EffortLess Association Member Manager

Changelog

2.12.93 – 2026-08-22

• Fix: the JSON export/import file and the profile photo upload validated the file’s name and temporary path without confirming they came from the current request’s own file upload. Both now use is_uploaded_file() before reading the file and sanitize_file_name() before the name is used anywhere, including in log entries.
• Fix: the “members can edit their own profile” setting sanitized its stored value with a raw boolean cast, which treats the string “false” as true; it now uses rest_sanitize_boolean().
• Fix: the email-attachment upload loaded two admin files it never used (media.php, image.php) alongside the one it does (file.php).
• Change: the donate notice’s outbound link no longer includes the site address as a query parameter. It still identifies the plugin and version so support requests can be matched to a release, but not which installation was viewing it.

2.12.92 – 2026-08-13

• Change: recording a subscription no longer emails the member automatically. The Add Subscription form has a new “Send notification email to the member” box, off by default — tick it when the member should be told. Quick subscribe, the one-click button in the members list, now records the payment silently; use the Add Subscription form when you want the email. Renewal reminders for expiring and expired memberships are unaffected and still go out on schedule.

2.12.91 – 2026-08-12

• Change: “Send welcome email to new members” on the CSV import screen is now off by default. An import can create hundreds of members at once and sent email cannot be recalled, so notifying everyone is now something you opt into rather than something you have to remember to switch off. Tick the box to send as before.

2.12.90 – 2026-08-12

• Fix: a site left with no membership roles now gets the three defaults (Member, Board Member, Guest) back automatically. They were only ever created when the plugin was activated, and WordPress does not re-run activation when a plugin is updated, so a site that reached an empty list stayed that way — leaving every role dropdown blank. Roles you renamed or deleted yourself are untouched; the defaults are only restored when the list is completely empty.
• New: the three default role names are translated for display, so they read Membre / Membre du bureau / Invité in French and Miembro / Miembro de la junta / Invitado in Spanish. The stored value stays in English, so switching the site language re-labels them and role names remain stable for imports and exports.
• Fix: CSV import now recognises a role given either by its stored name or by its translation, so a file prepared on a site running in another language imports correctly.

2.12.89 – 2026-08-12

• Fix: “Estimated Recipients” on the Send Email page stayed blank instead of showing the number of members. The page’s script was never loaded, because the plugin recognised its own admin screens by a fixed name that WordPress builds from the (translated) menu title — so it matched no site at all, and no site running in another language could ever have matched. The same fault was silently skipping the styles and scripts of the Settings, Add Member, Roles, Trash and Email Queue screens, which now load as intended.

2.12.88 – 2026-08-12

• Fix: member profile links returned a 404 on sites where WordPress is installed in its own subdirectory. The links were built from the address of the WordPress files rather than the address of the site, so they pointed outside the area the /member/ route serves. Affects the trombinoscope, the admin Members and Subscriptions lists, the {profile_url} email placeholder, and the redirect after saving a profile.

2.12.87 – 2026-08-12

• Fix: the “Personal Options” and “Application Passwords” sections of the profile screen are now found by their position in the page rather than by reading their heading text, so no translated string is involved and the sections are hidden correctly in every language.

2.12.85 – 2026-08-12

• Fix: the “Personal Options” and “Application Passwords” sections of the profile screen are hidden correctly in every language. They are hidden by matching WordPress’s own section headings, and the plugin previously compared them against its own translations of those headings — which only matched in English, French and Spanish, and left the sections visible in any other locale. The headings now come from WordPress’s own translations, so the match cannot drift.

Older changelog entries have been removed to keep this section within WordPress.org’s length limits.