The Official Blog for LifterLMS Contributors

Security Update

This releases fixes two security issues affecting LifterLMS versions 4.21.0 and earlier:

• Thank you to Amirmohammad vakili for reporting a way to store XSS.
• Thank you to Ashish Jha from Bluefire Redteam for reporting a reflected XSS issue on checkout screens.

• Default form templates now use reusable blocks.
• Improved the user experience surrounding fields with a confirmation field (email address and password).
• Added the ability to define a field’s column width instead of requiring the usage of WP column blocks.
• Added support for reusable blocks on form posts
• Upgraded LifterLMS Blocks to 2.0.0-beta.3.

Updates

• Certificate exports will now automatically include (most) externally hosted images and stylesheets.
• Opt-in forward compatibility changes have been made to the LLMS_Abstract_Options_Data class.

Bugfixes

• Fixed an issue causing one-time payment orders from being included in totals on some reporting screens.
• Fixed an issue causing student enrollment counts to be incorrect under some circumstances.
• Fixed issues resulting in unnecessary duplicated instances of course background data processing.
• Fixed an error encountered when a course is deleted prior to its background data being processed.
• Fixed an escaping issue causing passwords with a backslash character from being usable following a password reset.

• Fixed issue preventing users from editing their email address and password on the dashboard account edit screens.
• Fixed issues with country names with the article “the” in their name, for example “The Netherlands” instead of “Netherlands The”.
• Upgraded LifterLMS Blocks to version 2.0.0-beta.2.