Kwayy HTML Sitemap

Changelog

5.2

• Security Fix: Enforced explicit post_status => 'publish' and viewability checks on sitemap queries to prevent unpublished draft and private post leakage in cached environments.
• Security Fix: Added recursion cycle detection and depth guards ($visited tracking and max depth) to prevent infinite loops and denial of service from circular post or taxonomy hierarchies.
• Security Fix: Hardened Select2 rendering against DOM XSS.
• Security Fix: Restricted admin notice dismissal script and nonce enqueuing strictly to administrators with manage_options.
• Security Fix: Enhanced output escaping with wp_kses_post() for translation strings and esc_attr_e() for form attributes.
• Performance: Refactored taxonomy term rendering into a single database query with in-memory tree building, eliminating N+1 database queries.
• Performance: Optimized admin settings exclude query with no_found_rows and disabled meta/term cache updates to conserve memory.
• Bug Fix: Fixed timing issue where settings saved notice failed to display after saving options.

5.1

• Security Fix: Added nonce verification (wp_nonce_field and check_admin_referer) to prevent Cross-Site Request Forgery (CSRF) on settings save (CVE-2026-65539).
• Security Fix: Added capability check (manage_options) and nonce verification (check_ajax_referer) to admin notice dismissal endpoint.
• Security Fix: Added direct file access protection (defined( 'ABSPATH' ) || exit;).
• Security Fix: Removed undefined role function in multisite check.
• Security Fix: Hardened input sanitization with wp_unslash(), strict ID integer filtering, and sort order whitelist validation.
• Security Fix: Enhanced output escaping with esc_url() for permalinks and esc_attr() for form input values.
• Security Fix: Hardened Select2 rendering and popover title rename against DOM XSS.
• Performance & Compatibility: Scoped Select2 and admin script enqueues strictly to the plugin settings page.

5.0

• Added support for Taxonomies (Categories, Tags, Custom CPT Taxonomies).
• Added Drag & Drop reordering for both CPTs and Taxonomies.
• Added option to include CPT archive/page URL as the first link in each CPT section.
• Added ability to exclude specific taxonomy terms alongside posts and pages.
• Added Select2 search and multi-select for easily excluding posts and terms with type icons.
• Redesigned options page with responsive layout, type icons, and tooltips.
• Cleaned up empty post types and empty taxonomy headings when no visible items exist.
• Added welcome admin notice directing users to Settings -> Kwayy HTML Sitemap.
• Compatibility tested up to WordPress 7.1 and PHP 8.2.

4.0

• Security enhancements.

3.1

• Small changes and added “Support Us” block on option page.

3.0

• Added support to customize display titles of custom post types.

2.0

• Added support to exclude posts.
• Added CSS classes to sitemap lists for custom design.
• Wrapped sitemap content in a container div.
• Redesigned options page.

1.0.8

• Replaced wrong shortcode description with correct details.

1.0.7

• Added sort order support to list all posts on sitemap page.

1.0.6

• Bug fix for links.

1.0.5

• Updated documentation and support details.

1.0.4

• Updated code to show posts in tree view.

1.0.3

• Bug fixes.

1.0.2

• Bug fixes.

1.0.1

• Initial release.