1.2.1 - 2026-09-14

• SECURITY: The post-checkout redirect target is now validated with wp_validate_redirect(), so a crafted redirect_to value can no longer send members to an external site after signup. Sites that intentionally redirect off site can permit specific hosts with the allowed_redirect_hosts filter. #75 (@flintfromthebasement)
• BUG FIX: Fixed an issue where user field groups restricted to a specific membership level did not appear on the signup form or block. #74 (@dwanjuki)