- **new:** Added a pending-ticket badge to the admin Vendor Support menu so open tickets are visible at a glance.
- **new:** Added Germanized EU compliance field support to the new vendor product editor so vendors no longer need the legacy form.
- **update:** Made Germanized order withdrawal multi-vendor aware so each vendor can confirm or reject the request for their own sub-order.
- **fix:** Fixed ShipStation order export failing for orders that contain fee line items.
- **fix:** Prevented partial refunds via Authorize.Net from being cancelled when approved by an admin.
- **fix:** Showed the "Auto" refund type label for payment gateway refunds instead of "Manual".
- **fix:** Restricted abuse-report management to marketplace administrators.
- **fix:** Patched a SQL injection in the RMA warranty conversation lookup by binding the request ID as an integer.
- **fix:** Fixed Apple Pay not opening inside the Stripe Express Payment Element on Safari.
- **fix:** Prevented stored cross-site scripting in the Geolocation map info windows by escaping vendor-supplied shop names, titles, and links.
- **fix:** Ensured product add-on groups can only be deleted by their owner.
- **fix:** Restricted the all-order-logs CSV export to marketplace administrators so vendor orders and earnings stay private.
- **update:** Removed a duplicated copy of the Tailwind framework from admin and dashboard stylesheets for smaller, cleaner asset bundles.
- **fix:** Fixed repeat partial refunds failing on PayPal Marketplace orders by sending a unique invoice reference for each refund.
- **fix:** Prevented stored cross-site scripting in the Live Chat script by escaping the vendor shop name and email.
- **fix:** Ensured bookable persons can only be removed from the vendor's own booking products.
- **new:** Added auction product support to the new vendor product editor so vendors can create and edit auctions without the legacy form.
- **update:** Showed the Stripe Express payment method in block checkout only when every vendor in the cart has completed onboarding.
- **fix:** Prevented duplicate order notes on single-vendor orders paid via Stripe Express.
- **fix:** Prevented stored cross-site scripting in the Booking module's Manage Bookings list by escaping customer names and emails.
- **fix:** Ensured Product Add-ons can only be edited by their owner.
- **fix:** Ensured MangoPay account signup, disconnection, and saved-card actions apply only to the vendor's own account.
- **fix:** Ensured vendors can only update or delete reviews on their own products.
- **fix:** Ensured auction products can only be edited by their owner.
- **fix:** Ensured ShipStation shipment notifications apply only to the vendor's own orders.
- **new:** Added a "Clear Dokan Caches" tool on the admin Tools page so stale marketplace data can be refreshed in one click.
- **new:** Showed the staff member's name on the Manage Permissions page so vendors always know whose access they are editing.
- **update:** Hid Tax Status and Tax Class on the vendor product form when tax calculations are turned off, removing fields that had no effect.
- **fix:** Kept admin-only subscription packs fully hidden from vendors, including on the subscription page and at checkout.
- **fix:** Fixed a fatal error when generating a Credit Note while the Subscription module is active.
- **fix:** Hardened the Booking module so bookings and booking resources can only be viewed, changed, or deleted by their rightful owner.
- **fix:** Hardened vendor delivery time updates so they can only be saved against a vendor's own orders.
- **fix:** Patched a cross-site scripting vulnerability in the Elementor store template preview.
- **fix:** Prevented stored XSS in the Live Chat (Tawk.to) module by escaping vendor Property and Widget IDs in the storefront chat script.
- **fix:** Improved seller-wise shipping package splitting when the WooCommerce cart is not yet ready.
- **fix:** Improved Commission API category handling so the product editor's earning preview stays accurate.
- **fix:** Ensured vendor's own draft and hidden products remain visible in the new dashboard product list when the Request for Quotation module is active.
- **fix:** Refined the admin Product Q&A table column widths for a clearer, more consistent layout.
- **new:** Added store pickup support to Delivery Time on block checkout, excluding shipping charges for pickup vendors with live order total updates.
- **update:** Migrated admin dashboard list tables to the unified DataViews experience for consistent tabs, filters, search, and actions.
- **update:** Added a "Search by Author" filter to the vendor dashboard reviews page.
- **fix:** Patched SQL injection via the latitude and longitude parameters in the geolocation query.
- **fix:** Patched SQL injection via the orderby parameter in the Request for Quotation list query.
- **fix:** Fixed a vendor-staff privilege escalation in the update_capabilities REST endpoint.
- **fix:** Prevented Stripe Express transfers from exceeding the charge amount when admin coupons are applied.
- **fix:** Enforced the subscription product limit during bulk edit on the vendor dashboard.
- **fix:** Loaded AI image enhancer assets on the new vendor dashboard layout product and auction pages.
- **fix:** Corrected the free shipping "Only X away" notice to show only when free shipping is actually available on classic checkout.
- **fix:** Lazy-loaded product editor taxonomies to prevent memory exhaustion on stores with large catalogues.
- **fix:** Fixed the empty Rank Math SEO panel in the new product editor when Rank Math bundles a newer CMB2 version.
- **fix:** Fixed untranslated subscription limit notices on the vendor dashboard product listing page.
- **new:** Added Product Add-ons support to the new vendor product editor so vendors can manage add-ons without legacy editor.
- **new:** Added a Rank Math SEO section to the new product editor with the full Rank Math metabox UI.
- **new:** Added vendor-specific coupons analytics data on the vendor report analytics.
- **fix:** Adjusted the RTL switcher translation for improved layout consistency.