• Added : Cookie Consent : New GDPR/CCPA cookie banner block with consent categories, a preferences modal, and a privacy policy link — renders through Nexter Extension’s consent engine.

• Fixed : Theme Builder : Theme Builder menu item now opens the Theme Builder screen correctly.

- Added : Cookie Consent : collect, store and honour visitor cookie consent, with prior script blocking of non-essential vendors until a visitor decides, consent-record logging with configurable IP handling and retention, Google Consent Mode v2 integration, and a live Compliance Check report.

- Fixed : Content SEO : the meta description fallback no longer executes shortcodes on a page with no excerpt, which was causing shortcode-rendered content (e.g. FluentCart's customer dashboard navigation) to duplicate on the front end.

- Fixed : Theme Builder : the dashboard screen loaded from the theme now registers its translatable strings under the correct text domain, so theme-side dashboard translations load as expected.

- Fixed : Code Snippets : the Import Snippets drop zone now has proper padding around its text.

- Fixed : Code Snippets : the Cloud Library "Import Pre-Made Code Snippets" popup and other lazily loaded dashboard screens now show their translations; strings in the dashboard's split build chunks were never loaded before.

- Fixed : SVG Upload : the role names in "roles allowed to upload SVG" are now shown in the site language.

- Fixed : Disable Gutenberg : long translated labels in the Only On / Except On / All Types switch now wrap inside their segment instead of overflowing it.

- Fixed : Admin Menu : the arrow on the "Get Nexter Pro" menu item no longer overlaps longer translated labels.

• Improvement : Accordion : Full keyboard support and screen-reader roles for headers and panels.

• Improvement : Tabs & Tours : Keyboard arrow-key navigation and proper screen-reader roles.

• Improvement : Form : Required and error states announced to screen readers, with focus moved to the first invalid field.

• Improvement : Login / Register : Error messages are now announced to screen readers.

• Improvement : Product Add to Cart : Variation swatches are now keyboard accessible with proper radio roles and selected state.

• Improvement : Mini Cart : Cart drawer now keeps keyboard focus inside it and closes on the Escape key.

• Fix : GSAP Scroll Interaction : Advanced scroll animations now work for Color, Font Size, Letter Spacing, Opacity, Vertical, Horizontal, Border Radius, and Box Shadow.

• Fix : Popup Builder : Off-canvas toggle now opens when clicking the icon inside the toggle button.

• Fix : Controls : Number and slider fields now stay within their min/max limits (opacity no longer accepts -1 or 2).

• Fix : Compatibility : Accordion, Tabs & Tours, and Form fields updated without breaking existing content.

• Security : Multiple Blocks : Hardened security by properly escaping dynamic data attributes and sanitizing position and URL inputs to prevent XSS.

• Improvement : Coupon Code : Moved to server-side rendering for better performance and stability.

• Fix : Social Feed : Fixed Load More not working due to an invalid feed ID being sent.

• Fix : Product Listing : Fixed an undefined option that could break the Load More button.

• Fix : Popup Builder : Position values are now sanitized to prevent invalid output.

• Fix : Container : Fixed self-hosted video background not loading due to URL escaping.

• Fix : Countdown : Redirect URL and expiry message are now sanitized for safe output.

• Fix : Media Listing, Dynamic Category : Fixed metro layout data attributes being output unescaped.

• Added : Search Bar : No-results fallback — show suggested posts when a search returns nothing.

• Improvement : Accordion : Full keyboard support and screen-reader roles for headers and panels.

• Improvement : Tabs & Tours : Keyboard arrow-key navigation and proper screen-reader roles.

• Improvement : Form : Required and error states are announced to screen readers, and focus moves to the first invalid field.

• Improvement : Switcher : Toggle supports Enter/Space keyboard interaction and reports its on/off state.

• Improvement : Stylist List : Item spacing can now be set to 0.

• Fix : Breadcrumbs : Dynamic Field set on the Home Title now displays its value instead of raw code.

• Fix : Search Bar : Added nonce protection and throttling to search requests.

• Fix : Blocks Spacing : A spacing value set to 0 now applies correctly.

• Fix : Controls : Number and slider fields now stay within their minimum and maximum limits.

• Fix : Compatibility : Accordion, Tabs & Tours, Switcher, Flipbox, Infobox, and Form fields updated without breaking existing content.

• Security : Multiple Blocks : Escaped dynamic data attributes to prevent XSS.

• Improvement : Search Bar : Added nonce refresh and rate limiting for safer search and form requests.

• Fix : Navigation Builder : Fixed a stored-XSS risk in mega-menu link text.

• Fix : Countdown : Redirect URL is now sanitized for safe output.

• Fix : Info Box : Fixed carousel settings not applying due to undefined values.

• Fix : Social Embed : Twitter profile link now uses correct URL escaping.

• Fix : Post Comment : Logout text is now safely escaped.

• Fix : Creative Image, Flipbox, Testimonials, Post Image, Smooth Scroll : Fixed data attributes being output unescaped.

- Improved : New Dashboard : refreshed the admin dashboard's UI with clearer visual hierarchy, more consistent spacing and iconography, and more legible controls across every tab.

- Improved : Translations : every translatable string with a placeholder in the dashboard now carries a translators comment, so generating the translation file no longer warns about them.

- Improved : Code Snippets : the "MemberPress not installed" notice now uses the same confirmation dialog design as the WooCommerce notice, for a consistent look across eCommerce plugin checks.

- Improved : Code Snippets : the Location picker and Conditions tab's selected checkmark and tooltip no longer overlap, and all four condition tabs are evenly spaced.

- Compatibility : Abilities (MCP) : each ability file now stops early when the WordPress Abilities API (WordPress 6.9+) is not available, so sites on older WordPress versions never call wp_register_ability().

- Improvement : 2FA (Authenticator) : the authenticator secret is now stored encrypted; secrets saved by earlier versions are encrypted the first time they are read, so nobody has to set the authenticator up again

- Improvement : Security : 2FA signs the user out of their other sessions when the authenticator is set up or removed

- Improvement : removed unused code, unused helper functions and unused images

- Fixed : Security : 2FA authenticator setup now refuses a secret shorter than 16 characters

- Fixed : 2FA : a stored secret that can no longer be read now fails the sign-in instead of throwing an error on the login screen

- Fixed : 2FA (Email) : the code mail now states the real lifetime of the code instead of a fixed 10 minutes, and the code field offers one-time-code autofill

- Fixed : Security : Hide Author URLs : ?author=ID now redirects to the random author URL, the author-<login> body class is removed, and links of the retired slug scheme no longer resolve; plain permalinks and unknown users are left untouched

- Fixed : Redirect 404 : no more redirect loop when the target page is itself missing, and missing images, scripts, stylesheets, fonts, media and .well-known files now stay 404

- Fixed : Admin Menu Organizer : custom menu titles containing commas are kept, a page restriction now works wherever the page parameter sits in the URL, and a damaged saved option no longer breaks the admin

- Fixed : Right Click Disable : no longer active inside page-builder and Customizer previews

- Fixed : Clean User Profile : the hidden-field list is now encoded safely

- Fixed : Login Email Notification : the alert text in the plain-text mail shows & and < as typed

- Fixed : the development country constants are no longer defined by the plugin, so every private-IP visitor is not treated as being in India; minimum WordPress is now 5.9

- Fixed : Security : Hide Author URLs : visiting an author URL whose slug doesn't resolve to a real user now returns a real 404 instead of the "Page not found" template with a 200 OK status.

- Improved : Nexter SEO : the Site Audit no longer checks Theme Builder templates (headers, footers, sections) or other builder and template types, so they stop appearing under Orphan pages and Thin content. Post types you exclude from the sitemap are skipped by the audit too, and developers can adjust the list with the nexter_seo_audit_excluded_post_types filter.

- Improved : Nexter SEO : the category base and WooCommerce base options now flush rewrite rules once per request instead of once per category or product term, so bulk imports no longer rebuild the rules for every term.

- Improved : SMTP Email : the mail server's certificate is now verified by default, so a server that only pretends to be your mail host can no longer receive your SMTP login and your mail. Sites that already had SMTP set up are kept as they were, with self-signed certificates still allowed, and see a notice explaining the change. A site that needs self-signed certificates can use the allow_self_signed setting, the NEXTER_SMTP_ALLOW_SELF_SIGNED constant or the nxt_smtp_allow_self_signed filter.

- Improved : Dashboard : keyboard users can now see which control has focus on buttons, switches and the upgrade and install pop-up buttons, focus rings and some borders have more contrast, and pop-up dialogs move focus into the dialog, keep Tab inside it and make the rest of the admin inert while it is open.

- Improved : internal security hardening from a full code audit: the Theme Builder visitor-IP display condition is documented as non-authoritative, a browser-detection header read is now sanitized, duplicating a post no longer unserializes its meta without restricting which classes may be instantiated, the plugin/theme installer's wordpress.org lookups try JSON before falling back to a restricted unserialize, and the SEO settings, import and post/term REST endpoints now validate and sanitize every parameter against its declared schema. No user-facing behaviour changes.

- Fixed : Theme Builder : importing a template no longer ends in a fatal error. Importing now needs the manage options permission, which the Editor role did not have by design, and a template can only be exported by someone who can edit it.

- Fixed : Theme Builder : a widget that throws an error no longer leaves the page's main query switched, a template with no post no longer causes an error, and the preview link for an Author Archive template now works.

- Fixed : Theme Builder : a template made for one specific page no longer loses to an All Pages template just because it is older, and templates saved without a logged-in user (WP-CLI, importer, cron) now refresh the cached template list.

- Fixed : Theme Builder : editing a template's display conditions no longer drops saved Specific Pages/Posts; only the first 20 of each type were loaded, so the rest vanished and were lost on save.

- Fixed : Display Conditions : the Specific Pages and Archives pickers no longer crash on an empty request.

- Fixed : Display Conditions : the pickers no longer show other users' private and draft posts, or the full user list, to Contributors.

- Fixed : Image Optimisation : converting an image now requires permission to edit that image, so an Author can no longer convert or overwrite someone else's.

- Fixed : Image Optimisation : deleting an image from the Media Library now also deletes its converted copies and backups. Before, they stayed downloadable from the optimizer folder and piled up on disk, and the delete check can no longer be tricked by a path containing ...

- Fixed : SVG Upload : SVGs added through importers, demo kits and WP-CLI are no longer rejected as an invalid upload, and the PHP 8 deprecation notice shown on every upload is gone.

- Fixed : Captcha : Cloudflare Turnstile now refuses login, registration, password reset and comment forms that arrive without a token, not only the ones with a wrong token.

- Fixed : Local Google Fonts : only real fonts.googleapis.com links are downloaded, and the original link is kept, with a 15-minute pause, when a download fails instead of leaving the fonts missing.

- Fixed : WP Debug Mode : switching it on and off now edits wp-config.php safely. It no longer adds a second define on setups like Docker or Bedrock, sets WP_DEBUG_DISPLAY so visitors do not see PHP errors, finds a wp-config.php one folder above the site, and no longer ends in an error page when the file is not writable.

- Fixed : Code Snippets : the safety check no longer switches off ordinary snippets, such as loops that contain a break, code that calls get_permalink(), or file writes to a path built in the code.

- Fixed : Replace URL : now also replaces the JSON-escaped URLs that Elementor and other builders store, and handles serialized objects, so a domain change no longer leaves old images and links behind.

- Fixed : Nexter SEO : a post marked noindex is now dropped from the sitemap straight away instead of staying for up to 12 hours.

- Fixed : Nexter SEO : the XML sitemap now lists every language on sites using Polylang. Only the default language was included, so posts and pages under /fr/ or /en/ were missing. All languages are now listed with their hreflang alternates, and the sitemap rebuilds as soon as the plugin is updated or a language is added.

- Fixed : Nexter SEO : llms.txt now lists posts and tags in every language on sites using Polylang, the same gap already fixed on the XML sitemap. Only the default language was included before; pages were unaffected since they're chosen by hand.

- Fixed : Nexter SEO : with the WooCommerce base removal on, product, product category and product tag links no longer return 404 on permalink structures other than Post name, nested categories included.

- Fixed : View Admin Role Switcher : an account demoted through WordPress's bulk role change, the REST API or the single-user edit screen could regain its former Administrator role through the switcher's own restore link; the cleanup now runs on every role change, not only on a profile save.

- Fixed : Advance Security : Remove Meta Generator now works on block themes such as Twenty Twenty-Five, and no longer closes another plugin's output buffer.

- Fixed : Disable Comments : the comments REST routes are now really closed, and existing comments are hidden on block themes too.

- Fixed : Post Revision Control : the revision limit and the post-type setting now take effect. Before, a post edited 8 times kept 8 revisions with the limit set to 3.

- Fixed : Content Post Order : reordering no longer empties caches shared with other sites on the server, and a visitor's own ?orderby= sort is respected.

- Fixed : Disable Admin Settings : sites that already define a remove_core_updates() function no longer get a Cannot redeclare error on every admin page.

- Fixed : Dashboard : the What's New feed is cleaned before it is shown.

- Fixed : Translations : the plugin's translation files are now loaded from the right folder.

- Fixed : Login Limiter : a wrong two-factor code is now counted against the visitor's IP address, so it counts toward the lockout.

- Fixed : Adobe Fonts : saving now changes only its own setting, checks the kit ID, and reports success when the kit is cleared. SMTP also no longer shows a warning when its saved values have no type.

- Fixed : Post Duplicator : the number of copies is capped at 50, adjustable with the nxt_duplicate_post_max_copies filter, and a user who cannot publish now gets a pending copy instead of a published one.

• Improved : internal security hardening from a full code audit: Code Snippets' access check now uses a capability instead of a role name, the Theme Builder visitor-IP display condition is documented as non-authoritative, a browser-detection header read is now sanitized, duplicating a post no longer unserializes its meta without restricting which classes may be instantiated, the plugin/theme installer's wordpress.org lookups try JSON before falling back to a restricted unserialize, and the SEO settings, import and post/term REST endpoints now validate and sanitize every parameter against its declared schema. No user-facing behaviour changes.

• Fixed : Nexter SEO : with the WooCommerce base removal on, product, product category and product tag links no longer return 404 on permalink structures other than Post name, nested categories included.

• Fixed : Theme Builder : editing a template's display conditions no longer drops saved Specific Pages/Posts; only the first 20 of each type were loaded, so the rest vanished and were lost on save.

• Fixed : Nexter SEO : the XML sitemap now lists every language on sites using Polylang. Only the default language was included, so posts and pages under /fr/ or /en/ were missing. All languages are now listed with their hreflang alternates, and the sitemap rebuilds as soon as the plugin is updated or a language is added.

• Fixed : View Admin Role Switcher : an account demoted through WordPress's bulk role change, the REST API or the single-user edit screen could regain its former Administrator role through the switcher's own restore link; the cleanup now runs on every role change, not only on a profile save.

Nexter Extension Free - 05 Oct 2026

• Improved : Nexter SEO : Site Audit findings now list the pages they are about, each with a view and an edit link; the CSV and JSON exports carry the same per-item detail.

• Fixed : Custom Login URL : the hidden login address now works on Plain permalinks. The address the plugin generated opened the home page instead of the login form, leaving no way in.

• Fixed : View Admin Role Switcher : switching back to your own account no longer breaks when the feature is turned off or an unrelated profile save clears the stored role, and the Switch back button now also appears on the front end.

• Fixed : Nexter SEO : the post-import check no longer reports a correct import as failed; it now checks only the fields the import actually wrote, against the value that was stored.

• Fixed : Code Snippets : a PHP snippet could break admin screens and JSON replies, such as the Site Audit, by printing text into them. Snippet output is now discarded during REST and JSON requests, so snippets that register REST routes still work.

• Fixed : Image Optimisation : AVIF and WebP copies are now served through a picture element, so Safari on iPhone and iPad and search-engine crawlers no longer receive the original JPG or PNG.

• Fixed : Nexter SEO : No Index, No Follow, No Archive and Exclude from Sitemap now save for a post type that only exists in admin screens, such as Complianz's, and an unrelated save no longer erases them.

• Fixed : Translations : the translator notes on the SEO import check message and the Search & Replace result message now stay attached to their text in the built files.

Nexter Blocks - PRO — 2 days ago

• Improved : Widgets Screen : Editor dependencies now load on the widgets screen, matching the free plugin's block widget area support.

• Improved : Editor Dependencies : Script dependency list updated for the current block editor (adds moment, wp-compose, wp-data, wp-hooks, wp-preferences, wp-rich-text).

• Improved : Order Review Block : Tax rows and totals now carry dedicated classes for consistent styling.

• Fix : Form : Editor no longer crashes when a form has an old or invalid saved action value.

• Fix : Form : Required checkbox no longer shows "field is required" when a box is already ticked.

• Fix : Form : Multi Step progress bar now stays on one row and labels no longer clip on mobile.

• Improvement : Single Product Image : Advanced & global options (animation, custom CSS, position) now apply on the frontend.

• Improvement : Single Product Image : Active gallery thumbnail stays visible and centered across all column settings.

• Improvement : Post Listing : Search List now supports category, tag, and pagination options.

• Improvement : Product Listing : Search List now supports product category and tag options.

• Improvement : Order Review : Tax / VAT row now displays with proper border and styling.

• Improvement : Form : Design and responsive improvements.

• Improvement : Cart Table : Design and responsive improvements.

• Improvement : Thank You Order Details : Design and responsive improvements.

• Fix : Add to Cart : Hide WooCommerce 11.1 duplicate product gallery in the variations form.