- **fix:** Fixed Apple Pay not opening inside the Stripe Express Payment Element on Safari.
- **fix:** Prevented stored cross-site scripting in the Geolocation map info windows by escaping vendor-supplied shop names, titles, and links.
- **fix:** Ensured product add-on groups can only be deleted by their owner.
- **fix:** Restricted the all-order-logs CSV export to marketplace administrators so vendor orders and earnings stay private.
- **update:** Removed a duplicated copy of the Tailwind framework from admin and dashboard stylesheets for smaller, cleaner asset bundles.
- **fix:** Fixed repeat partial refunds failing on PayPal Marketplace orders by sending a unique invoice reference for each refund.
- **fix:** Prevented stored cross-site scripting in the Live Chat script by escaping the vendor shop name and email.
- **fix:** Ensured bookable persons can only be removed from the vendor's own booking products.
- **new:** Added auction product support to the new vendor product editor so vendors can create and edit auctions without the legacy form.
- **update:** Showed the Stripe Express payment method in block checkout only when every vendor in the cart has completed onboarding.
- **fix:** Prevented duplicate order notes on single-vendor orders paid via Stripe Express.
- **fix:** Prevented stored cross-site scripting in the Booking module's Manage Bookings list by escaping customer names and emails.
- **fix:** Ensured Product Add-ons can only be edited by their owner.
- **fix:** Ensured MangoPay account signup, disconnection, and saved-card actions apply only to the vendor's own account.
- **fix:** Ensured vendors can only update or delete reviews on their own products.
- **fix:** Ensured auction products can only be edited by their owner.
- **fix:** Ensured ShipStation shipment notifications apply only to the vendor's own orders.
- **new:** Added a "Clear Dokan Caches" tool on the admin Tools page so stale marketplace data can be refreshed in one click.
- **new:** Showed the staff member's name on the Manage Permissions page so vendors always know whose access they are editing.
- **update:** Hid Tax Status and Tax Class on the vendor product form when tax calculations are turned off, removing fields that had no effect.
- **fix:** Kept admin-only subscription packs fully hidden from vendors, including on the subscription page and at checkout.
- **fix:** Fixed a fatal error when generating a Credit Note while the Subscription module is active.
- **fix:** Hardened the Booking module so bookings and booking resources can only be viewed, changed, or deleted by their rightful owner.
- **fix:** Hardened vendor delivery time updates so they can only be saved against a vendor's own orders.
- **fix:** Patched a cross-site scripting vulnerability in the Elementor store template preview.
- **fix:** Prevented stored XSS in the Live Chat (Tawk.to) module by escaping vendor Property and Widget IDs in the storefront chat script.
- **fix:** Improved seller-wise shipping package splitting when the WooCommerce cart is not yet ready.
- **fix:** Improved Commission API category handling so the product editor's earning preview stays accurate.
- **fix:** Ensured vendor's own draft and hidden products remain visible in the new dashboard product list when the Request for Quotation module is active.
- **fix:** Refined the admin Product Q&A table column widths for a clearer, more consistent layout.
- **new:** Added store pickup support to Delivery Time on block checkout, excluding shipping charges for pickup vendors with live order total updates.
- **update:** Migrated admin dashboard list tables to the unified DataViews experience for consistent tabs, filters, search, and actions.
- **update:** Added a "Search by Author" filter to the vendor dashboard reviews page.
- **fix:** Patched SQL injection via the latitude and longitude parameters in the geolocation query.
- **fix:** Patched SQL injection via the orderby parameter in the Request for Quotation list query.
- **fix:** Fixed a vendor-staff privilege escalation in the update_capabilities REST endpoint.
- **fix:** Prevented Stripe Express transfers from exceeding the charge amount when admin coupons are applied.
- **fix:** Enforced the subscription product limit during bulk edit on the vendor dashboard.
- **fix:** Loaded AI image enhancer assets on the new vendor dashboard layout product and auction pages.
- **fix:** Corrected the free shipping "Only X away" notice to show only when free shipping is actually available on classic checkout.
- **fix:** Lazy-loaded product editor taxonomies to prevent memory exhaustion on stores with large catalogues.
- **fix:** Fixed the empty Rank Math SEO panel in the new product editor when Rank Math bundles a newer CMB2 version.
- **fix:** Fixed untranslated subscription limit notices on the vendor dashboard product listing page.
- **new:** Added Product Add-ons support to the new vendor product editor so vendors can manage add-ons without legacy editor.
- **new:** Added a Rank Math SEO section to the new product editor with the full Rank Math metabox UI.
- **new:** Added vendor-specific coupons analytics data on the vendor report analytics.
- **fix:** Adjusted the RTL switcher translation for improved layout consistency.
- **update:** Loaded AI image enhancer assets in the product editor only when AI image/text features are enabled.
- **fix:** Resolved vendor inbox chat layout and height inconsistencies for a responsive, viewport-aware UI.
- **fix:** Fixed untranslated Quick Edit, Duplicate, and Advertise strings on the vendor dashboard products page.
- **update:** Loaded AI image enhancer assets in the product editor only when AI image/text features are enabled.
- **fix:** Resolved vendor inbox chat layout and height inconsistencies for a responsive, viewport-aware UI.
- **fix:** Fixed untranslated Quick Edit, Duplicate, and Advertise strings on the vendor dashboard products page.