Ultimate Member Core Plugin 2.8.4 Nulled

**Enhancements**

* Tweak: Added separate file for full changelog. readme.txt shows only a few latest versions

**Bugfixes**

* Fixed: Member directory data sanitizing (CVE-2024-2123)
* Fixed: Activation link time changed from seconds to days
* Fixed: Password validation error
* Fixed: Password reset url for the approved user who didn't set their password after registration without password
* Fixed: Conflict with WebP Uploads

* Enhancements:

- Added: The `data` protocol for embedding base64 encoded logos in emails
- Added: Hook `um_access_restricted_post_instance` for filtering the restricted post instance
- Added: Shortcode `[um_author_profile_link]` for getting user Profile URL
- Updated: Using underscore.js native debounce method for resize handler
- Updated: Texts spelling

* Bugfixes:

- Fixed: AJAX requests conflict with `um_current_locale` attribute
- Fixed: Pickadate styling (Date & Time fields) in wp-admin screen
- Fixed: RTL styling and removed `um` class from UM frontend predefined pages
- Fixed: select2 conflict with Impreza theme
- Fixed: cropper conflict with Avada theme and active Fusion Image lazyload
- Fixed: MegaMenu conflict with nav menu items conditional settings (e.g. Newsletter theme)
- Fixed: PHP Fatal error when there isn't a proper WP_Post object in UM User Profile > Posts loop
- Fixed: Account styles
- Fixed: Saving `um_form_version` postmeta

* Templates required update:

- profile/posts-single.php

* Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade

* Enhancements:

- Updated: Twitter texts to X
- Added: Safeguards against clickjacking attacks on UM Forms

* Bugfixes:

- Fixed: Displaying notice to avoid using wrong symbols
- Fixed: UM > Settings button styles
- Fixed: Error notice when creating page via extensions
- Fixed: Workaround for Cropper.JS if UM.frontend.cropper.obj undefined (Cropper hasn't been properly inited for UM objects)
- Fixed: The visibility of sub-items of hidden menu items

* Enhancements:
- Added: Site Health sections
- Added: oEmbed field type
- Added: YouTube field type supports YouTube Shorts links
- Added: Profile permalink base options: Unique hash, Custom usermeta
- Added: UM Form meta `um_form_version` for legacy support in the future
- Added: Setting "Deleting user comments after deleting a user" for WordPress native logic workaround
- Added: `aria-invalid` and `aria-errormessage` attributes to the fields on UM Forms
- Updated: Structure for enqueue assets PHP classes
- Updated: [Hooks Documentation v2](https://ultimatemember.github.io/ultimatemember/hooks/)

* Bugfixes:
- Fixed: Member directory search query escaping process
- Fixed: Added 'ID' metakey to the blacklist. It's not possible to create field with 'ID' metakey to avoid the conflict
- Fixed: Add/Edit Field metabox and "Field Icon", "Conditional logic" fields
- Fixed: Init `jquery-slider-ui` script/style on the block editor page
- Fixed: Displaying "Notifications Account Tab" setting
- Fixed: Displaying Post Date on the User Profile > Posts tab based on this [article](https://make.wordpress.org/core/2019/09/23/date-time-improvements-wp-5-3/)
- Fixed: Small PHP warning, notices and typos

* Deprecated:
- `UM()->enqueue()` use `UM()->frontend()->enqueue()` method
- `UM()->admin_enqueue()` use `UM()->admin()->enqueue()` method
- `UM()->admin_enqueue()->suffix` property use `UM()->frontend()->enqueue()::get_suffix()`
- `UM()->admin()->enqueue()->suffix` property use `UM()->frontend()->enqueue()::get_suffix()`
- Changed directories for the fonts (fonticons + raty), and JS/CSS files related to libs `jquery-ui`, `raty`, `select2`, `tipsy`, `fonticons (FontAwesome + Ionicons)`

* Templates required update:
- account.php
- login.php
- password-change.php
- password-reset.php
- register.php
- profile/posts-single.php

* Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade

- Fixed: Empty mail From data when there isn't set an option
- Fixed: Nonce validation for the admin actions handler
- Fixed: REST API endpoint List Pages redirecting to the homepage
- Fixed: Standardize the 'editable' attribute for the UM fields and hooks that can extend these fields
- Fixed: Redirection from default WordPress registration to UM registration page (if it's not a published)

• Bugfixes:
  • Fixed: A privilege escalation vulnerability used through UM Forms. Known in the wild that vulnerability allowed strangers to create administrator-level WordPress users. Please update immediately and check all administrator-level users on your website.
  • Fixed: Displaying fields on Account page > Privacy > Member directory settings
  • Fixed: Allowed types for the file field
  • Fixed: Disabled weekdays for the datepicker field

- Fixed: Password Confirm field and validation
- Fixed: Form Builder row editing
- Fixed: Spotify URL user URL display on user profile
- Fixed: Spotify URL validation

• Bugfixes:
  • Fixed: Email notifications sending
  • Fixed: File and Image uploaders and allowed types data for them
  • Fixed: Content field-type editor in wp-admin Form Builder
  • Fixed: Image and File uploaders max size saving in wp-admin Form Builder

* Enhancements:
- Added: Hook arguments ($form_id, $not_searched) to 'um_members_directory_head'
- Added: Using user locale `get_user_locale()` for localization with the 1st priority
- Added: Hooks to change the profile SEO image: 'um_profile_dynamic_meta_image_size', 'um_profile_dynamic_meta_image_type'
- Added: Filter for making 3rd-party roles editable through Ultimate Member interfaces. Use 'um_extend_editable_roles' and pass there an array of role keys( e.g. 'editor', 'administrator', etc. )

* Bugfixes:
- Fixed: Major issues with the Member Directory search line
- Fixed: Social links (Twitch, TikTok, Reddit) colors in profile header
- Fixed: Exclude registered date field from editable fields
- Fixed: Create the custom table for usermeta if does not exists
- Fixed: Locale loading time and hook for that
- Fixed: Used `wp_unslash()` for input POST data on Change Password
- Fixed: Role setting "Avoid indexing profile by search engines"
- Fixed: Date Picker field value format for 3rd-party integration meta fields
- Fixed: Last login timestamp being lost in the users cache
- Fixed: Textdomain typos
- Fixed: Small PHP warnings and notices

* Deprecated:
- Deprecated: VKontakte and Google+ predefined fields. VKontakte and Google+ fields validation changed to just URL validation.

* Templates required update:
- members.php

• Enhancements:
  • Added: TikTok, Twitch and Reddit fields
  • Added: Handler of restriction settings for blog page
  • Added: Support of the <iframes> inside textarea with enabled the “HTML using” option
  • Added: ‘um_get_field_date’ hook for filtering date fields
  • Added: UM()->get_allowed_html() function for using it inside wp_kses allowed HTML tags
• Bugfixes:
  • Fixed: Redirect to some links when content is restricted. Using esc_url_raw() instead of esc_url() for redirect to URLs inside class-access.php
  • Fixed: Handle restriction settings for attachments, later hook is used for checking capabilities through current_user_can()
  • Fixed: Honeypot triggering in password reset, when not set
  • Fixed: Small PHP notices and warnings