Ultimate Member Version History

**Enhancements**

* Added: UM > Settings > Advanced > APIs section for set available APIs settings.
* Added: GoogleMaps API setting when it's available.
* Added: Function `UM()->mail()->enabled_email()` for checking if the email notification is enabled by the user.
* Added: `color` type of sanitize settings saved in wp-admin.
* Added: Checking array type of submission data when `url` type of sanitize is used in wp-admin.
* Added: Enhance UM form sanitization filter with $form_data param. Added the $form_data parameter to the `um_sanitize_form_submission` filter.
* Added: Option for special character requirement for passwords. It's situated in "General > Users > Password requires special character" (based on @faisalahammad suggestions)
* Added: Filter hook `um_before_account_delete_text` for changing before delete account text by 3rd-party plugins. End-customers can use it for translations.
* Added: Filter hook `um_custom_{$message_key}` (`um_custom_pending_message`, `um_custom_checkmail_message`) for changing after-registration message based on the user status by 3rd-party plugins. End-customers can use it for translations.
* Added: Filter hook `um_convert_tags_blacklist_fields` For 3rd-party integrations to control the usermeta keys in `um_convert_tags()` function.
* Added: `.um-display-none` CSS utility + `umShow()/umHide()/umToggle()` jQuery helpers.
* Added: `um-notice` JS library.

**Bugfixes**

* Fixed: Security issue, CVE ID: CVE-2026-4248. Added blacklist filter for convert_tag replace placeholders function.
* Fixed: HTML sanitization logic for textarea-type custom fields with enabled HTML using setting.
* Fixed: WP editor formatting to prevent incorrect HTML entity conversion when using html-mode in the textarea-type custom fields. Applied and removed this filter dynamically to avoid interfering with other processes.
* Fixed: Dynamic string translation pattern and improve escaping. Replaced incorrect __('%s') pattern. (@faisalahammad)
* Fixed: `wp_die()` function triggering on the frontend actions. Added UM notice above the User Profile page. (based on @faisalahammad suggestions)
* Fixed: Password reset key handling for multiple users. Previously, the static reset key caused issues when handling password resets for multiple users simultaneously.
* Fixed: `um_trim_string()` function for using with UTF-8 symbols.
* Fixed: PHP Notice: Function WP_Scripts::add was called incorrectly.

**Templates Requiring Update**

* members.php
* message.php
* restricted-blog.php
* restricted-taxonomy.php

**Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**

**Enhancements**

* Added: Server-side validation when the Search Form is submitted.
* Added: Action hook `um_approve_user_on_email_confirmation` to natively approve the user after validating the email activation link.
* Added: JS filter wp.hook `um_member_directory_popstate_ignore` to stop window.pushSate in the member directory for 3rd-party integrations.

**Bugfixes**

* Fixed: Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It's still allowed to use only predefined 'user_description' tags in `wp_kses()`.
* Fixed: Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.
* Fixed: Profile photo dropdown menu position for screens smaller than 340px.
* Fixed: Display of the saved value of the "Privacy Options" > "Allowed roles" setting for the member directory.
* Fixed: Information in Site-Health about the registration form's `Template` and `Role` settings.
* Fixed: Information in Site-Health about the login and profile form's `Template` settings.

**Templates Requiring Update**

* members.php
* searchform.php

**Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**