Security fix: the pymoptions shortcode/block attribute is now parsed against an allowlist of known Pym.js Parent options (xdomain, title, name, id, sandbox, parenturlparam, parenturlvalue, allowfullscreen, optionalparams, trackscroll, scrollwait) and JSON-encoded at output time. Previously the attribute was inlined verbatim into the new pym.Parent(...) call, which made it a stored XSS sink for any user who could author content. Documented usage (e.g. pymoptions=" xdomain: '*\.npr\.org' ") continues to work; arbitrary JavaScript values are dropped.
Backwards-incompatible change: the pluggable function pym_shortcode_script_footer_enqueue now receives $args['pymoptions'] as an associative array of sanitized options rather than a raw JavaScript object body string. Sites that override this pluggable function must update their override to consume the array (and JSON-encode it safely on output).