Security Fixed a broken access control issue where the Offers and Dashboard REST endpoints could be read or deleted without authentication because the permission check returned the required capability name instead of verifying it.
Security The “resend verification” and “send congratulations” admin actions now require the dashboard capability instead of being reachable while logged out.
Security Hardened unserialize() calls storing offer data against PHP object-injection.
Security Added missing sanitization/unslashing on request data across the admin and frontend, and moved raw SQL table-name interpolation onto prepared statements where supported.
Improved Replaced direct filesystem calls in CSV import/export with the WordPress Filesystem API, and standardized on wp_json_encode() throughout.
Credit Thanks to Labda for responsibly disclosing the broken access control issue in the Offers and Dashboard REST endpoints.
Fixed “Security Check Failed — Nonce verification failed” on sites using page caching — the form now fetches a fresh nonce right before submitting instead of relying on the (possibly cached and expired) one embedded in the page.
Fixed Blank error dialog on form submission failures — error responses were wrapped in a data envelope the frontend didn’t unwrap.
Improved Escrow API errors now report the actual cause (missing Escrow settings, connection failure, or an unexpected API response with its HTTP status) instead of a generic failure message, and connection details are written to the PHP error log.
Fixed Escrow API requests failing when the configured API URL has no trailing slash.
Fixed Escrow.com “Buy Now” transactions failing with “The title and description fields are required” — the domain description was never sent with the purchase request, and Template 2 didn’t include it at all.
Improved The Escrow transaction description now falls back to an auto-generated description when the sale content is empty, and is capped at Escrow’s 500-character limit.
Fixed The Domains, Offers, and Analytics screens showing no data when the permalink structure is set to “Plain” — a malformed REST request URL was silently failing.
New Completely redesigned admin area, rebuilt as a modern React single-page application.
New Migrated the entire admin away from the legacy Codestar options framework to a native React + REST API architecture, removing ~35,000 lines of legacy framework code for a lighter, faster plugin.
New React-based Settings, Offers, Transactions, Import/Export, Help, and License pages, all powered by a unified REST API and shared schema registry.
New Reworked Post List and Post Editor screens with bulk actions, one-click shortcode copy, and an integrated rich text editor.
New shadcn/ui component system across the admin (calendar, popover, hover card, dialogs, dropdowns, toast notifications, and more) for a consistent, accessible UI.
New Frontend single Domain Listing template for displaying listings on their own page.
Improved Admin navigation now intercepts WordPress menu clicks and routes through the React SPA, eliminating page reloads and menu flickering.
Improved Replaced Toastify with shadcn/ui Toast for consistent in-app notifications.
Improved Added internationalization (i18n) support throughout the React admin.
Fixed Hash-based route navigation for Offers, Transactions, Settings, and Help pages.
Fixed Admin preview issue.
Fixed Minor CSS issues in the admin panel.
Fixed An issue where domain titles were being automatically normalized to lowercase
Added Layout 03 — new domain landing page template with a modern, full-width design.
Added Layout 03 includes a prominent hero section with domain name display, price, and call-to-action button.
Added Layout 03 features a built-in inquiry/offer form with clean card-based layout.
Fixed The Dashboard link now navigates via hash routing, consistent with all other React sub-pages.
Cleanup Removed unused file to reduce plugin size.
Fixed Fatal memory exhaustion in `dfs_fetch_selected_page()` caused by self-merging arrays growing exponentially on each loop iteration.
Fixed `$single_page` variable used before initialization inside the loop.
Fixed `foreach()` warning — “argument must be of type array|object, string given” — caused by `dfs_fetch_selected_page()` returning a flat array of strings instead of the expected array of arrays.
Improved Refactored `dfs_fetch_selected_page()` to collect each template’s `multi_page` and `single_page` values as separate sub-arrays, matching the structure expected by the page-selection field renderer.
Fixed Domain Name field blanked for all existing domains after updating to 3.3.0+ due to migration bug overwriting saved domain_name with empty string.
Fixed Update migration guard in 3.3.0 — old keys now only renamed when they actually exist in post meta.
Added Automatic data recovery (update-3.3.2) restores domain_name from post title for any domain where it was wiped.