4.10.5

Changelog

• Fixed: Re-release of 4.10.4 for WordPress.org (correct plugin version header, stable tag, and checksums).
• Fixed: Fatal error on Scheduled Actions screen when Action Scheduler 4.1 is loaded (Issue #1684).

4.10.4

Changelog

• Fixed: Fatal error on Scheduled Actions screen when Action Scheduler 4.1 is loaded (Issue #1684).

4.10.3

Changelog

• Fixed: Future Action metabox now correctly appears in the sidebar (Issue #1641).
• Fixed: Improved compatibility with Polylang when post IDs include a language code (Issue #1637).
• Fixed: Workflows list status change and copy workflow actions no longer throw createRoot is not defined in the browser console (Issue #1640).
• Changed: Admin React entry points now mount via createRoot from @wordpress/element instead of react-dom/client, matching WordPress script dependencies (Issue #1640).
• Changed: Removed unused @wordpress/i18n imports across workflow editor, backup panel, and workflows list components.
• Changed: Update translation files.

4.10.2

Changelog

• Added: Added new language files for locales: ar, cs_CZ, da_DK, el, en_US, fa_IR, he_IL, or_RO, pl_PL, sv_SE, th, tr_TR, and vi.
• Changed: Updated existing translations.
• Fixed: WordPress.org translations now correctly take priority over custom or AI-generated strings, ensuring consistent language display while still merging all available sources.
• Fixed: Enhanced translations for JavaScript interfaces, particularly in the settings and workflow editor.
• Fixed: Post metadata is now available in its updated state for Post Update, Save, and Publish triggers (Issue #1626).
• Fixed: Bulk action "Update Future Actions from Post Metadata" now works correctly for Future Actions.
• Fixed: Debug log auto-refresh now updates the footer summary (displayed/total counts, sessions, and log size) along with the log content.
• Security: Escape [futureaction] shortcode output when rendered inside an HTML wrapper to prevent stored XSS from unescaped expiration date text.
• Security: Add permission checks to restrict access to workflow settings.
• Security: Escape workflow, trigger, step, and post data in scheduled action admin output to prevent stored XSS in Action Scheduler listings.
• Security: Bulk sync for "Update Future Actions from Post Metadata" now uses WordPress bulk action handling, with per-post "expire" and "edit" capability checks.
• Security: Require nonce verification when saving manual workflow selections via Quick Edit.
• Security: Add granular permission checks to workflow manual triggering.

4.10.1

Changelog

• Fixed: Update language strings.
• Security: Stored XSS via [futureaction] shortcode (CVE-2026-5247, CVSS 5.5 Medium). Insufficient input sanitization allowed authenticated attackers (administrator-level or lower-privileged users when the shortcode is available to them) to inject arbitrary web scripts into pages. Thanks to zaim for the responsible disclosure.

4.10.0

Changelog

• Added: Add new trigger: Post is created - PRO, (Issue #1146).
• Added: Debug log view shows total logs displayed, session count, and log size (filter-aware; shows both filtered and total when filter applied).
• Added: Debug log timestamps now include milliseconds.
• Added: Debug log filter to show only requests where a workflow trigger was activated.
• Added: Debug log request_id column for request correlation, with migration for existing sites.
• Added: Debug log display option to toggle between time sequence and grouped by request views.
• Added: Debug log autorefresh option.
• Added: Workflow engine logs "Engine finished processing" on shutdown when debug is enabled.
• Added: Added cache for workflow execution context variables to increase performance when resolving variables repeated times, disabled by default (Issue #1581).
• Added: Added new language files for German, Finnish, Filipino, Indonesian, Japanese, Korean, Russian, and Yoruba translations.
• Added: Added new constant PUBLISHPRESS_FUTURE_VARIABLES_CACHE as a flag to enable a experimental cache for context variables in the workflow execution (Issue #1581).
• Changed: Debug log now defaults to grouped by request display.
• Changed: Move the scheduled actions "Run" button to it's own column, (Issue #1496).
• Changed: Workflow debug log messages rewritten for clarity and consistency (format, parentheses for details, [Workflow] prefix).
• Changed: Replace UUID generation with a more secure method in the workflow's execution ID, also incresing performance on huge sites (Issue #1579).
• Fixed: Improve performance on large multisites by memoizing table existence checks, using information_schema instead of SHOW TABLES LIKE, and creating the debug log table only on first use (Issue #1597).
• Fixed: Debug log enable/disable in Diagnostics and Tools tab now reflects the correct state immediately without needing a second page refresh.
• Fixed: Improved reliability of the "Post is Published" and "Post is Updated" triggers by fixing how post metadata is handled on block editor and when ACF is enabled (Issue #1312).
• Fixed: Fixed post saved related events not triggering when revisions is saved (Issue #1582).
• Fixed: Update .pot file.
• Deprecated: StepProcessorInterface::prepareLogMessage() in favor of direct logger sprintf methods.

4.9.4

Changelog

Added

• Enhance workflow management with custom capabilities (Issue #1540).
  • Introduced new workflow capabilities: edit_publishpress_workflows, publish_publishpress_workflows, unpublish_publishpress_workflows
  • Update REST API to use workflow-specific capabilities instead of generic edit_posts
  • Add X-PP-Workflow-Nonce verification to all workflow endpoints for enhanced security

Fixed

• Published pages via Future Actions show incorrect View links (Issue #1539).
• Unable to edit imported workflow (Issue #1544).
• "Query posts" step doesn't work when post type is not specified for custom posts, (Issue #1546)
• Update ES-FR-IT translations (Issue #1537).

Full Changelog: 4.9.3...4.9.4

4.9.3

Changelog

Added

• Added new conditional operators for workflow steps: "Is empty" and "Is not empty", allowing you to check if a value or field is empty or not within conditional logic (Issue #1518).

Fixed

• Warning: Undefined array key "id" on an imported workflow, (Issue #1524)
• Unable to re-schedule "On Schedule" trigger if it was already executed, (Issue #1527)
• "Update post details" step not working with "Query posts" step, (Issue #1503).
• Fixed how variable helpers are interpreted inside JSON logic conditions (Issue #1517).
• "Query Posts" step has invalid settings validation, (Issue #1525)
• Update ES-FR-IT translations (Issue #1477).
• Remove email field from getAuthors REST API endpoint.
• Convert workflow operations from GET to POST requests
• Add capability checks for all workflow actions
• Improve utils stripTags function
• Implement backup structure validation to ensure data integrity
• Add sanitization methods for workflows and settings data
• Improve input validation with proper type checking and whitelisting
• Enhanced workflow setDescription() method with wp_kses_post() sanitization
• Enhance post expiration extraData data validation
• Improve query parameter handling in settings controller
• Enhance template rendering validation and path security
• Add nonce verification to processMetaboxUpdate method
• Improve input sanitization in debug log download
• Add proper permission checks for post expiration data access
• Add input sanitization for workflow node data values

Full Changelog: 4.9.2...4.9.3

4.9.2

Changelog

Added

• Add "User Role After Change" criteria to "User role is changed" trigger, (Issue #1473).

Changed

• Re-organize Action Workflows quick edit links, (Issue #1479)
• Resize workflow editor expression box modal, (Issue #1480)
• Redirect users to "Action Workflows" screen on plugin activation, (Issue #1454)
• Add validation to workflow schedule custom date source variable, (Issue #1481)

Fixed

• Update ES-FR-IT translations (Issue #1477).
• Enhance permission checks for REST API post modification endpoint, (Issue #1491).

Developers

• Fixed duplicated constant values for hooks between modules and the core, (Issue #1292).

Full Changelog: 4.9.1...4.9.2

4.9.1

Changelog

Added

• Add "Run" and "Cancel" Bulk Edit in Scheduled Actions screen, (Issue #1461).
• Restore "User role change" trigger - PRO, (Issue #1212)

Changed

• Enable "Cancel Scheduled Actions" link for active workflow, (Issue #1455).
• Text changes for User role is changed, (Issue#1209)

Fixed

• DoAction step arguments not available as variables in subsequent workflow steps, (Issue #1467).
• Custom i18n wrapper doesn't fall back to original string when translation is empty, (Issue #1465).
• "No results found." message is breaking when using nl_NL, showing a JS error message, (Issue #1140).
• TypeError: t.terms.forEach is not a function, (Issue #1169).

Full Changelog: 4.9.0...4.9.1