Improved : internal security hardening from a full code audit: Code Snippets' access check now uses a capability instead of a role name, the Theme Builder visitor-IP display condition is documented as non-authoritative, a browser-detection header read is now sanitized, duplicating a post no longer unserializes its meta without restricting which classes may be instantiated, the plugin/theme installer's wordpress.org lookups try JSON before falling back to a restricted unserialize, and the SEO settings, import and post/term REST endpoints now validate and sanitize every parameter against its declared schema. No user-facing behaviour changes.

Fixed : Nexter SEO : with the WooCommerce base removal on, product, product category and product tag links no longer return 404 on permalink structures other than Post name, nested categories included.

Fixed : Theme Builder : editing a template's display conditions no longer drops saved Specific Pages/Posts; only the first 20 of each type were loaded, so the rest vanished and were lost on save.

Fixed : Nexter SEO : the XML sitemap now lists every language on sites using Polylang. Only the default language was included, so posts and pages under /fr/ or /en/ were missing. All languages are now listed with their hreflang alternates, and the sitemap rebuilds as soon as the plugin is updated or a language is added.

Fixed : View Admin Role Switcher : an account demoted through WordPress's bulk role change, the REST API or the single-user edit screen could regain its former Administrator role through the switcher's own restore link; the cleanup now runs on every role change, not only on a profile save.