Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Injection Guard · Version history

Injection Guard changelog and version history

Latest version
1.4.0
Oct 31, 2026 (9 days ago)
Releases
12
since 2022
In the last year
4
about one every 82 days
Tested up to
WordPress 7.1.4
PHP 7.2 or later

Releases each year

  • 20221 release
  • 20232 releases
  • 20242 releases
  • 20253 releases
  • 20264 releases

20264 releases

  1. Injection Guard 1.4.0Latest

    • Tested up to WordPress 7.1.
    • New: attack-signature scan of query strings (off / record / block).
    • New: Blocked tab and blocked-requests list (anonymised IPs, rate-limited writes) with CSV export; log CSV export.
    • New: Settings tab: safe parameters (prefix patterns), global blacklist, 404 or 403 response, log limits and retention, proxy / CDN IP header choice, administrator exemption.
    • New: dashboard counters, log search and filters, clear-log button, capability audit search with flagged-only filter and last-login column.
    • New (Pro): automatic IP ban, email alerts, new-administrator watch, extended signatures and scanner user agents, IP allowlist, capability audit CSV.
    • Fix: the request log was overwritten by every visit of a non-administrator, so logging only worked while an administrator was browsing. Logging now works for all visitors.
    • Fix: bulk whitelist / blacklist saved the wrong URL for paths containing a slash; single actions and bulk actions now share the same normalisation.
    • Fix: the capability audit table never filled because its rows were parsed outside a table; the endpoint now returns JSON. A stray global table {} style was removed from the admin.
    • Fix: block check and log compared different spellings of a parameter (for example Foo and foo); both are now normalised, as are encoded and dot-segment paths, so such variations no longer slip past a blacklist.
    • Fix: block page no longer renders blank on block themes or themes without a 404 template.
    • Security: bounded the log (parameters per request, per URL, name length) so a flood of random query strings cannot bloat the database; the log is no longer autoloaded and is written only when something changes.
    • Security: visitor IP now uses REMOTE_ADDR unless a trusted proxy header is selected (forwarded headers can be forged); the IP history per user is capped.
    • Security: removed the dashboard ?hash debug export that wrote customer email hashes and password hashes to a file in the plugin folder; any leftover ab-hash.dat is deleted on update.
    • Security: AJAX handlers answer with JSON errors, validate every input, and settings are saved through a nonce-protected admin-post handler; CSV exports neutralise spreadsheet formulas; the debug helper pree() is restricted to administrators and escapes its output.
    • Fix: WooCommerce customer table no longer needs WooCommerce to be installed, works with HPOS orders, and escapes all output; external geolocation lookups are cached, time-limited and validated.
    • Improvement: no plugin file parsing on public page views; script versions use the plugin version instead of the current time so browsers can cache them.
    • Improvement: text domain is now loaded, remaining strings are translatable, an uninstall.php removes the plugin’s data, and privacy-policy text is provided.

  2. Injection Guard 1.3.1

  3. Injection Guard 1.3.0

    • Security: Fixed Stored XSS vulnerability by sanitizing query parameter keys, escaping admin output, improving query handling, and adding a log size limit. [Thanks to Wordfence / 15/03/2026 / Aramsri (Boeing777)].

  4. Injection Guard 1.2.9

    • Security Fix: Added depth-limited recursive sanitization for all POST/array inputs to prevent possible injection or malformed data attacks. [Thanks to Wordfence / 28/02/2026].
    • Security Fix: Enforced stricter nonce and super-admin checks on bulk whitelist/blacklist updates. [Thanks to Wordfence / 28/02/2026].
    • Security Fix: Standardized all AJAX JSON responses to use wp_send_json_success() / wp_send_json_error() for safer output. [Thanks to Wordfence / 28/02/2026].

20253 releases

  1. Injection Guard 1.2.8

    • Security Fix: Escaped $_SERVER['REQUEST_URI'] output to prevent Reflected Cross-Site Scripting (XSS) vulnerability in the admin logs tab. [Thanks to WPScan / 22/07/2025].

  2. Injection Guard 1.2.7

    • Enhanced security for capability audit with proper nonce validation and admin-only access.

  3. Injection Guard 1.2.6

    • Added user session tracking, logout history, and capability audit with proper prefixing (ig_) and textdomain usage. [Thanks to Hila / 10/04/2025]

20242 releases

  1. Injection Guard 1.2.5

  2. Injection Guard 1.2.4

    • Updated version for WordPress. [05/06/2024]

20232 releases

  1. Injection Guard 1.2.3

    • Updated version for pioneer. [Thanks to alianwaar91][11/05/2023]

  2. Injection Guard 1.2.2

    • Updated version for vulnerable to Broken Access Control. [Thanks to Darius Sveikauskas | Patchstack Alliance overlord][10/05/2023]

20221 release

  1. Injection Guard 1.2.1

    • Updated version for WordPress. [07/09/2022]

Questions about Injection Guard’s releases

What is the latest version of Injection Guard?

1.4.0, released on Oct 31, 2026 (1 week ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.2 or later.

How often is Injection Guard updated?

4 releases in the last year, about one every 82 days. Its first release on WordPress.org dates from September 2022.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Injection Guard’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.