readme.txt

=== WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory ===
Author URI: https://wpusermanager.com
Plugin URI: https://wpusermanager.com
Contributors: wpusermanager, polevaultweb, alessandro.tesoro
Tags: registration form, login form, user profile, member directory, membership
Requires at least: 4.9
Tested up to: 7.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html
Stable Tag: 2.10.2

Registration forms, a frontend login form, user profiles and a member directory for WordPress. Add Stripe payments and content restriction.

== Description ==

= User registration, login, profiles and member directories for WordPress =

[WP User Manager](https://wpusermanager.com?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) replaces the default WordPress login and registration with forms that live on your own pages and match your theme. Members get a public user profile and an account page to edit their details, and you can list them in a searchable member directory.

Use it to build a membership site, a community, a client portal, or simply a better registration form and login page than WordPress gives you out of the box.

**What you can build with the free plugin:**

- **A custom registration form** on any page, with your own user fields, terms and privacy checkboxes, and automatic login after signup
- **A front-end login form** and login page, with password recovery, so users never see wp-login.php
- **User profile pages** with custom avatars, cover images and tabs for each member's posts and comments
- **A member directory** with search, sorting and filtering by role, displayed anywhere with a block or shortcode
- **An account page** where members update their details and change their password
- **Paid registration with Stripe**, collecting a one-off or recurring payment when someone signs up
- **Content restriction** by role or logged-in status, on whole pages or on any individual block, plus custom redirects after login, logout and registration
- **Blocks and Elementor widgets** for every form and page: login, registration, password recovery, account, profile, profile card, user directory, recently registered users, and login and logout links. Shortcodes work everywhere else

[Website](https://wpusermanager.com?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) | [Addons](https://wpusermanager.com/addons?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) | [Documentation](http://docs.wpusermanager.com/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) | [Support](https://wordpress.org/support/plugin/wp-user-manager/)

= Features included =

- [Frontend forms](https://wpusermanager.com/features/front-end-forms/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Allow users to register and login from the front of the site. Customize the registration form with custom fields to collect data
- [Stripe integration](https://wpusermanager.com/articles/332-stripe/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Take one-off or recurring payments on the registration form, using Stripe Connect
- [Custom email notifications](https://wpusermanager.com/features/custom-email-notifications/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Customize the emails sent to users when the register, reset their password and more
- [Custom avatars](https://wpusermanager.com/features/custom-avatars/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Users can edit their site avatar by uploading an image from the account page
- [Elegant user profiles](https://wpusermanager.com/features/elegant-user-profiles/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): All users have a public profile page to display their data
- [Shortcodes editor](https://wpusermanager.com/features/shortcodes/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Easily add the plugin shortcodes to pages or posts with the shortcode generator and editor
- [Roles editor](https://wpusermanager.com/features/roles-and-permissions-editor/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Edit roles and their capabilities. Create new roles and duplicate existing ones
- [Beautiful user directories](https://wpusermanager.com/features/user-directories/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Display users in a directories that can be displayed anywhere on the site
- [SEO URLs](https://wpusermanager.com/features/seo/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): All the URLs are SEO friendly
- [Content restriction](https://wpusermanager.com/features/content-restriction/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Restrict content for certain users, by logged in status, or by role
- [Passwords management](https://wpusermanager.com/features/passwords-management/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Allow users to update their password from their account page
- [Custom fields editor](https://wpusermanager.com/features/custom-fields/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Create custom user fields that can be used to collect data on registration
- [Custom widgets](https://wpusermanager.com/features/custom-widgets/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Display user data and forms in sidebars using widgets
- [Custom redirects](https://wpusermanager.com/features/custom-redirects/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Control where the users are redirected to on login, registration and more
- [Powerful tools](https://wpusermanager.com/features/tools/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Tools to be in control of your site and who registers
- [Developers friendly](https://wpusermanager.com/features/developers-friendly/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Customize and integrate with other plugins with a large number of hooks and filters
- [Extensive documentation](http://docs.wpusermanager.com?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Full documentation and expert support
- Translation Ready - The plugin and addons are fully localized ready for translation

Read more about our features on [wpusermanager.com](https://wpusermanager.com/features/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager)

= Premium Features =

For more advanced functionality check out the [pricing page](https://wpusermanager.com/pricing/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

- [Custom Fields](https://wpusermanager.com/addons/custom-fields/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Add custom fields to members profiles and registration forms
- [WooCommerce](https://wpusermanager.com/addons/woocommerce/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Integration with WooCommerce. Collect payment at registration, allow members to update their billing and shipping addresses, display product purchases, reviews and more!
- [Stripe Pro](https://wpusermanager.com/addons/stripe-pro/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Integration with Stripe. Collect payment at registration with Stripe, restrict access to your site, remove the commission fees.
- [User Verification](https://wpusermanager.com/addons/user-verification/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Send a verification link via email upon registration or manually approve users before they can login
- [Groups](https://wpusermanager.com/addons/groups/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Give your users the ability to create and join groups
- [Security](https://wpusermanager.com/addons/security/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Add password security features and user login management features
- [Registration Forms](https://wpusermanager.com/addons/registration-forms/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Create unlimited registration forms, create multi-step forms, customize forms with HTML, and have full control over form settings
- [Frontend Posting](https://wpusermanager.com/addons/frontend-posting/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Allow your users to submit posts and other content from the frontend
- [Advanced Custom Fields](https://wpusermanager.com/addons/acf/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Collect [ACF](https://wordpress.org/plugins/advanced-custom-fields/) user data at registration and allow users to see and edit the data on their profile
- [Social Login & Registration](https://wpusermanager.com/addons/social-login/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Allow your users to quickly login and register with their favorite social network account, Facebook, Twitter, Instagram & LinkedIn
- [Private Content](https://wpusermanager.com/addons/private-content/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Provide private content for all your users, as well as user specific content so you can tailor for each member
- [Mailchimp](https://wpusermanager.com/addons/mailchimp/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Sync users with Mailchimp upon registration & more
- [Google reCAPTCHA](https://wpusermanager.com/addons/recaptcha?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Stop spam registrations on your website for free
- [Content Restriction Plus](https://wpusermanager.com/addons/content-restriction/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): One-click restriction to posts, pages and custom post types
- [Likes](https://wpusermanager.com/addons/likes/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Allow your users to like posts, pages and other content
- [hCaptcha](https://wpusermanager.com/addons/hcaptcha/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Stop more bots. Start protecting user privacy with hCaptcha
- [WPML](https://wpusermanager.com/addons/wpml/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Translate your custom fields, field groups, registration forms, and emails using [WPML](https://wpml.org/)
- [Personal Data](https://wpusermanager.com/addons/personal-data?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Allows the user to request an export of personal data and request erasure of personal data from the account page for GDPR compliance
- [Delete Account](https://wpusermanager.com/addons/delete-account?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager): Allows the user to delete their own profile from the frontend account page

= Free Extensions =

- [Newsletter](https://wordpress.org/plugins/wpum-newsletter): Subscribe your members to your Newsletter plugin lists easily during registration
- [Username Length](https://wordpress.org/plugins/wpum-username-length): Set minimum and maximum characters length for usernames

= Translations =

Want to add a new language to WP User Manager? Awesome! You can contribute via [translate.wordpress.org](https://translate.wordpress.org/projects/wp-plugins/wp-user-manager). Please read the official [translation tutorial](https://docs.wpusermanager.com/article/67-translate-wp-user-manager/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) for more information.

= Support =

Support is provided only through the [support forum](https://wordpress.org/support/plugin/wp-user-manager). Join the [support forum](https://wordpress.org/support/plugin/wp-user-manager) to ask questions and get help regarding WP User Manager. Free support is provided exclusively for bugs and help using the plugin. Please read the support policy [https://wpusermanager.com/support-policy/](https://wpusermanager.com/support-policy/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

Before opening a [support topic](https://wordpress.org/support/plugin/wp-user-manager) please read the [faqs](http://docs.wpusermanager.com/category/66-faq-tutorials/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) and [documentation](http://docs.wpusermanager.com/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

Support for premium addons is provided exclusively [through the premium support platform](https://wpusermanager.com/support/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager). Support for premium addons cannot be provided through WordPress.org due to the rules put in place by the WordPress.org team.

== Installation ==

Please read our detailed documentation here [https://docs.wpusermanager.com/category/13-installation](https://docs.wpusermanager.com/category/13-installation)

== Frequently Asked Questions ==

= How do I add a login form to a page? =

Add the **Login Form** block (or Elementor widget) to any page, or use the `[wpum_login_form]` shortcode. WP User Manager creates a login page for you on activation, and you can redirect wp-login.php to it so users never see the default WordPress login screen. See the [login form shortcode guide](https://wpusermanager.com/article/170-login-form-shortcode/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

= How do I create a custom registration form? =

Add the **Registration Form** block, Elementor widget or `[wpum_register]` shortcode to a page, then choose which user fields the form shows under Users → Registration Forms. The free plugin includes one registration form. The [Registration Forms](https://wpusermanager.com/addons/registration-forms/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) addon adds unlimited forms and multi-step forms.

= How do I create a member directory? =

Create a directory under Users → Directories, choose which roles to include and whether to show a search form, then add it to a page with the **User Directory** block, the Elementor widget or its `[wpum_user_directory id="123"]` shortcode.

= Can I charge for registration? =

Yes. The free plugin connects to Stripe so you can take a one-off or recurring payment on the registration form. [Stripe Pro](https://wpusermanager.com/addons/stripe-pro/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) uses your own Stripe keys and removes the platform fee. See [how to accept recurring payments with Stripe](https://wpusermanager.com/tutorials/how-to-accept-recurring-payments-with-stripe-in-wordpress/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

= Does it work with the block editor and Elementor? =

Yes. Every form and page has a block and a native Elementor widget: login, registration, password recovery, account, profile, profile card, user directory, recently registered users, and login and logout links. In the block editor you can also show or hide any block by logged-in status, user role or specific users.

= Which shortcodes are available? =

Login, registration, password recovery, account, profile, profile card, user directory, recently registered users, logout and content restriction shortcodes, for classic themes, widgets and page builders. See the [full list of pages and shortcodes](https://wpusermanager.com/article/173-pages-shortcodes/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

= Install instructions =

Please refer to the [official documentation](https://docs.wpusermanager.com/category/13-installation/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

= Does WPUM work with any theme? =
 WP User Manager has been designed and coded to seamlessly integrate with any properly coded WordPress theme. However, each theme is coded differently and the quality of the code can vary. To avoid potential issues and conflicts, WPUM adds very little css and js to your website. If your theme is properly coded, WPUM should adapt itself to your site layout. Although we cannot guarantee that the plugin works with all themes.

= My emails aren't delivering =
Please refer to the [official documentation](https://docs.wpusermanager.com/article/73-my-emails-arent-delivering/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

= Where do I report security bugs found in this plugin? =

Please report security bugs found in the source code of the WP User Manager plugin through the [Patchstack Vulnerability Disclosure Program](https://patchstack.com/database/vdp/wp-user-manager/). The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin. For further details, see our [security policy](https://github.com/WPUserManager/wp-user-manager/blob/develop/.github/SECURITY.md).

= Does the plugin send my email address anywhere? =

Only if you subscribe. The plugin's admin screens offer the WP User Manager newsletter, with your email address filled in. Nothing is sent until you click Subscribe, when your email address and first name go to our mailing list at wpusermanager.com. See our [privacy policy](https://wpusermanager.com/privacy-policy/). To stop the offer showing at all, return false from the `wpum_show_newsletter_optin` filter.

= Is WP User Manager GDPR compliant? =

Please refer to the [official documentation for gdpr compliance](https://docs.wpusermanager.com/article/427-gdpr-compliance/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager).

WP User Manager provides add-ons to comply with the right of erasure and the right

Please note that using WPUM and the mentioned add-ons does NOT guarantee compliance to GDPR. WPUM gives you general information and tools, but is NOT meant to serve as complete compliance package. As the owner of your website, it is your responsibility to ensure that your site is compliant with the regulations. Please always contact an attorney for accurate information, we are not responsible for your website GDPR compliance and we can’t be held accountable for any legal issues.

== Screenshots ==

1. Fields groups editor, customize name and description and add new ones.
2. Fields editor page from here you can adjust the order edit each field's settings etc..
3. Individual fields settings editor.
4. Registration forms fields editor: add, remove, edit fields and setup custom user role for the form.
5. Emails editor
6. Live emails editor.
7. Emails editor dynamic tags.
8. User directories editor.
9. Single member profile example.
10. Example of a directory.
11. Account customization page.
12. Registration form.
13. Login form.

== Changelog ==

= 2.10.2 (29th October 2026) =

- New: Text tab in the email editor, for editing an email's HTML directly
- New: Send WP User Manager's password reset email from the Users list
- New: Send logged in users away from the login and registration pages (Settings > Redirects > Logged In Users)
- Tweak: The Stripe webhook setting says to choose the Snapshot payload format, and warns when Stripe sends Thin events
- Fix: Stripe products beyond the first 100, and prices beyond the first 10, are now listed
- Fix: The Fetch Stripe Products button now shows when there is only one product
- Fix: Paying for a Stripe price that has since been archived no longer causes a fatal error
- Fix: Application passwords now work for non-admins when login is set to Email only or Username only

= 2.10.1 (27th October 2026) =

- Security: "Prevent site access to visitors" can no longer be bypassed by sending the login form's field names to a page (thanks to mroccon via Patchstack for responsible disclosure)

= 2.10.0 (20th October 2026) =

- New: Rename roles from the Roles screen
- New: {login_page_link} and {recovery_link} email tags output a clickable link
- New: Admins see a notice when a PHP extension the plugin needs is missing
- Security: Stripe Connect checks the site started a connection before handing over its keys
- Security: Disconnecting Stripe also removes the connection from the Stripe Connect service
- Tweak: {login_page_url} and {recovery_url} now output the plain URL, for use in your own links and buttons. Existing emails are updated to keep their links
- Tweak: New installs hide the Email field on public profiles
- Tweak: The login, registration, password, account and profile pages are no longer indexed by search engines
- Tweak: Logged in visitors to the login page are sent to its redirect_to address
- Tweak: The Stripe Eligible Products setting describes what it does
- Fix: A Stripe subscription moved to a plan the member can't choose no longer gives paid access
- Fix: Upgrading in the Stripe customer portal keeps paid access
- Fix: Radio groups no longer pre-select the first option
- Fix: Fields that never show a placeholder no longer offer the Placeholder setting
- Fix: Fatal error when the stored email settings were not in the expected format

= 2.9.26 (16th October 2026) =

- Security: Customers who haven't paid for a Stripe plan stay restricted when Stripe isn't connected (thanks to Charles Vosburgh via WPScan for responsible disclosure)
- Security: Registration forms with Stripe products no longer accept registrations while Stripe isn't connected
- Fix: Duplicate default registration forms are no longer created on first activation
- Fix: WP User Manager form pages are kept out of page and browser caches
- Fix: Menu item settings no longer query the database for every item
- Fix: The Stripe plan choice on registration forms has a label, and billing amounts show to the cent

= 2.9.25 (14th October 2026) =

- Security: "Prevent site access to visitors" can no longer be bypassed with a URL that only looks like a REST API request (thanks to Truebird via Patchstack for responsible disclosure)
- Security: With site access prevented, the password reset page's child pages are no longer open to visitors
- Fix: With plain permalinks and site access prevented, REST API requests such as the Stripe webhook are no longer redirected to the login page

= 2.9.24 (8th October 2026) =

- Fix: A Stripe API error, such as a rate limit or outage, no longer causes a critical error. The last product list fetched from Stripe is used until Stripe responds again
- Fix: Connecting or disconnecting a Stripe account clears the previous account's products
- Enhancement: Stripe Connect checkout requests are signed with your connected account's key. If the Connect service can't verify them, the Stripe settings explain what to do

= 2.9.23 (8th October 2026) =

- Security: Stripe payments only count towards the plans a customer registered for. The Billing tab and checkout offer only those plans, and a payment for any other price no longer marks the customer's plan as paid (thanks to Atia Avela via Patchstack for responsible disclosure)
- Security: Content restricted to a Stripe product is only shown once that product is paid for, or its subscription is active
- Fix: New Stripe subscriptions are active straight away, instead of only after a later update from Stripe
- Fix: Connecting to Stripe could fail with "This Stripe connection request has expired" if the site made other requests while you were on Stripe
- Fix: The Stripe Billing plans template now hides prices that aren't offered

= 2.9.22 (2nd October 2026) =

- New: Form Styles setting (Users > Settings > General > Misc Settings) adds basic styles to WP User Manager forms. On by default for new installs and for sites using a block theme
- New: Support link on the Plugins screen
- New: wpum_field_datepicker_disable_mobile filter, to use the device's native date input on mobile instead of the calendar
- Fix: With "Prevent site access to visitors" on, logged-out visitors can no longer read content through the REST API. Use the wpum_prevent_entire_site_rest_allowed_routes filter to open specific routes
- Fix: Emails with no saved subject are no longer sent with a blank subject line
- Fix: Emails missing from saved settings (including password recovery and the admin new registration notice) now send using the defaults
- Fix: Responsive column classes (wpum-col-sm-*, wpum-col-md-* and wpum-col-lg-*) now apply. If you added CSS to work around them, check your layouts
- Fix: Date fields open the calendar on mobile devices and show the site's date format
- Fix: The registration forms admin screen lists every form, not just the first 20
- Fix: The ACF settings metabox and the Elementor registration form widget list every registration form
- Fix: "Translation loading triggered too early" notices for Groups and Social Login caused by the addon version check

= 2.9.21 (30th September 2026) =

- Security: Accounts with an outstanding Stripe payment are limited to read access across the site, including wp-admin, the REST API and admin-ajax (thanks to Pedro Delgado via Patchstack for responsible disclosure)
- Security: Role-restricted content, Elementor widgets and profile fields treat accounts with an outstanding Stripe payment as having no role
- Tweak: Members whose Stripe subscription has lapsed also lose their role's capabilities until they pay. Use the wpum_stripe_restrict_unpaid_capabilities filter to keep the previous behaviour

= 2.9.20 (19th September 2026) =

- Security: Stripe registration only accepts the plans configured on the registration form (thanks to Patchstack for the follow-up review)
- Security: Stripe Connect callback is now tied to the administrator who started the connection
- Security: One-time Stripe plans are only marked as paid once Stripe confirms the payment
- Security: Hardened addon version check, license requests, file field output and bundled Carbon Fields AJAX actions
- Fix: One-time Stripe payments not being marked as paid
- Fix: Fatal error when downloading Stripe invoices
- Fix: Customers who abandoned a one-time Stripe checkout had no way to pay
- Fix: Addon licenses entered since 2.9.14 not activating
- Tweak: Removed unused Carbon Fields source files from the plugin package

= 2.9.19 (18th September 2026) =

- Security: Enforced server-side Stripe plan validation on registration (thanks to Ananda Dhakal via Patchstack for responsible disclosure)
- Security: Added authorization check to Stripe Connect callback (thanks to Wordfence PRISM for responsible disclosure)
- Enhancement: Added "Fetch Stripe Products" button to Stripe settings
- Enhancement: Stripe product webhook handlers to auto-sync product cache
- Enhancement: Filter Stripe API queries to active products and prices only
- Enhancement: Generic login error messages setting to prevent username enumeration
- Fix: PHP 8 fatal in avatar cache key when $id_or_email is an object

= 2.9.18 (30th May 2026) =

- Security: Hardened profile tab input validation (thanks to Yat via Wordfence for responsible disclosure)
- Fix: Custom avatar not shown when a default avatar is also configured
- Fix: Multiple roles not saving on the admin edit user page
- Fix: Email content editor for 'Delete Inactive Accounts' not working with block themes

= 2.9.17 (11th May 2026) =

- Security: Hardened file field input validation during registration (thanks to endy via Patchstack for responsible disclosure)

= 2.9.16 (11th Apr 2026) =

- Fix: PHP 8.2+ dynamic property deprecation warnings in WPUM_Field
- Fix: Account update no longer fails when avatar or cover image file is missing from disk
- Fix: Password recovery now works when the username is an email address different from the stored email
- Fix: Multicheckbox and multiselect fields no longer cause errors when the stored value is not an array

= 2.9.15 (26th Feb 2026) =

- Fix: User role multiselect was disabled on the admin user profile after Carbon Fields upgrade

= 2.9.14 (24th Feb 2026) =

- Improvement: Updated Brain\Cortex routing library for PHP 8.3 compatibility
- Improvement: Upgraded Carbon Fields to a version compatible with PHP 8.1-8.3
- Fix: Translation loading now uses the correct hook for WordPress 6.7+ compatibility
- Improvement: Minimum PHP version raised from 7.2 to 7.4

= 2.9.13 (16th Dec 2025) =

- Security: Fixed authenticated arbitrary file deletion vulnerability in custom avatar and cover image handling (Thanks to YC_Infosec via Wordfence)
- Security: Fixed a PHP Object Injection vulnerability in the user nickname profile field (Thanks to Nguyen Ngoc Quang Bach (maysbachs) via Patchstack)

= 2.9.12 (21st Nov 2024) =

- Security: Missing authorization to authenticated check for the unique usermeta key check when editing a field (Thanks to Tieu Pham Trong Nhan)
- Security: Carbon Field sidebar AJAX action handlers removed which are not used but posed a CSRF security risk (Thanks to BrokenAC)

= 2.9.11 (7th Sept 2024) =

- Security: Nonce check added to the admin action of fixing old plugin data

= 2.9.10 (2nd April 2024) =

- Improvement: + and other characters no longer accepted in username at registration
- Fix: Required checkboxes field hidden with conditional logic incorrectly requires all boxes to be checked
- Fix: Registration form duplicate id attribute HTML issues
- Tested with WordPress 6.5

= 2.9.9 (11th March 2024) =

- Fix: Stripe subscriptions not connecting to user correctly
- Fix: Password field not allowing special characters

= 2.9.8 (19th November 2023) =

- Fix: Unable to add new WPUM Blocks or edit existing ones
- Fix: PHP 8.1 and 8.2 notices
- Fix: Redirect loop when preventing access to the site unless logged in for sites installed in a subdirectory
- Fix: Unable to submit WPUM forms as Elementor widgets
- Fix: Displayed Stripe product prices incorrectly rounded to whole numbers
- Fix: REST API endpoints not accessible when preventing access to the site unless logged in
- Fix: Unable to remove all "Allowed Roles" in the custom field permissions tab
- Fix: Unable to add blocks for the Likes, Private Content, and Social Login addons
- Fix: Unable to delete custom role

= 2.9.7 (23rd March 2023) =

- Fix: WP User Manager custom blocks and block restriction settings now appear in the block editor

= 2.9.6 (22nd March 2023) =

- Improvement: Plugin now requires PHP 7.2+
- Fix: PHP Fatal error: Cannot declare because the name is already in use in
- Fix: Date picker on the account page now uses the correct display format

= 2.9.5 (17th March 2023) =

- Fix: PHP Fatal error:  Uncaught Error: Class 'WPUM\Walker_Nav_Menu_Edit' not found
- Fix: Date picker not saving in correct format
- Fix: Repeater fields not loading correctly

= 2.9.4 (17th March 2023) =

- Fix: Fatal error: Cannot declare because the name is already in use in errors

= 2.9.3 (16th March 2023) =

- Fix: Fatal errors on sites using Divi

= 2.9.2 (16th March 2023) =

- Fix: PHP 8 Fatal error: Uncaught TypeError: spl_autoload_unregister(): Argument #1 ($callback) must be a valid callback

= 2.9.1 (16th March 2023) =

- Fix: PHP Fatal error failed opening required /includes/functions-scoped.php

= 2.9 (16th March 2023) =

- New: Collect payment for site access with credit cards using our Stripe integration
- New: Use native Elementor widgets instead of WP User Manager shortcodes
- New: Choose an image as the default avatar for users who haven't uploaded one
- New: Compatibility with the [Stripe Pro](https://wpusermanager.com/addons/stripe-pro/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) addon
- Improvement: Registration success notice now shows on after registration redirect pages
- Improvement: Third-party dependency code is now prefixed to avoid clashes with other plugins
- Improvement: Storage date format for the Date picker field updated to 'Y-m-d' for standardization
- Improvement: Date format for the Date picker field can be altered with the 'wpum_field_datepicker_date_format' filter
- Fix: PHP notice on form submit with Repeater field with conditional logic

= 2.8.19 (3rd February 2023) =

- Improvement: Pagination for comments on the profile, with comments per page setting
- Fix: Email customizer now works with the OceanWP theme
- Fix: Conditional logic support for Repeater subfields

= 2.8.18 (23rd January 2023) =

- Fix: Code fixes using PHPStan (props [szepeviktor](https://github.com/szepeviktor))
- Fix: Renaming a registration form now works correctly
- Fix: Abort loading plugin early if plugin doesn't meet PHP or WP requirements
- Fix: Newsletter email form on welcome page updated
- Fix: Formatting on the welcome page
- Fix: Updated documentation URLs

= 2.8.17 (18th January 2023) =

- New: Setting to partially obfuscate email addresses used as the user display name
- Improvement: 'wpum_authentication_method_admin_override' filter to enforce admin logins with the correct username/email method
- Fix: Headers for field groups with only hidden fields now don't render on the profile
- Fix: Searching in a directory for users with apostrophes in their names now returns result
- Fix: Redirecting to a URL with query parameters now retains the parameters after login

= 2.8.16 (2nd January 2023) =

- New: Compatibility with [Likes](https://wpusermanager.com/addons/likes/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) addon
- New: Blocks for Social Login Buttons and Private Content
- Improvement: Profile permission settings now in a different tab in the admin
- Fix: User role editor now saving grant and deny capabilities correctly
- Fix: Profile Card block settings now working correctly
- Fix: Undefined offset: 0 in wp-user-manager/includes/actions.php on line 117
- Fix: Error log messages now not showing if a profile is accessed for a user that does not exist

= 2.8.15 (21st December 2022) =

- New: Compatibility with [hCaptcha](https://wpusermanager.com/addons/hcaptcha/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) addon
- Fix: Warning: Undefined array key “action” now not showing
- Fix: Undefined offset: 0 when excluding roles from showing the admin bar

= 2.8.14 (6th December 2022) =

- Improvement: Saving a custom field with same unique key is now not allowed
- Improvement: 'wpum_prevent_entire_site_access_allowed_urls' filter for allowing URLs when site access is prevented
- Fix: Multiple checkboxes field now saving correctly
- Fix: Existing file fields data in a repeater field are now preserved correctly on save
- Fix: Menu item user role restriction now works as expected
- Fix: Switching back to a user with the User Switching plugin now works as expected
- Fix: Plugin admin scripts now not loading on every admin page
- Fix: Hypens now allowed in unique meta key for custom fields

= 2.8.13 (19th October 2022) =

- Fix: User, User Role, and User Taxonomy fields now saving multiple values correctly

= 2.8.12 (16th September 2022) =

- Fix: Forms in widgets now render correctly
- Fix: Multi select fields now rendered correctly when hidden with conditional logic

= 2.8.11 (15th September 2022) =

- Improvement: Links on the Already Logged In template can be filtered using the 'wpum_already_logged_in_links' filter
- Fix: Password reset success message now renders HTML correctly
- Fix: File field now correctly saving uploads
- Fix: Sub pages for the account and profile page now loading when using an Elementor template

= 2.8.10 (14th September 2022) =

- Fix: Conditional logic settings now correctly saving when editing a field
- Fix: Custom field unique meta keys now converted to lowercase to stop fatal errors

= 2.8.9 (12th September 2022) =

- Improvement: Options for dropdown, multiselect, checkbox and radio buttons fields can be pasted in
- Improvement: Plugin coding standards improved
- Fix: Account and profile subpages now correctly styled like the parent page when using page builder plugins
- Fix: PHP notices now not thrown when using conditional logic with empty multiselect fields

= 2.8.8 (16th August 2022) =

- Security: File uploads now checked for matching file extension and file type before attempting to upload
- Fix: HTML in form error messages now showing correctly
- Fix: 'Edit account' string on the profile page now localized for translation

= 2.8.7 (8th August 2022) =

- Fix: PHP Notice: Undefined index preventing form submission on some installs

= 2.8.6 (7th August 2022) =

- Improvement: Conditional logic for fields now supported for both the [Custom Fields](https://wpusermanager.com/addons/custom-fields/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) and [ACF](https://wpusermanager.com/addons/acf/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager) addons
- Fix: Change Password account form now loading correctly after save
- Fix: Account and profile sub pages now inheriting the parent page template which was broken in WordPress 6.0
- Fix: Saving Divi pages now not throwing fatal errors on some installs
- Fix: Registration form error messages now using the general-error.php template

= 2.8.5 (25th May 2022) =

- Fix: Account and profile sub pages now working with WordPress 6.0

= 2.8.4 (22nd May 2022) =

- Tested with WordPress 6.0
- Fix: Plugin now compatible with sites with object caching enabled

= 2.8.3 (12th May 2022) =

- Fix: Field names with apostrophes now don't have slashes added
- Fix: Prevent site access now compatible with Social Login addon

= 2.8.2 (1st May 2022) =

- Improvement: Redirect URL after login can now be filtered with 'wpum_login_redirect_to_url' filter when restricting content
- Fix: Password reset page now accessible when preventing access to the whole site
- Fix: Email settings tab now only showing for File fields
- Fix: File field help hint now includes jpeg in the example file extensions for clarity
- Fix: WP User Manager addons now showing as tested up to the minor WordPress versions correctly

= 2.8.1 (25th February 2022) =

- Fix: User password now not regenerated when other plugins create users when using a 'password' field
- Fix: WP CLI commands now working when the site is locked

= 2.8 (24th February 2022) =

- New: Sites can now be completely locked from access unless users are logged in
- New: Email sent to the site administrator when a new user registers can now be customized like other emails from the email screen
- New: File fields can now be attached to new user registration emails with the [Custom Fields addon](https://wpusermanager.com/addons/custom-fields/?utm_source=wordpress.org&utm_medium=free%20plugin%20listing&utm_campaign=WP%20User%20Manager)
- New: Emails can now be disabled from the email screen
- New: Directory sorting option is now filterable with 'wpum_directory_sort_options' to allow setting custom sort field
- Improvement: User is now alerted if they have unsaved field settings and try to change settings tabs
- Fix: 'Username or email' string now used to match WordPress and leverage existing string translations

= Earlier versions =
For the full changelog with earlier versions, please refer to [the changelog on wpusermanager.com](https://wpusermanager.com/changelog/).