v1.0.4

Security

Fixes a cross-origin disclosure of the WordPress REST nonce in the popup, and a related same-tab navigation race. A malicious page could otherwise cause the extension to read and leak a logged-in administrator's REST nonce from another WordPress site.

Advisory: GHSA-8h3m-hf57-9rj4. Affected: 0.8.0 through 1.0.3; patched in 1.0.4. Reported responsibly through HackerOne by Muhamad Arga Reksapati (nobcoder).

Detection and reliability

• Broader WordPress detection across more site configurations, including front-controller REST roots and additional detection signals.
• More reliable logged-in detection on cached sites, redirect-target validation on fresh detection, and detection performance improvements.

Install

• Chrome Web Store: https://chromewebstore.google.com/detail/wordpress-browser-extensi/apaakgfongbkeecchhhjocpgjchbdenl
• Mac App Store: https://apps.apple.com/app/id6794460913

Both stores auto-update. The attached zip is for manual (unpacked) installation.

Full changelog: v1.0.3...v1.0.4