- Improved : Nexter SEO : the Site Audit no longer checks Theme Builder templates (headers, footers, sections) or other builder and template types, so they stop appearing under Orphan pages and Thin content. Post types you exclude from the sitemap are skipped by the audit too, and developers can adjust the list with the nexter_seo_audit_excluded_post_types filter.

- Improved : Nexter SEO : the category base and WooCommerce base options now flush rewrite rules once per request instead of once per category or product term, so bulk imports no longer rebuild the rules for every term.

- Improved : SMTP Email : the mail server's certificate is now verified by default, so a server that only pretends to be your mail host can no longer receive your SMTP login and your mail. Sites that already had SMTP set up are kept as they were, with self-signed certificates still allowed, and see a notice explaining the change. A site that needs self-signed certificates can use the allow_self_signed setting, the NEXTER_SMTP_ALLOW_SELF_SIGNED constant or the nxt_smtp_allow_self_signed filter.

- Improved : Dashboard : keyboard users can now see which control has focus on buttons, switches and the upgrade and install pop-up buttons, focus rings and some borders have more contrast, and pop-up dialogs move focus into the dialog, keep Tab inside it and make the rest of the admin inert while it is open.

- Improved : internal security hardening from a full code audit: the Theme Builder visitor-IP display condition is documented as non-authoritative, a browser-detection header read is now sanitized, duplicating a post no longer unserializes its meta without restricting which classes may be instantiated, the plugin/theme installer's wordpress.org lookups try JSON before falling back to a restricted unserialize, and the SEO settings, import and post/term REST endpoints now validate and sanitize every parameter against its declared schema. No user-facing behaviour changes.

- Fixed : Theme Builder : importing a template no longer ends in a fatal error. Importing now needs the manage options permission, which the Editor role did not have by design, and a template can only be exported by someone who can edit it.

- Fixed : Theme Builder : a widget that throws an error no longer leaves the page's main query switched, a template with no post no longer causes an error, and the preview link for an Author Archive template now works.

- Fixed : Theme Builder : a template made for one specific page no longer loses to an All Pages template just because it is older, and templates saved without a logged-in user (WP-CLI, importer, cron) now refresh the cached template list.

- Fixed : Theme Builder : editing a template's display conditions no longer drops saved Specific Pages/Posts; only the first 20 of each type were loaded, so the rest vanished and were lost on save.

- Fixed : Display Conditions : the Specific Pages and Archives pickers no longer crash on an empty request.

- Fixed : Display Conditions : the pickers no longer show other users' private and draft posts, or the full user list, to Contributors.

- Fixed : Image Optimisation : converting an image now requires permission to edit that image, so an Author can no longer convert or overwrite someone else's.

- Fixed : Image Optimisation : deleting an image from the Media Library now also deletes its converted copies and backups. Before, they stayed downloadable from the optimizer folder and piled up on disk, and the delete check can no longer be tricked by a path containing ...

- Fixed : SVG Upload : SVGs added through importers, demo kits and WP-CLI are no longer rejected as an invalid upload, and the PHP 8 deprecation notice shown on every upload is gone.

- Fixed : Captcha : Cloudflare Turnstile now refuses login, registration, password reset and comment forms that arrive without a token, not only the ones with a wrong token.

- Fixed : Local Google Fonts : only real fonts.googleapis.com links are downloaded, and the original link is kept, with a 15-minute pause, when a download fails instead of leaving the fonts missing.

- Fixed : WP Debug Mode : switching it on and off now edits wp-config.php safely. It no longer adds a second define on setups like Docker or Bedrock, sets WP_DEBUG_DISPLAY so visitors do not see PHP errors, finds a wp-config.php one folder above the site, and no longer ends in an error page when the file is not writable.

- Fixed : Code Snippets : the safety check no longer switches off ordinary snippets, such as loops that contain a break, code that calls get_permalink(), or file writes to a path built in the code.

- Fixed : Replace URL : now also replaces the JSON-escaped URLs that Elementor and other builders store, and handles serialized objects, so a domain change no longer leaves old images and links behind.

- Fixed : Nexter SEO : a post marked noindex is now dropped from the sitemap straight away instead of staying for up to 12 hours.

- Fixed : Nexter SEO : the XML sitemap now lists every language on sites using Polylang. Only the default language was included, so posts and pages under /fr/ or /en/ were missing. All languages are now listed with their hreflang alternates, and the sitemap rebuilds as soon as the plugin is updated or a language is added.

- Fixed : Nexter SEO : llms.txt now lists posts and tags in every language on sites using Polylang, the same gap already fixed on the XML sitemap. Only the default language was included before; pages were unaffected since they're chosen by hand.

- Fixed : Nexter SEO : with the WooCommerce base removal on, product, product category and product tag links no longer return 404 on permalink structures other than Post name, nested categories included.

- Fixed : View Admin Role Switcher : an account demoted through WordPress's bulk role change, the REST API or the single-user edit screen could regain its former Administrator role through the switcher's own restore link; the cleanup now runs on every role change, not only on a profile save.

- Fixed : Advance Security : Remove Meta Generator now works on block themes such as Twenty Twenty-Five, and no longer closes another plugin's output buffer.

- Fixed : Disable Comments : the comments REST routes are now really closed, and existing comments are hidden on block themes too.

- Fixed : Post Revision Control : the revision limit and the post-type setting now take effect. Before, a post edited 8 times kept 8 revisions with the limit set to 3.

- Fixed : Content Post Order : reordering no longer empties caches shared with other sites on the server, and a visitor's own ?orderby= sort is respected.

- Fixed : Disable Admin Settings : sites that already define a remove_core_updates() function no longer get a Cannot redeclare error on every admin page.

- Fixed : Dashboard : the What's New feed is cleaned before it is shown.

- Fixed : Translations : the plugin's translation files are now loaded from the right folder.

- Fixed : Login Limiter : a wrong two-factor code is now counted against the visitor's IP address, so it counts toward the lockout.

- Fixed : Adobe Fonts : saving now changes only its own setting, checks the kit ID, and reports success when the kit is cleared. SMTP also no longer shows a warning when its saved values have no type.

- Fixed : Post Duplicator : the number of copies is capped at 50, adjustable with the nxt_duplicate_post_max_copies filter, and a user who cannot publish now gets a pending copy instead of a published one.