v2.6.6 — Modern gateways, new CSS, security hardening

What's New

Payment Gateways

• PayPal — completely rewritten from legacy Standard Payments + IPN to modern REST API (Orders v2) + JS SDK. Popup checkout instead of redirect, config via Client ID + Secret
• PayU — new gateway for Polish payments. REST API v2.1, OAuth2, webhook notifications with MD5 signature verification
• Przelewy24 — streamlined flow, reads donor data from session (one-step checkout)
• Dotpay — removed (service no longer exists)
• Dedicated buttons per gateway with branded styling (P24 red with logo, PayU green, PayPal gold SDK)

Design

• New modern wdf-default CSS style — responsive, card-based layout with CSS custom properties for easy theming
• Replaced 5 legacy themes (basic, dark, fresh, minimal, note)

Security

• Fixed SQL injection in generate_pledge_id()
• Added CSRF protection on settings save and tutorial AJAX
• Sanitized all transaction fields in manual gateway
• Validated $_GET['tab'] parameter with whitelist
• Fixed broken HTML label attributes
• Replaced custom email regex with WordPress is_email()

UX

• One-step checkout — donor data collected once, no redundant gateway form
• Payment flow validation with clear error messages
• Admin notice when no payment gateway is active
• Sample data seeder on first activation

Installation

Download wp-simple-donations.zip below, upload via Plugins > Add New > Upload Plugin in WordPress admin, and activate.

Requirements

• WordPress 5.0+
• PHP 8.3+