', false) . '>
-                    <label for="pm_land">Land</label>';
+                    <label for="pm_land">' . esc_html__('Land', 'property-drive') . '</label>';
                 }
             $show .= '</div>
@@ -101 +110 @@
 
     if ($searchFieldStatusGroup === 1) {
-        $checkedStatusGroupType = (isset($_GET['property_status'])) ? sanitize_text_field($_GET['property_status']) : 'For Sale';
+        $checkedStatusGroupType = (isset($_GET['property_status'])) ? sanitize_text_field( wp_unslash( $_GET['property_status'] ) ) : 'For Sale';
 
         if ((string) $default_status !== '') {
@@ -124 +133 @@
     }
     if ($searchFieldType === 1) {
-        $searchString['type'] = '<select name="property_type" id="property_type_select" class="wp4pm-flex-item advanced-search-trigger" aria-label="Property Type">
-            <option value="">Any Property Type</option>';
+        $searchString['type'] = '<select name="property_type" id="property_type_select" class="wp4pm-flex-item advanced-search-trigger" aria-label="' . esc_attr__('Property Type', 'property-drive') . '">
+            <option value="">' . esc_html__('Any Property Type', 'property-drive') . '</option>';
 
             foreach ($termsType as $row) {
-                $searchString['type'] .= '<option value="'. $row->slug .'">' . $row->name . '</option>';
+                $searchString['type'] .= '<option value="' . esc_attr($row->slug) . '">' . esc_html($row->name) . '</option>';
             }
 
@@ -134 +143 @@
     }
     if ($searchFieldFeatures === 1) {
-        $searchString['features'] = '<select name="f[]" id="property_features_select" class="wp4pm-flex-item" aria-label="Property Features" size="1" multiple>';
-
-            //foreach ($termsType as $row) {
-                //$searchString['features'] .= '<option value="'. $row->slug .'">' . $row->name . '</option>';
-                $searchString['features'] .= '<option value="">Swimming Pool</option>';
-                $searchString['features'] .= '<option value="">Garage</option>';
-                $searchString['features'] .= '<option value="">Garden</option>';
-            //}
+        $searchString['features'] = '<select name="f[]" id="property_features_select" class="wp4pm-flex-item" aria-label="' . esc_attr__('Property Features', 'property-drive') . '" size="1" multiple>';
+
+            $searchString['features'] .= '<option value="">' . esc_html__('Swimming Pool', 'property-drive') . '</option>';
+            $searchString['features'] .= '<option value="">' . esc_html__('Garage', 'property-drive') . '</option>';
+            $searchString['features'] .= '<option value="">' . esc_html__('Garden', 'property-drive') . '</option>';
 
         $searchString['features'] .= '</select>';
@@ -148 +154 @@
         $keywordPlaceholder = trim($keyword_placeholder);
 
-        $value = isset($_GET['property_keyword']) ? urldecode($_GET['property_keyword']) : '';
-        $searchString['keyword'] = '<input type="text" id="keyword" name="property_keyword" placeholder="' . $keywordPlaceholder . '" class="wp4pm-flex-item" value="' . $value . '" aria-label="Keyword">';
+        $keyword_raw = isset( $_GET['property_keyword'] ) ? sanitize_text_field( wp_unslash( $_GET['property_keyword'] ) ) : '';
+        $value = ! empty( $keyword_raw ) ? sanitize_text_field( urldecode( $keyword_raw ) ) : '';
+        $searchString['keyword'] = '<input type="text" id="keyword" name="property_keyword" placeholder="' . esc_attr($keywordPlaceholder) . '" class="wp4pm-flex-item" value="' . esc_attr($value) . '" aria-label="' . esc_attr__('Keyword', 'property-drive') . '">';
     }
     if ($searchFieldPrice === 1) {
         $searchString['price'] = '<div class="wp4pm-flex-item flex-container-nowrap">
-            <select name="min_price" id="min_price" aria-label="Minimum Price">
-                <option value="" selected disabled>Min Price</option>
+            <select name="min_price" id="min_price" aria-label="' . esc_attr__('Minimum Price', 'property-drive') . '">
+                <option value="" selected disabled>' . esc_html__('Min Price', 'property-drive') . '</option>
                 <option value="10000">10,000</option>
                 <option value="20000">20,000</option>
@@ -165 +172 @@
                 <option value="500000">500,000</option>
             </select>
-            <select name="max_price" id="max_price" aria-label="Maximum Price">
-                <option value="" selected disabled>Max Price</option>
+            <select name="max_price" id="max_price" aria-label="' . esc_attr__('Maximum Price', 'property-drive') . '">
+                <option value="" selected disabled>' . esc_html__('Max Price', 'property-drive') . '</option>
                 <option value="10000">10,000</option>
                 <option value="20000">20,000</option>
@@ -186 +193 @@
     }
     if ($searchFieldStatus === 1) {
-        $searchString['status'] = '<select id="property_status" name="property_status" class="wp4pm-flex-item" aria-label="Property Status">
-            <option value="" selected>Any Property Status</option>';
+        $searchString['status'] = '<select id="property_status" name="property_status" class="wp4pm-flex-item" aria-label="' . esc_attr__('Property Status', 'property-drive') . '">
+            <option value="" selected>' . esc_html__('Any Property Status', 'property-drive') . '</option>';
 
             foreach ($termsStatus as $row) {
-                $searchString['status'] .= '<option>' . $row . '</option>';
+                $searchString['status'] .= '<option>' . esc_html($row) . '</option>';
             }
         $searchString['status'] .= '</select>';
     }
     if ($searchFieldBeds === 1) {
-        $searchString['beds'] = '<select id="bedrooms" name="beds" class="wp4pm-flex-item" aria-label="Bedrooms">
-            <option value="" disabled selected>Select Bedrooms</option>
+        $searchString['beds'] = '<select id="bedrooms" name="beds" class="wp4pm-flex-item" aria-label="' . esc_attr__('Bedrooms', 'property-drive') . '">
+            <option value="" disabled selected>' . esc_html__('Select Bedrooms', 'property-drive') . '</option>
             <option value="1">1+</option>
             <option value="2">2+</option>
@@ -208 +215 @@
     }
     if ($searchFieldBaths === 1) {
-        $searchString['baths'] = '<select id="bathrooms" name="baths" class="wp4pm-flex-item" aria-label="Bathrooms">
-            <option value="" disabled selected>Select Bathrooms</option>
+        $searchString['baths'] = '<select id="bathrooms" name="baths" class="wp4pm-flex-item" aria-label="' . esc_attr__('Bathrooms', 'property-drive') . '">
+            <option value="" disabled selected>' . esc_html__('Select Bathrooms', 'property-drive') . '</option>
             <option value="1">1+</option>
             <option value="2">2+</option>
@@ -338 +345 @@
         $searchString['multitype'] = $string;
     }
+    // phpcs:enable WordPress.Security.NonceVerification.Recommended
 
     /**
      * Build search form
      */
-    $out = '<form id="wp4pm-search" class="wp4pm-' . $layout . '" method="get" action="' . $results . '">
-        <input type="hidden" id="wp4pm-ip-address" value="' . wp4pm_get_pd_user_ip() . '">
+    $out = '<form id="wp4pm-search" class="wp4pm-' . esc_attr($layout) . '" method="get" action="' . esc_url($results) . '">
+        <input type="hidden" id="wp4pm-ip-address" value="' . esc_attr(wp4pm_get_pd_user_ip()) . '">
+        <input type="hidden" name="_wpnonce" value="' . esc_attr($nonce) . '">
         <div class="wp4pm-search-progress-wrap">
             <div class="wp4pm-search-progress"></div>
@@ -349 +358 @@
         <div class="wp4pm wp4pm-flex">';
 
-            $searchFieldArray = explode('|', (string) get_option('search_field_array'));
+            $searchFieldArray = array_map('sanitize_text_field', explode('|', (string) get_option('search_field_array')));
             foreach ($searchFieldArray as $searchFieldItem) {
                 if (isset($searchString[$searchFieldItem])) {
@@ -356 +365 @@
             }
 
-            $out .= '<button type="submit" class="wp4pm-flex-item wp4pm-btn-primary"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="search" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-search fa-w-16 fa-fw"><path fill="currentColor" d="M505 442.7L405.3 343c-4.5-4.5-10.6-7-17-7H372c27.6-35.3 44-79.7 44-128C416 93.1 322.9 0 208 0S0 93.1 0 208s93.1 208 208 208c48.3 0 92.7-16.4 128-44v16.3c0 6.4 2.5 12.5 7 17l99.7 99.7c9.4 9.4 24.6 9.4 33.9 0l28.3-28.3c9.4-9.4 9.4-24.6.1-34zM208 336c-70.7 0-128-57.2-128-128 0-70.7 57.2-128 128-128 70.7 0 128 57.2 128 128 0 70.7-57.2 128-128 128z" class=""></path></svg> Search</button>
+            $out .= '<button type="submit" class="wp4pm-flex-item wp4pm-btn-primary"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="search" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-search fa-w-16 fa-fw"><path fill="currentColor" d="M505 442.7L405.3 343c-4.5-4.5-10.6-7-17-7H372c27.6-35.3 44-79.7 44-128C416 93.1 322.9 0 208 0S0 93.1 0 208s93.1 208 208 208c48.3 0 92.7-16.4 128-44v16.3c0 6.4 2.5 12.5 7 17l99.7 99.7c9.4 9.4 24.6 9.4 33.9 0l28.3-28.3c9.4-9.4 9.4-24.6.1-34zM208 336c-70.7 0-128-57.2-128-128 0-70.7 57.2-128 128-128 70.7 0 128 57.2 128 128 0 70.7-57.2 128-128 128z" class=""></path></svg> ' . esc_html__('Search', 'property-drive') . '</button>
         </div>
         <div id="wp4pm-status"></div>
@@ -363 +372 @@
     return $out;
 }
-add_shortcode('jtg_search_type_4', 'jtg_search_type_4_shortcode');
-add_shortcode('search_form', 'jtg_search_type_4_shortcode');
-add_shortcode('property-search', 'jtg_search_type_4_shortcode');
+add_shortcode('jtg_search_type_4', 'wppd_search_type_4_shortcode');
+add_shortcode('search_form', 'wppd_search_type_4_shortcode');
+add_shortcode('property-search', 'wppd_search_type_4_shortcode');

property-drive/trunk/templates/part-sidebar-classic.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 function wp4pm_get_sidebar_classic($propertyId, $propertyDetails) {
     $agentEmailAddress = get_option('agency_email');
@@ -35 +39 @@
     $out .= '<div class="sidebar-section sidebar-sharing">
         <div id="share-buttons">';
-            $out .= get_sharing_buttons($propertyId);
+            $out .= wppd_get_sharing_buttons($propertyId);
         $out .= '</div>
     </div>';

property-drive/trunk/templates/single-property.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 get_header();
 
@@ -6 +10 @@
 while ( have_posts() ) {
     the_post();
-    $property_id = (int) get_the_ID();
-
-    wp4pm_update_property_attachments( $property_id ); ?>
-
-    <article id="pd-property-<?php echo esc_attr( $property_id ); ?>" <?php post_class( 'pid-' . esc_attr( $property_id ) ); ?> data-pid="<?php echo esc_attr( $property_id ); ?>">
+
+    $wppd_property_id = (int) get_the_ID();
+
+    wp4pm_update_property_attachments( $wppd_property_id ); ?>
+
+    <article id="pd-property-<?php echo esc_attr( $wppd_property_id ); ?>" <?php post_class( 'pid-' . esc_attr( $wppd_property_id ) ); ?> data-pid="<?php echo esc_attr( $wppd_property_id ); ?>">
         <?php
-        $image_array = get_post_meta( $property_id, 'detail_images_array', true );
-        $image_array = array_map( 'trim', explode( ',', $image_array ) );
-        $image_array = array_filter( $image_array );
-
-        if ( count( $image_array ) > 0 ) {
-            $cinematic_image_uri = preg_replace( '#&h=.*&#', '&h=1440&', $image_array[0] );
-            $cinematic_image_uri = preg_replace( '#&w=.*&#', '&w=1920&', $cinematic_image_uri );
+        $wppd_image_array = get_post_meta( $wppd_property_id, 'detail_images_array', true );
+        $wppd_image_array = array_map( 'trim', explode( ',', $wppd_image_array ) );
+        $wppd_image_array = array_filter( $wppd_image_array );
+
+        if ( count( $wppd_image_array ) > 0 ) {
+            $wppd_cinematic_image_uri = preg_replace( '#&h=.*&#', '&h=1440&', $wppd_image_array[0] );
+            $wppd_cinematic_image_uri = preg_replace( '#&w=.*&#', '&w=1920&', $wppd_cinematic_image_uri );
         } else {
-            $cinematic_image_uri = get_the_post_thumbnail_url( $property_id );
+            $wppd_cinematic_image_uri = get_the_post_thumbnail_url( $wppd_property_id );
         }
 
-        $property_details = get_post_meta( $property_id );
-        $property_type    = get_the_terms( $property_id, 'property_type' );
-        $property_status  = get_post_meta( $property_id, 'property_status', true );
-
-        $property_area = get_the_terms( $property_id, 'property_area' );
-        $property_area = ( $property_area ) ? $property_area[0]->name : '';
-
-        if ( (int) get_option( 'inactive_not_clickable' ) === 1 && ( sanitize_title( $property_status ) === 'sold' || sanitize_title( $property_status ) === 'has-been-let' ) ) {
+        $wppd_property_details = get_post_meta( $wppd_property_id );
+        $wppd_property_type    = get_the_terms( $wppd_property_id, 'property_type' );
+        $wppd_property_status  = get_post_meta( $wppd_property_id, 'property_status', true );
+
+        $wppd_property_area = get_the_terms( $wppd_property_id, 'property_area' );
+        $wppd_property_area = ( $wppd_property_area ) ? $wppd_property_area[0]->name : '';
+
+        // Validate property status
+        $wppd_property_status = sanitize_text_field( $wppd_property_status );
+        $wppd_is_inactive = (int) get_option( 'inactive_not_clickable' ) === 1 && 
+                      (sanitize_title( $wppd_property_status ) === 'sold' || sanitize_title( $wppd_property_status ) === 'has-been-let');
+
+        if ( $wppd_is_inactive ) {
             echo '<div class="grid-wrap grid-single-property grid-single-property--not-available" itemscope itemtype="http://schema.org/Place">
-                <h2>Property not available.</h2>
+                <h2>' . esc_html__( 'Property not available.', 'property-drive' ) . '</h2>
             </div>';
 
@@ -38 +48 @@
         }
 
-        // Build the Favourite action string
-        $favourite_string = '';
-        if ( (int) get_option( 'allow_favourites' ) === 1 ) {
-            $favourite_string = '<span class="pd-box-favourite" data-property-id="' . $property_id . '" tooltip="Save property" flow="right"></span>';
-        }
-
         // Build the title string
-        $property_title_string = get_the_title() . $favourite_string;
+        $wppd_property_title = get_the_title();
 
         // Generate priceValidUntil
-        $date = new DateTime( $post->post_date );
-        $date->modify( '+90 day' );
-        $price_valid_until = $date->format( 'Y-m-d' );
+        $wppd_date = new DateTime( $post->post_date );
+        $wppd_date->modify( '+90 day' );
+        $wppd_price_valid_until = $wppd_date->format( 'Y-m-d' );
         ?>
-        <div id="single-hero-image" data-src="<?php echo esc_url( $cinematic_image_uri ); ?>"></div>
+        <div id="single-hero-image" data-src="<?php echo esc_url( $wppd_cinematic_image_uri ); ?>"></div>
 
         <script type="application/ld+json">
@@ -61 +65 @@
                 "@type": "PostalAddress",
                 "@context": "http://schema.org",
-                "streetAddress": "<?php echo esc_html( get_the_title() ); ?>",
-                "addressLocality": "<?php echo esc_html( $property_area ); ?>",
-                "addressRegion": "<?php echo esc_html( $property_area ); ?>"
+                "streetAddress": <?php echo wp_json_encode(get_the_title()); ?>,
+                "addressLocality": <?php echo wp_json_encode($wppd_property_area); ?>,
+                "addressRegion": <?php echo wp_json_encode($wppd_property_area); ?>
             },
             "geo": {
                 "@type": "GeoCoordinates",
                 "@context": "http://schema.org",
-                "latitude": <?php echo floatval( $property_details['latitude'][0] ); ?>,
-                "longitude": <?php echo floatval( $property_details['longitude'][0] ); ?>
+                "latitude": <?php echo floatval($wppd_property_details['latitude'][0] ?? 0); ?>,
+                "longitude": <?php echo floatval($wppd_property_details['longitude'][0] ?? 0); ?>
             },
-            "url": "<?php echo esc_url( get_permalink() ); ?>"
+            "url": <?php echo wp_json_encode(get_permalink()); ?>
         }
         </script>
@@ -78 +82 @@
             "@context": "http://schema.org",
             "@type": "Product",
-            "name": "<?php echo esc_html( get_the_title() ); ?>",
-            "image": "<?php echo esc_url( $cinematic_image_uri ); ?>",
+            "name": <?php echo wp_json_encode(get_the_title()); ?>,
+            "image": <?php echo wp_json_encode($wppd_cinematic_image_uri); ?>,
             "offers": {
                 "@type": "Offer",
                 "priceCurrency": "EUR",
                 <?php
-                if ( (int) $property_details['price'][0] !== '' && (int) $property_details['price'][0] > 0 ) {
-                    echo '"price": "' . floatval( $property_details['price'][0] ) . '",' . "\n";
+                if (isset($wppd_property_details['price'][0]) && (int) $wppd_property_details['price'][0] !== '' && (int) $wppd_property_details['price'][0] > 0) {
+                    echo '"price": "' . floatval($wppd_property_details['price'][0]) . '",' . "\n";
                 }
                 ?>
-                "validFrom": "<?php echo get_the_date( 'Y-m-d' ); ?>",
-                "priceValidUntil": "<?php echo esc_html( $price_valid_until ); ?>",
+                "validFrom": <?php echo wp_json_encode(get_the_date('Y-m-d')); ?>,
+                "priceValidUntil": <?php echo wp_json_encode($wppd_price_valid_until); ?>,
                 "availability": "http://schema.org/InStock",
-                "url": "<?php echo esc_url( get_permalink() ); ?>",
+                "url": <?php echo wp_json_encode(get_permalink()); ?>,
                 "seller": {
                     "@type": "Organization",
-                    "name": "
-                    <?php
-                    $wp_seo_titles = get_option( 'wpseo_titles' );
-                    echo esc_html( $wp_seo_titles['company_name'] );
-                    ?>
-                    "
+                    "name": <?php echo wp_json_encode($wp_seo_titles['company_name'] ?? ''); ?>
                 }
             },
-            "description": "<?php echo esc_html( wp_strip_tags( get_the_excerpt() ) ); ?>"
+            "description": <?php echo wp_json_encode(wp_strip_tags(get_the_excerpt())); ?>
         }
         </script>
 
-        <div id="single-property-container" data-property-id="<?php echo esc_attr( $property_id ); ?>"></div>
+        <div id="single-property-container" data-property-id="<?php echo esc_attr( $wppd_property_id ); ?>"></div>
 
         <div class="grid-wrap grid-single-property" itemscope itemtype="http://schema.org/Place">
             <div class="print-view">
-                <p><img src="<?php echo esc_url( wppd_get_thumbnail_url( $property_id ) ); ?>" alt="">
-                <h2 class="single-property-title"><?php echo wp_kses_post( $property_title_string ); ?></h2>
+                <p><img src="<?php echo esc_url( wppd_get_thumbnail_url( $wppd_property_id ) ); ?>" alt="<?php echo esc_attr__( 'Property Image', 'property-drive' ); ?>">
+                <h2 class="single-property-title"><?php echo wp_kses_post( $wppd_property_title ); ?></h2>
             </div>
             <?php
             // Get property template
-            $property_template = (int) get_option( 'cinematic_overlay' );
-            if ( get_post_meta( $property_id, '_property_template', true ) !== '' && (int) get_post_meta( $property_id, '_property_template', true ) !== 999 ) {
-                $property_template = (int) $property_details['_property_template'][0];
-                $property_template = ( $property_template !== 'none' ) ? (int) $property_template : (int) get_option( 'cinematic_overlay' );
+            $wppd_property_template = (int) get_option( 'cinematic_overlay' );
+            if ( get_post_meta( $wppd_property_id, '_property_template', true ) !== '' && (int) get_post_meta( $wppd_property_id, '_property_template', true ) !== 999 ) {
+                $wppd_property_template = (int) $wppd_property_details['_property_template'][0];
+                $wppd_property_template = ( $wppd_property_template !== 'none' ) ? (int) $wppd_property_template : (int) get_option( 'cinematic_overlay' );
             }
 
-            $agent_email_address = get_option( 'agency_email' );
-            if ( $property_details['agent_email'][0] ) {
-                $agent_email_address = $property_details['agent_email'][0];
+            $wppd_agent_email_address = get_option( 'agency_email' );
+            if ( $wppd_property_details['agent_email'][0] ) {
+                $wppd_agent_email_address = $wppd_property_details['agent_email'][0];
             }
 
-            if ( $property_template === 2 ) {
-                echo '<div class="supernova-fullwidth supernova-property-hero" style="background: url(' . esc_url( wppd_get_thumbnail_url( $property_id ) ) . ') no-repeat center center; background-size: cover; margin-top: -128px;">
-                    <h1 class="single-property-title grid-wrap overlaid">' . wp_kses_post( $property_title_string ) . '</h1>
+            if ( $wppd_property_template === 2 ) {
+                echo '<div class="supernova-fullwidth supernova-property-hero" style="background: url(' . esc_url( wppd_get_thumbnail_url( $wppd_property_id ) ) . ') no-repeat center center; background-size: cover; margin-top: -128px;">
+                    <h1 class="single-property-title grid-wrap overlaid">' . wp_kses_post( $wppd_property_title ) . '</h1>
                 </div>
                 <div class="pd-section-breakdown">
                     <ul class="grid-wrap">
-                        <li><a href="#"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="arrow-up" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512" class="svg-inline--fa fa-arrow-up fa-w-14 fa-fw"><path fill="currentColor" d="M34.9 289.5l-22.2-22.2c-9.4-9.4-9.4-24.6 0-33.9L207 39c9.4-9.4 24.6-9.4 33.9 0l194.3 194.3c9.4 9.4 9.4 24.6 0 33.9L413 289.4c-9.5 9.5-25 9.3-34.3-.4L264 168.6V456c0 13.3-10.7 24-24 24h-32c-13.3 0-24-10.7-24-24V168.6L69.2 289.1c-9.3 9.8-24.8 10-34.3.4z" class=""></path></svg> Top</a></li>
-                        <li><a href="#property-page-slider"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="images" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 576 512" class="svg-inline--fa fa-images fa-w-18 fa-fw"><path fill="currentColor" d="M480 416v16c0 26.51-21.49 48-48 48H48c-26.51 0-48-21.49-48-48V176c0-26.51 21.49-48 48-48h16v208c0 44.112 35.888 80 80 80h336zm96-80V80c0-26.51-21.49-48-48-48H144c-26.51 0-48 21.49-48 48v256c0 26.51 21.49 48 48 48h384c26.51 0 48-21.49 48-48zM256 128c0 26.51-21.49 48-48 48s-48-21.49-48-48 21.49-48 48-48 48 21.49 48 48zm-96 144l55.515-55.515c4.686-4.686 12.284-4.686 16.971 0L272 256l135.515-135.515c4.686-4.686 12.284-4.686 16.971 0L512 208v112H160v-48z" class=""></path></svg> Gallery</a></li>
-                        <li><a href="#pd-property-page-description"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="file-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-file-alt fa-w-12 fa-fw"><path fill="currentColor" d="M224 136V0H24C10.7 0 0 10.7 0 24v464c0 13.3 10.7 24 24 24h336c13.3 0 24-10.7 24-24V160H248c-13.2 0-24-10.8-24-24zm64 236c0 6.6-5.4 12-12 12H108c-6.6 0-12-5.4-12-12v-8c0-6.6 5.4-12 12-12h168c6.6 0 12 5.4 12 12v8zm0-64c0 6.6-5.4 12-12 12H108c-6.6 0-12-5.4-12-12v-8c0-6.6 5.4-12 12-12h168c6.6 0 12 5.4 12 12v8zm0-72v8c0 6.6-5.4 12-12 12H108c-6.6 0-12-5.4-12-12v-8c0-6.6 5.4-12 12-12h168c6.6 0 12 5.4 12 12zm96-114.1v6.1H256V0h6.1c6.4 0 12.5 2.5 17 7l97.9 98c4.5 4.5 7 10.6 7 16.9z" class=""></path></svg> Description</a></li>
-                        <li><a href="#listing-map"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="map-marker-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-map-marker-alt fa-w-12 fa-fw"><path fill="currentColor" d="M172.268 501.67C26.97 291.031 0 269.413 0 192 0 85.961 85.961 0 192 0s192 85.961 192 192c0 77.413-26.97 99.031-172.268 309.67-9.535 13.774-29.93 13.773-39.464 0zM192 272c44.183 0 80-35.817 80-80s-35.817-80-80-80-80 35.817-80 80 35.817 80 80 80z" class=""></path></svg> Location</a></li>
+                        <li><a href="#"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="arrow-up" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512" class="svg-inline--fa fa-arrow-up fa-w-14 fa-fw"><path fill="currentColor" d="M34.9 289.5l-22.2-22.2c-9.4-9.4-9.4-24.6 0-33.9L207 39c9.4-9.4 24.6-9.4 33.9 0l194.3 194.3c9.4 9.4 9.4 24.6 0 33.9L413 289.4c-9.5 9.5-25 9.3-34.3-.4L264 168.6V456c0 13.3-10.7 24-24 24h-32c-13.3 0-24-10.7-24-24V168.6L69.2 289.1c-9.3 9.8-24.8 10-34.3.4z" class=""></path></svg> ' . esc_html__( 'Top', 'property-drive' ) . '</a></li>
+                        <li><a href="#property-page-slider"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="images" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 576 512" class="svg-inline--fa fa-images fa-w-18 fa-fw"><path fill="currentColor" d="M480 416v16c0 26.51-21.49 48-48 48H48c-26.51 0-48-21.49-48-48V176c0-26.51 21.49-48 48-48h16v208c0 44.112 35.888 80 80 80h336zm96-80V80c0-26.51-21.49-48-48-48H144c-26.51 0-48 21.49-48 48v256c0 26.51 21.49 48 48 48h384c26.51 0 48-21.49 48-48zM256 128c0 26.51-21.49 48-48 48s-48-21.49-48-48 21.49-48 48-48 48 21.49 48 48zm-96 144l55.515-55.515c4.686-4.686 12.284-4.686 16.971 0L272 256l135.515-135.515c4.686-4.686 12.284-4.686 16.971 0L512 208v112H160v-48z" class=""></path></svg> ' . esc_html__( 'Gallery', 'property-drive' ) . '</a></li>
+                        <li><a href="#pd-property-page-description"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="file-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-file-alt fa-w-12 fa-fw"><path fill="currentColor" d="M224 136V0H24C10.7 0 0 10.7 0 24v464c0 13.3 10.7 24 24 24h336c13.3 0 24-10.7 24-24V160H248c-13.2 0-24-10.8-24-24zm64 236c0 6.6-5.4 12-12 12H108c-6.6 0-12-5.4-12-12v-8c0-6.6 5.4-12 12-12h168c6.6 0 12 5.4 12 12v8zm0-64c0 6.6-5.4 12-12 12H108c-6.6 0-12-5.4-12-12v-8c0-6.6 5.4-12 12-12h168c6.6 0 12 5.4 12 12v8zm0-72v8c0 6.6-5.4 12-12 12H108c-6.6 0-12-5.4-12-12v-8c0-6.6 5.4-12 12-12h168c6.6 0 12 5.4 12 12zm96-114.1v6.1H256V0h6.1c6.4 0 12.5 2.5 17 7l97.9 98c4.5 4.5 7 10.6 7 16.9z" class=""></path></svg> ' . esc_html__( 'Description', 'property-drive' ) . '</a></li>
+                        <li><a href="#listing-map"><svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="map-marker-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-map-marker-alt fa-w-12 fa-fw"><path fill="currentColor" d="M172.268 501.67C26.97 291.031 0 269.413 0 192 0 85.961 85.961 0 192 0s192 85.961 192 192c0 77.413-26.97 99.031-172.268 309.67-9.535 13.774-29.93 13.773-39.464 0zM192 272c44.183 0 80-35.817 80-80s-35.817-80-80-80-80 35.817-80 80 35.817 80 80 80z" class=""></path></svg> ' . esc_html__( 'Location', 'property-drive' ) . '</a></li>
                     </ul>
                 </div>';
-            } elseif ( $property_template === 3 ) {
+            } elseif ( $wppd_property_template === 3 ) {
                 /**
                  * Flickity (Sydney Gallery
                  */
-                wp4pm_show_flickity_gallery( $property_id );
-                echo '<h1 class="single-property-title">' . wp_kses_post( $property_title_string ) . '</h1>';
-            } elseif ( $property_template === 4 ) {
+                wp4pm_show_flickity_gallery( $wppd_property_id );
+                echo '<h1 class="single-property-title">' . wp_kses_post( $wppd_property_title ) . '</h1>';
+            } elseif ( $wppd_property_template === 4 ) {
                 /**
                  * Flickity (Parsley) Gallery
                  */
-                wp4pm_show_flickity_parsley_gallery( $property_id );
-                echo '<h1 class="single-property-title">' . wp_kses_post( $property_title_string ) . '</h1>';
-            } elseif ( $property_template === 1 ) {
-                echo '<h1 class="single-property-title">' . wp_kses_post( $property_title_string ) . '</h1>';
+                wp4pm_show_flickity_parsley_gallery( $wppd_property_id );
+                echo '<h1 class="single-property-title">' . wp_kses_post( $wppd_property_title ) . '</h1>';
+            } elseif ( $wppd_property_template === 1 ) {
+                echo '<h1 class="single-property-title">' . wp_kses_post( $wppd_property_title ) . '</h1>';
             } else {
-                echo '<h1 class="single-property-title">' . wp_kses_post( $property_title_string ) . '</h1>';
+                echo '<h1 class="single-property-title">' . wp_kses_post( $wppd_property_title ) . '</h1>';
             }
 
@@ -169 +168 @@
                         <?php
                         // Only show price if property is not sold or sale agreed
-                        if ( ! in_array( $property_status, [ 'Sale Agreed', 'Sold', 'Let', 'Has Been Let' ] ) ) {
+                        if ( ! in_array( $wppd_property_status, [ 'Sale Agreed', 'Sold', 'Let', 'Has Been Let' ] ) ) {
                             ?>
                             <div class="grid-property-attribute grid-property-attribute-price flex-element">
-                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="euro-sign" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 320 512" class="svg-inline--fa fa-euro-sign fa-w-10 fa-fw"><path fill="currentColor" d="M310.706 413.765c-1.314-6.63-7.835-10.872-14.424-9.369-10.692 2.439-27.422 5.413-45.426 5.413-56.763 0-101.929-34.79-121.461-85.449h113.689a12 12 0 0 0 11.708-9.369l6.373-28.36c1.686-7.502-4.019-14.631-11.708-14.631H115.22c-1.21-14.328-1.414-28.287.137-42.245H261.95a12 12 0 0 0 11.723-9.434l6.512-29.755c1.638-7.484-4.061-14.566-11.723-14.566H130.184c20.633-44.991 62.69-75.03 117.619-75.03 14.486 0 28.564 2.25 37.851 4.145 6.216 1.268 12.347-2.498 14.002-8.623l11.991-44.368c1.822-6.741-2.465-13.616-9.326-14.917C290.217 34.912 270.71 32 249.635 32 152.451 32 74.03 92.252 45.075 176H12c-6.627 0-12 5.373-12 12v29.755c0 6.627 5.373 12 12 12h21.569c-1.009 13.607-1.181 29.287-.181 42.245H12c-6.627 0-12 5.373-12 12v28.36c0 6.627 5.373 12 12 12h30.114C67.139 414.692 145.264 480 249.635 480c26.301 0 48.562-4.544 61.101-7.788 6.167-1.595 10.027-7.708 8.788-13.957l-8.818-44.49z" class=""></path></svg><br><span>Price</span><br><em><?php echo esc_html( wp4pm_get_property_price( $property_id ) ); ?></em>
-                                <?php echo esc_html( wp4pm_get_property_price_term( $property_id ) ); ?>
+                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="euro-sign" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 320 512" class="svg-inline--fa fa-euro-sign fa-w-10 fa-fw"><path fill="currentColor" d="M310.706 413.765c-1.314-6.63-7.835-10.872-14.424-9.369-10.692 2.439-27.422 5.413-45.426 5.413-56.763 0-101.929-34.79-121.461-85.449h113.689a12 12 0 0 0 11.708-9.369l6.373-28.36c1.686-7.502-4.019-14.631-11.708-14.631H115.22c-1.21-14.328-1.414-28.287.137-42.245H261.95a12 12 0 0 0 11.723-9.434l6.512-29.755c1.638-7.484-4.061-14.566-11.723-14.566H130.184c20.633-44.991 62.69-75.03 117.619-75.03 14.486 0 28.564 2.25 37.851 4.145 6.216 1.268 12.347-2.498 14.002-8.623l11.991-44.368c1.822-6.741-2.465-13.616-9.326-14.917C290.217 34.912 270.71 32 249.635 32 152.451 32 74.03 92.252 45.075 176H12c-6.627 0-12 5.373-12 12v29.755c0 6.627 5.373 12 12 12h21.569c-1.009 13.607-1.181 29.287-.181 42.245H12c-6.627 0-12 5.373-12 12v28.36c0 6.627 5.373 12 12 12h30.114C67.139 414.692 145.264 480 249.635 480c26.301 0 48.562-4.544 61.101-7.788 6.167-1.595 10.027-7.708 8.788-13.957l-8.818-44.49z" class=""></path></svg><br><span>Price</span><br><em><?php echo esc_html( wp4pm_get_property_price( $wppd_property_id ) ); ?></em>
+                                <?php echo esc_html( wp4pm_get_property_price_term( $wppd_property_id ) ); ?>
                             </div>
                         <?php } ?>
 
                         <div class="grid-property-attribute grid-property-attribute-name flex-element">
-                            <?php if ( $property_type[0]->name === 'Parking Space' ) { ?>
+                            <?php if ( $wppd_property_type[0]->name === 'Parking Space' ) { ?>
                                 <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="parking" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512" class="svg-inline--fa fa-parking fa-w-14 fa-fw"><path fill="currentColor" d="M400 32H48C21.5 32 0 53.5 0 80v352c0 26.5 21.5 48 48 48h352c26.5 0 48-21.5 48-48V80c0-26.5-21.5-48-48-48zM240 320h-48v48c0 8.8-7.2 16-16 16h-32c-8.8 0-16-7.2-16-16V144c0-8.8 7.2-16 16-16h96c52.9 0 96 43.1 96 96s-43.1 96-96 96zm0-128h-48v64h48c17.6 0 32-14.4 32-32s-14.4-32-32-32z" class=""></path></svg>
                             <?php } else { ?>
@@ -185 +184 @@
                             <br><span>Type</span>
 
-                            <?php if ( $property_type[0]->name === 'Parking Space' ) { ?>
+                            <?php if ( $wppd_property_type[0]->name === 'Parking Space' ) { ?>
                                 <br><em>Parking Space</em>
-                            <?php } elseif ( (string) $property_details['property_market'][0] === 'New Developments' ) { ?>
+                            <?php } elseif ( (string) $wppd_property_details['property_market'][0] === 'New Developments' ) { ?>
                                 <br><em>New Development</em>
                             <?php } else { ?>
                                 <br><em>
                                 <?php
-                                if ( ! empty( wp4pm_get_property_living_type( $property_id ) ) ) {
-                                    echo esc_html( wp4pm_get_property_living_type( $property_id ) ) . ' '; }
+                                if ( ! empty( wp4pm_get_property_living_type( $wppd_property_id ) ) ) {
+                                    echo esc_html( wp4pm_get_property_living_type( $wppd_property_id ) ) . ' '; }
                                 ?>
-                                <?php echo esc_html( $property_type[0]->name ); ?></em>
+                                <?php echo esc_html( $wppd_property_type[0]->name ); ?></em>
                             <?php } ?>
                         </div>
 
-                        <div class="grid-property-attribute grid-property-attribute-status grid-property-attribute-status-<?php echo esc_html( sanitize_title( $property_status ) ); ?> flex-element">
-                            <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="th" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-th fa-w-16 fa-fw"><path fill="currentColor" d="M149.333 56v80c0 13.255-10.745 24-24 24H24c-13.255 0-24-10.745-24-24V56c0-13.255 10.745-24 24-24h101.333c13.255 0 24 10.745 24 24zm181.334 240v-80c0-13.255-10.745-24-24-24H205.333c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24h101.333c13.256 0 24.001-10.745 24.001-24zm32-240v80c0 13.255 10.745 24 24 24H488c13.255 0 24-10.745 24-24V56c0-13.255-10.745-24-24-24H386.667c-13.255 0-24 10.745-24 24zm-32 80V56c0-13.255-10.745-24-24-24H205.333c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24h101.333c13.256 0 24.001-10.745 24.001-24zm-205.334 56H24c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24h101.333c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24zM0 376v80c0 13.255 10.745 24 24 24h101.333c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H24c-13.255 0-24 10.745-24 24zm386.667-56H488c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H386.667c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24zm0 160H488c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H386.667c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24zM181.333 376v80c0 13.255 10.745 24 24 24h101.333c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H205.333c-13.255 0-24 10.745-24 24z" class=""></path></svg><br><span>Status</span><br><em><?php echo esc_html( $property_status ); ?></em>
+                        <div class="grid-property-attribute grid-property-attribute-status grid-property-attribute-status-<?php echo esc_html( sanitize_title( $wppd_property_status ) ); ?> flex-element">
+                            <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="th" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-th fa-w-16 fa-fw"><path fill="currentColor" d="M149.333 56v80c0 13.255-10.745 24-24 24H24c-13.255 0-24-10.745-24-24V56c0-13.255 10.745-24 24-24h101.333c13.255 0 24 10.745 24 24zm181.334 240v-80c0-13.255-10.745-24-24-24H205.333c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24h101.333c13.256 0 24.001-10.745 24.001-24zm32-240v80c0 13.255 10.745 24 24 24H488c13.255 0 24-10.745 24-24V56c0-13.255-10.745-24-24-24H386.667c-13.255 0-24 10.745-24 24zm-32 80V56c0-13.255-10.745-24-24-24H205.333c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24h101.333c13.256 0 24.001-10.745 24.001-24zm-205.334 56H24c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24h101.333c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24zM0 376v80c0 13.255 10.745 24 24 24h101.333c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H24c-13.255 0-24 10.745-24 24zm386.667-56H488c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H386.667c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24zm0 160H488c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H386.667c-13.255 0-24 10.745-24 24v80c0 13.255 10.745 24 24 24zM181.333 376v80c0 13.255 10.745 24 24 24h101.333c13.255 0 24-10.745 24-24v-80c0-13.255-10.745-24-24-24H205.333c-13.255 0-24 10.745-24 24z" class=""></path></svg><br><span>Status</span><br><em><?php echo esc_html( $wppd_property_status ); ?></em>
                         </div>
 
-                        <?php if ( (int) wp4pm_get_property_bedrooms( $property_id ) > 0 || ( (string) $property_details['property_market'][0] === 'New Developments' && (int) getLinkedPropertiesBedroomRange( $property_details['linked_properties'][0] ) > 0 ) ) { ?>
+                        <?php if ( (int) wp4pm_get_property_bedrooms( $wppd_property_id ) > 0 || ( (string) $wppd_property_details['property_market'][0] === 'New Developments' && (int) wppd_get_linked_properties_bedroom_range( $wppd_property_details['linked_properties'][0] ) > 0 ) ) { ?>
                             <div class="grid-property-attribute grid-property-attribute-bedrooms flex-element">
-                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="bed" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 640 512" class="svg-inline--fa fa-bed fa-w-20 fa-fw"><path fill="currentColor" d="M176 256c44.11 0 80-35.89 80-80s-35.89-80-80-80-80 35.89-80 80 35.89 80 80 80zm352-128H304c-8.84 0-16 7.16-16 16v144H64V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v352c0 8.84 7.16 16 16 16h32c8.84 0 16-7.16 16-16v-48h512v48c0 8.84 7.16 16 16 16h32c8.84 0 16-7.16 16-16V240c0-61.86-50.14-112-112-112z" class=""></path></svg><br><span>BEDROOMS</span><br><em><?php echo esc_html( wp4pm_get_property_bedrooms( $property_id ) ); ?></em>
-                            </div>
-                        <?php } ?>
-
-                        <?php if ( (int) wp4pm_get_property_bathrooms( $property_id ) > 0 ) { ?>
+                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="bed" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 640 512" class="svg-inline--fa fa-bed fa-w-20 fa-fw"><path fill="currentColor" d="M176 256c44.11 0 80-35.89 80-80s-35.89-80-80-80-80 35.89-80 80 35.89 80 80 80zm352-128H304c-8.84 0-16 7.16-16 16v144H64V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v352c0 8.84 7.16 16 16 16h32c8.84 0 16-7.16 16-16v-48h512v48c0 8.84 7.16 16 16 16h32c8.84 0 16-7.16 16-16V240c0-61.86-50.14-112-112-112z" class=""></path></svg><br><span>BEDROOMS</span><br><em><?php echo esc_html( wp4pm_get_property_bedrooms( $wppd_property_id ) ); ?></em>
+                            </div>
+                        <?php } ?>
+
+                        <?php if ( (int) wp4pm_get_property_bathrooms( $wppd_property_id ) > 0 ) { ?>
                             <div class="grid-property-attribute grid-property-attribute-bathrooms flex-element">
-                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="bath" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-bath fa-w-16 fa-fw"><path fill="currentColor" d="M488 256H80V112c0-17.645 14.355-32 32-32 11.351 0 21.332 5.945 27.015 14.88-16.492 25.207-14.687 59.576 6.838 83.035-4.176 4.713-4.021 11.916.491 16.428l11.314 11.314c4.686 4.686 12.284 4.686 16.971 0l95.03-95.029c4.686-4.686 4.686-12.284 0-16.971l-11.314-11.314c-4.512-4.512-11.715-4.666-16.428-.491-17.949-16.469-42.294-21.429-64.178-15.365C163.281 45.667 139.212 32 112 32c-44.112 0-80 35.888-80 80v144h-8c-13.255 0-24 10.745-24 24v16c0 13.255 10.745 24 24 24h8v32c0 28.43 12.362 53.969 32 71.547V456c0 13.255 10.745 24 24 24h16c13.255 0 24-10.745 24-24v-8h256v8c0 13.255 10.745 24 24 24h16c13.255 0 24-10.745 24-24v-32.453c19.638-17.578 32-43.117 32-71.547v-32h8c13.255 0 24-10.745 24-24v-16c0-13.255-10.745-24-24-24z" class=""></path></svg><br><span>BATHROOMS</span><br><em><?php echo esc_html( wp4pm_get_property_bathrooms( $property_id ) ); ?></em>
-                            </div>
-                        <?php } ?>
-
-                        <?php if ( $property_type[0]->name !== 'Parking Space' && (string) $property_details['property_market'][0] !== 'New Developments' ) { ?>
+                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="bath" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-bath fa-w-16 fa-fw"><path fill="currentColor" d="M488 256H80V112c0-17.645 14.355-32 32-32 11.351 0 21.332 5.945 27.015 14.88-16.492 25.207-14.687 59.576 6.838 83.035-4.176 4.713-4.021 11.916.491 16.428l11.314 11.314c4.686 4.686 12.284 4.686 16.971 0l95.03-95.029c4.686-4.686 4.686-12.284 0-16.971l-11.314-11.314c-4.512-4.512-11.715-4.666-16.428-.491-17.949-16.469-42.294-21.429-64.178-15.365C163.281 45.667 139.212 32 112 32c-44.112 0-80 35.888-80 80v144h-8c-13.255 0-24 10.745-24 24v16c0 13.255 10.745 24 24 24h8v32c0 28.43 12.362 53.969 32 71.547V456c0 13.255 10.745 24 24 24h16c13.255 0 24-10.745 24-24v-8h256v8c0 13.255 10.745 24 24 24h16c13.255 0 24-10.745 24-24v-32.453c19.638-17.578 32-43.117 32-71.547v-32h8c13.255 0 24-10.745 24-24v-16c0-13.255-10.745-24-24-24z" class=""></path></svg><br><span>BATHROOMS</span><br><em><?php echo esc_html( wp4pm_get_property_bathrooms( $wppd_property_id ) ); ?></em>
+                            </div>
+                        <?php } ?>
+
+                        <?php if ( $wppd_property_type[0]->name !== 'Parking Space' && (string) $wppd_property_details['property_market'][0] !== 'New Developments' ) { ?>
                             <div class="grid-property-attribute grid-property-attribute-ber flex-element">
                                 <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="thermometer-empty" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 512" class="svg-inline--fa fa-thermometer-empty fa-w-8 fa-fw"><path fill="currentColor" d="M192 384c0 35.346-28.654 64-64 64s-64-28.654-64-64c0-35.346 28.654-64 64-64s64 28.654 64 64zm32-84.653c19.912 22.563 32 52.194 32 84.653 0 70.696-57.303 128-128 128-.299 0-.609-.001-.909-.003C56.789 511.509-.357 453.636.002 383.333.166 351.135 12.225 321.755 32 299.347V96c0-53.019 42.981-96 96-96s96 42.981 96 96v203.347zM208 384c0-34.339-19.37-52.19-32-66.502V96c0-26.467-21.533-48-48-48S80 69.533 80 96v221.498c-12.732 14.428-31.825 32.1-31.999 66.08-.224 43.876 35.563 80.116 79.423 80.42L128 464c44.112 0 80-35.888 80-80z" class=""></path></svg><br><span>BER</span><br>
-                                <?php echo wp_kses_post( wp4pm_get_property_ber( $property_id ) ); ?>
-                            </div>
-                        <?php } ?>
-
-                        <?php if ( isset( $property_details['brochure_1'] ) && $property_details['brochure_1'][0] != '' ) { ?>
+                                <?php echo wp_kses_post( wp4pm_get_property_ber( $wppd_property_id ) ); ?>
+                            </div>
+                        <?php } ?>
+
+                        <?php if ( isset( $wppd_property_details['brochure_1'] ) && $wppd_property_details['brochure_1'][0] != '' ) { ?>
                             <div class="grid-property-attribute grid-property-attribute-brochure flex-element">
-                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="file-pdf" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-file-pdf fa-w-12 fa-fw"><path fill="currentColor" d="M181.9 256.1c-5-16-4.9-46.9-2-46.9 8.4 0 7.6 36.9 2 46.9zm-1.7 47.2c-7.7 20.2-17.3 43.3-28.4 62.7 18.3-7 39-17.2 62.9-21.9-12.7-9.6-24.9-23.4-34.5-40.8zM86.1 428.1c0 .8 13.2-5.4 34.9-40.2-6.7 6.3-29.1 24.5-34.9 40.2zM248 160h136v328c0 13.3-10.7 24-24 24H24c-13.3 0-24-10.7-24-24V24C0 10.7 10.7 0 24 0h200v136c0 13.2 10.8 24 24 24zm-8 171.8c-20-12.2-33.3-29-42.7-53.8 4.5-18.5 11.6-46.6 6.2-64.2-4.7-29.4-42.4-26.5-47.8-6.8-5 18.3-.4 44.1 8.1 77-11.6 27.6-28.7 64.6-40.8 85.8-.1 0-.1.1-.2.1-27.1 13.9-73.6 44.5-54.5 68 5.6 6.9 16 10 21.5 10 17.9 0 35.7-18 61.1-61.8 25.8-8.5 54.1-19.1 79-23.2 21.7 11.8 47.1 19.5 64 19.5 29.2 0 31.2-32 19.7-43.4-13.9-13.6-54.3-9.7-73.6-7.2zM377 105L279 7c-4.5-4.5-10.6-7-17-7h-6v128h128v-6.1c0-6.3-2.5-12.4-7-16.9zm-74.1 255.3c4.1-2.7-2.5-11.9-42.8-9 37.1 15.8 42.8 9 42.8 9z" class=""></path></svg>
+                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="file-pdf" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-file-pdf fa-w-12 fa-fw"><path fill="currentColor" d="M181.9 256.1c-5-16-4.9-46.9-2-46.9 8.4 0 7.6 36.9 2 46.9zm-1.7 47.2c-7.7 20.2-17.3 43.3-28.4 62.7 18.3-7 39-17.2 62.9-21.9-12.7-9.6-24.9-23.4-23.4-34.5-40.8zM86.1 428.1c0 .8 13.2-5.4 34.9-40.2-6.7 6.3-29.1 24.5-34.9 40.2zM248 160h136v328c0 13.3-10.7 24-24 24H24c-13.3 0-24-10.7-24-24V24C0 10.7 10.7 0 24 0h200v136c0 13.2 10.8 24 24 24zm-8 171.8c-20-12.2-33.3-29-42.7-53.8 4.5-18.5 11.6-46.6 6.2-64.2-4.7-29.4-42.4-26.5-47.8-6.8-5 18.3-.4 44.1 8.1 77-11.6 27.6-28.7 64.6-40.8 85.8-.1 0-.1.1-.2.1-27.1 13.9-73.6 44.5-54.5 68 5.6 6.9 16 10 21.5 10 17.9 0 35.7-18 61.1-61.8 25.8-8.5 54.1-19.1 79-23.2 21.7 11.8 47.1 19.5 64 19.5 29.2 0 31.2-32 19.7-43.4-13.9-13.6-54.3-9.7-73.6-7.2zM377 105L279 7c-4.5-4.5-10.6-7-17-7h-6v128h128v-6.1c0-6.3-2.5-12.4-7-16.9zm-74.1 255.3c4.1-2.7-2.5-11.9-42.8-9 37.1 15.8 42.8 9 42.8 9z" class=""></path></svg>
                                 <br><span>Brochure</span>
 
-                                <?php if ( $property_details['brochure_1'][0] != '' && $property_details['brochure_2'][0] == '' ) { ?>
-                                    <br><a target="_blank" href="<?php echo esc_url( $property_details['brochure_1'][0] ); ?>">View Now</a>
+                                <?php if ( $wppd_property_details['brochure_1'][0] != '' && $wppd_property_details['brochure_2'][0] == '' ) { ?>
+                                    <br><a target="_blank" href="<?php echo esc_url( $wppd_property_details['brochure_1'][0] ); ?>">View Now</a>
                                 <?php } else { ?>
-                                    <br><a target="_blank" href="<?php echo esc_url( $property_details['brochure_1'][0] ); ?>">1</a>
-                                    <?php if ( isset( $property_details['brochure_2'][0] ) && $property_details['brochure_2'][0] !== '' ) { ?>
-                                        <a target="_blank" href="<?php echo esc_url( $property_details['brochure_2'][0] ); ?>">2</a>
+                                    <br><a target="_blank" href="<?php echo esc_url( $wppd_property_details['brochure_1'][0] ); ?>">1</a>
+                                    <?php if ( isset( $wppd_property_details['brochure_2'][0] ) && $wppd_property_details['brochure_2'][0] !== '' ) { ?>
+                                        <a target="_blank" href="<?php echo esc_url( $wppd_property_details['brochure_2'][0] ); ?>">2</a>
                                     <?php } ?>
-                                    <?php if ( isset( $property_details['brochure_3'][0] ) && $property_details['brochure_3'][0] !== '' ) { ?>
-                                        <a target="_blank" href="<?php echo esc_url( $property_details['brochure_3'][0] ); ?>">3</a>
+                                    <?php if ( isset( $wppd_property_details['brochure_3'][0] ) && $wppd_property_details['brochure_3'][0] !== '' ) { ?>
+                                        <a target="_blank" href="<?php echo esc_url( $wppd_property_details['brochure_3'][0] ); ?>">3</a>
                                     <?php } ?>
                                 <?php } ?>
@@ -241 +240 @@
                         <?php } ?>
 
-                        <?php if ( $property_details['property_size'][0] ) { ?>
+                        <?php if ( $wppd_property_details['property_size'][0] ) { ?>
                             <div class="grid-property-attribute grid-property-attribute-size flex-element">
-                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="arrows-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-arrows-alt fa-w-16 fa-fw"><path fill="currentColor" d="M352.201 425.775l-79.196 79.196c-9.373 9.373-24.568 9.373-33.941 0l-79.196-79.196c-15.119-15.119-4.411-40.971 16.971-40.97h51.162L228 284H127.196v51.162c0 21.382-25.851 32.09-40.971 16.971L7.029 272.937c-9.373-9.373-9.373-24.569 0-33.941L86.225 159.8c15.119-15.119 40.971-4.411 40.971 16.971V228H228V127.196h-51.23c-21.382 0-32.09-25.851-16.971-40.971l79.196-79.196c9.373-9.373 24.568-9.373 33.941 0l79.196 79.196c15.119 15.119 4.411 40.971-16.971 40.971h-51.162V228h100.804v-51.162c0-21.382 25.851-32.09 40.97-16.971l79.196 79.196c9.373 9.373 9.373 24.569 0 33.941L425.773 352.2c-15.119 15.119-40.971 4.411-40.97-16.971V284H284v100.804h51.23c21.382 0 32.09 25.851 16.971 40.971z" class=""></path></svg><br><span>Area</span><br><em><?php echo esc_html( strtok( $property_details['property_size'][0], 'm' ) . 'm.' ); ?></em>
+                                <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="arrows-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" class="svg-inline--fa fa-arrows-alt fa-w-16 fa-fw"><path fill="currentColor" d="M352.201 425.775l-79.196 79.196c-9.373 9.373-24.568 9.373-33.941 0l-79.196-79.196c-15.119-15.119-4.411-40.971 16.971-40.97h51.162L228 284H127.196v51.162c0 21.382-25.851 32.09-40.971 16.971L7.029 272.937c-9.373-9.373-9.373-24.569 0-33.941L86.225 159.8c15.119-15.119 40.971-4.411 40.971 16.971V228H228V127.196h-51.23c-21.382 0-32.09-25.851-16.971-40.971l79.196-79.196c9.373-9.373 24.568-9.373 33.941 0l79.196 79.196c15.119 15.119 4.411 40.971-16.971 40.971h-51.162V228h100.804v-51.162c0-21.382 25.851-32.09 40.97-16.971l79.196 79.196c9.373 9.373 9.373 24.569 0 33.941L425.773 352.2c-15.119 15.119-40.971 4.411-40.97-16.971V284H284v100.804h51.23c21.382 0 32.09 25.851 16.971 40.971z" class=""></path></svg><br><span>Area</span><br><em><?php echo esc_html( strtok( $wppd_property_details['property_size'][0], 'm' ) . 'm.' ); ?></em>
                             </div>
                         <?php } ?>
 
                         <?php
-                        if ( isset( $property_details['property_floors'] ) ) {
-                            if ( sanitize_text_field( $property_details['property_floors'][0] ) !== '' ) {
+                        if ( isset( $wppd_property_details['property_floors'] ) ) {
+                            if ( sanitize_text_field( $wppd_property_details['property_floors'][0] ) !== '' ) {
                                 ?>
                                 <div class="grid-property-attribute grid-property-attribute-floorplan flex-element">
@@ -271 +270 @@
 
                         <div class="grid-property-attribute grid-property-attribute-location flex-element">
-                            <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="map-marker-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-map-marker-alt fa-w-12 fa-fw"><path fill="currentColor" d="M172.268 501.67C26.97 291.031 0 269.413 0 192 0 85.961 85.961 0 192 0s192 85.961 192 192c0 77.413-26.97 99.031-172.268 309.67-9.535 13.774-29.93 13.773-39.464 0zM192 272c44.183 0 80-35.817 80-80s-35.817-80-80-80-80 35.817-80 80 35.817 80 80 80z" class=""></path></svg><br><span>Location</span><br><a href="#listing-map"><?php echo esc_html( $property_area ); ?></a>
+                            <svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="map-marker-alt" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" class="svg-inline--fa fa-map-marker-alt fa-w-12 fa-fw"><path fill="currentColor" d="M172.268 501.67C26.97 291.031 0 269.413 0 192 0 85.961 85.961 0 192 0s192 85.961 192 192c0 77.413-26.97 99.031-172.268 309.67-9.535 13.774-29.93 13.773-39.464 0zM192 272c44.183 0 80-35.817 80-80s-35.817-80-80-80-80 35.817-80 80 35.817 80 80 80z" class=""></path></svg><br><span>Location</span><br><a href="#listing-map"><?php echo esc_html( $wppd_property_area ); ?></a>
                         </div>
                     </section>
@@ -279 +278 @@
                      * Show the carousel for classic, cover or cinematic overlays
                      */
-                    if ( in_array( (int) $property_template, [ 0, 1, 2 ] ) ) {
-                        wppd_show_property_images( $property_id );
+                    if ( in_array( (int) $wppd_property_template, [ 0, 1, 2 ] ) ) {
+                        wppd_show_property_images( $wppd_property_id );
                     }
-
-                    do_action( 'after_slider', $property_id );
 
                     /**
                      * Show property description
                      */
-                    wppd_property_description( $property_id );
+                    wppd_property_description( $wppd_property_id );
 
                     /**
                      * Show property floorplans
                      */
-                    wppd_property_floorplans( $property_id );
+                    wppd_property_floorplans( $wppd_property_id );
 
                     /**
                      * Show property directions
                      */
-                    wppd_property_directions( $property_id );
+                    wppd_property_directions( $wppd_property_id );
 
                     /**
                      * Show property gallery (flexbin)
                      */
-                    wppd_property_flexbin( $property_id );
-
-
-
-                    if ( $property_details['property_market'][0] == 'New Developments' ) {
-                        $linked_properties = $property_details['linked_properties'][0];
-
-                        if ( (string) $linked_properties !== '' ) {
+                    wppd_property_flexbin( $wppd_property_id );
+
+
+
+                    if ( $wppd_property_details['property_market'][0] == 'New Developments' ) {
+                        $wppd_linked_properties = $wppd_property_details['linked_properties'][0];
+
+                        if ( (string) $wppd_linked_properties !== '' ) {
                             ?>
                             <section class="grid-property-types-within">
@@ -316 +313 @@
 
                                 <?php
-                                $linked_properties_array = explode( ',', $linked_properties );
-                                $importer_ids            = [];
-
-                                foreach ( $linked_properties_array as $linked_property ) {
-                                    $linked_property_args   = [
+                                $wppd_linked_properties_array = explode( ',', $wppd_linked_properties );
+                                $wppd_importer_ids            = [];
+
+                                foreach ( $wppd_linked_properties_array as $wppd_linked_property ) {
+                                    $wppd_linked_property_args   = [
                                         'post_type'      => 'property',
                                         'posts_per_page' => 1,
@@ -326 +323 @@
                                             [
                                                 'key'     => 'importer_id',
-                                                'value'   => $linked_property,
+                                                'value'   => $wppd_linked_property,
                                                 'compare' => '=',
                                             ],
                                         ],
                                     ];
-                                    $linked_property_object = new WP_Query( $linked_property_args );
-                                    if ( $linked_property_object->have_posts() ) {
-                                        while ( $linked_property_object->have_posts() ) {
-                                            $linked_property_object->the_post();
-                                            $importer_ids[] = $linked_property_object->post->ID;
+                                    $wppd_linked_property_object = new WP_Query( $wppd_linked_property_args );
+                                    if ( $wppd_linked_property_object->have_posts() ) {
+                                        while ( $wppd_linked_property_object->have_posts() ) {
+                                            $wppd_linked_property_object->the_post();
+                                            $wppd_importer_ids[] = $wppd_linked_property_object->post->ID;
                                         }
                                     }
                                 }
 
-                                if ( count( $importer_ids ) > 0 ) {
-                                    echo do_shortcode( '[property-grid columns="3" in="' . implode( ',', $importer_ids ) . '"]' );
+                                if ( count( $wppd_importer_ids ) > 0 ) {
+                                    echo do_shortcode( '[property-grid columns="3" in="' . implode( ',', $wppd_importer_ids ) . '"]' );
                                 }
                                 ?>
@@ -356 +353 @@
                         // get reusable gutenberg block:
                         if ( (int) get_option( 'reusable_sidebar_id' ) > 0 ) {
-                            $reusable_sidebar_block = get_post( (int) get_option( 'reusable_sidebar_id' ) );
-
-                            echo wp_kses_post( apply_filters( 'the_content', $reusable_sidebar_block->post_content ) );
+                            $wppd_reusable_sidebar_block = get_post( (int) get_option( 'reusable_sidebar_id' ) );
+
+                            echo wp_kses_post( apply_filters( 'the_content', $wppd_reusable_sidebar_block->post_content ) );
                         } elseif ( is_active_sidebar( 'sidebar-widget' ) ) {
                             dynamic_sidebar( 'sidebar-widget' );
                         } else {
-                            echo wp_kses_post( wp4pm_get_sidebar_classic( $property_id, $property_details ) );
+                            echo wp_kses_post( wp4pm_get_sidebar_classic( $wppd_property_id, $wppd_property_details ) );
                         }
                         ?>
@@ -372 +369 @@
                 <section id="listing-map">
                     <h4 class="listing-section-title">Location</h4>
-                    <?php $location = $property_details['latitude'][0] . ',' . $property_details['longitude'][0]; ?>
 
                     <?php if ( (string) get_option( 'map_provider' ) === 'osm' ) { ?>
@@ -379 +375 @@
                         <script>
                         window.addEventListener('load', function () {
-                            var osmMap = L.map('osm-map').setView([<?php echo floatval( $property_details['latitude'][0] ); ?>, <?php echo floatval( $property_details['longitude'][0] ); ?>], 16);
-
-                            L.marker([<?php echo floatval( $property_details['latitude'][0] ); ?>, <?php echo floatval( $property_details['longitude'][0] ); ?>])
+                            var osmMap = L.map('osm-map').setView([<?php echo floatval( $wppd_property_details['latitude'][0] ); ?>, <?php echo floatval( $wppd_property_details['longitude'][0] ); ?>], 16);
+
+                            L.marker([<?php echo floatval( $wppd_property_details['latitude'][0] ); ?>, <?php echo floatval( $wppd_property_details['longitude'][0] ); ?>])
                                 .addTo(osmMap)
                                 .bindPopup('<?php echo esc_html( get_the_title() ); ?>');
@@ -405 +401 @@
                 $per_page = (int) get_option( 'flex_grid_size' );
 
-                $property_county = get_the_terms( $property_id, 'property_county' );
-                $property_county = ( $property_county ) ? $property_county[0]->slug : '';
-
-                $property_area = get_the_terms( $property_id, 'property_area' );
-                $property_area = ( $property_area ) ? $property_area[0]->slug : '';
-
-                $property_price     = get_post_meta( $property_id, 'price', true );
-                $property_price_min = (int) $property_price - 20000;
-                $property_price_max = (int) $property_price + 20000;
-
-                $custom_taxterms    = wp_get_object_terms( $post->ID, 'property_type', [ 'fields' => 'ids' ] );
-                $args               = [
+                $wppd_property_county = get_the_terms( $wppd_property_id, 'property_county' );
+                $wppd_property_county = ( $wppd_property_county ) ? $wppd_property_county[0]->slug : '';
+
+                $wppd_property_area = get_the_terms( $wppd_property_id, 'property_area' );
+                $wppd_property_area = ( $wppd_property_area ) ? $wppd_property_area[0]->slug : '';
+
+                $wppd_property_price     = get_post_meta( $wppd_property_id, 'price', true );
+                $wppd_property_price_min = (int) $wppd_property_price - 20000;
+                $wppd_property_price_max = (int) $wppd_property_price + 20000;
+
+                $wppd_custom_taxterms    = wp_get_object_terms( $post->ID, 'property_type', [ 'fields' => 'ids' ] );
+                $wppd_args               = [
                     'post_type'      => 'property',
                     'post_status'    => 'publish',
@@ -429 +425 @@
                         [
                             'key'     => 'price',
-                            'value'   => [ $property_price_min, $property_price_max ],
+                            'value'   => [ $wppd_property_price_min, $wppd_property_price_max ],
                             'type'    => 'numeric',
                             'compare' => 'BETWEEN',
@@ -439 +435 @@
                             'taxonomy' => 'property_type',
                             'field'    => 'id',
-                            'terms'    => $custom_taxterms,
+                            'terms'    => $wppd_custom_taxterms,
                         ],
                         [
                             'taxonomy' => 'property_area',
                             'field'    => 'slug',
-                            'terms'    => [ $property_area ],
+                            'terms'    => [ $wppd_property_area ],
                             'operator' => 'IN',
                         ],
@@ -450 +446 @@
                     'post__not_in'   => [ $post->ID ],
                 ];
-                $related_properties = new WP_Query( $args );
-
-                if ( (int) $related_properties->found_posts > 0 ) {
+                $wppd_related_properties = new WP_Query( $wppd_args );
+
+                if ( (int) $wppd_related_properties->found_posts > 0 ) {
                     ?>
                     <section class="property-grid">
@@ -459 +455 @@
                         <div class="flex-container">
                             <?php
-                            if ( $related_properties->have_posts() ) :
-                                while ( $related_properties->have_posts() ) :
-                                    $related_properties->the_post();
+                            if ( $wppd_related_properties->have_posts() ) :
+                                while ( $wppd_related_properties->have_posts() ) :
+                                    $wppd_related_properties->the_post();
                                     echo wp_kses_post( wp4pm_get_property_box( $post->ID ) );
                                 endwhile;
@@ -478 +474 @@
 }
 
-wp_reset_query();
+wp_reset_postdata();
 
 get_footer();

property-drive/trunk/templates/template-parts.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 /**
  * Display the property description.
@@ -289 +293 @@
                 $out     .= '<p><small>Share to social networks via the icons below.</small></p>
                 <p id="share-buttons">';
-                    $out .= get_sharing_buttons( $propertyId );
+                    $out .= wppd_get_sharing_buttons( $propertyId );
                 $out     .= '</p>
             </div>