Kwayy HTML Sitemap changelog and version history

20263 releases

1. Kwayy HTML Sitemap 5.2Latest

   Sep 7, 2026
   • Security Fix: Enforced explicit post_status => 'publish' and viewability checks on sitemap queries to prevent unpublished draft and private post leakage in cached environments.
   • Security Fix: Added recursion cycle detection and depth guards ($visited tracking and max depth) to prevent infinite loops and denial of service from circular post or taxonomy hierarchies.
   • Security Fix: Hardened Select2 rendering against DOM XSS.
   • Security Fix: Restricted admin notice dismissal script and nonce enqueuing strictly to administrators with manage_options.
   • Security Fix: Enhanced output escaping with wp_kses_post() for translation strings and esc_attr_e() for form attributes.
   • Performance: Refactored taxonomy term rendering into a single database query with in-memory tree building, eliminating N+1 database queries.
   • Performance: Optimized admin settings exclude query with no_found_rows and disabled meta/term cache updates to conserve memory.
   • Bug Fix: Fixed timing issue where settings saved notice failed to display after saving options.

2. Kwayy HTML Sitemap 5.1

   Sep 6, 2026
   • Security Fix: Added nonce verification (wp_nonce_field and check_admin_referer) to prevent Cross-Site Request Forgery (CSRF) on settings save (CVE-2026-65539).
   • Security Fix: Added capability check (manage_options) and nonce verification (check_ajax_referer) to admin notice dismissal endpoint.
   • Security Fix: Added direct file access protection (defined( 'ABSPATH' ) || exit;).
   • Security Fix: Removed undefined role function in multisite check.
   • Security Fix: Hardened input sanitization with wp_unslash(), strict ID integer filtering, and sort order whitelist validation.
   • Security Fix: Enhanced output escaping with esc_url() for permalinks and esc_attr() for form input values.
   • Security Fix: Hardened Select2 rendering and popover title rename against DOM XSS.
   • Performance & Compatibility: Scoped Select2 and admin script enqueues strictly to the plugin settings page.

3. Kwayy HTML Sitemap 5.0

   Sep 5, 2026
   • Added support for Taxonomies (Categories, Tags, Custom CPT Taxonomies).
   • Added Drag & Drop reordering for both CPTs and Taxonomies.
   • Added option to include CPT archive/page URL as the first link in each CPT section.
   • Added ability to exclude specific taxonomy terms alongside posts and pages.
   • Added Select2 search and multi-select for easily excluding posts and terms with type icons.
   • Redesigned options page with responsive layout, type icons, and tooltips.
   • Cleaned up empty post types and empty taxonomy headings when no visible items exist.
   • Added welcome admin notice directing users to Settings -> Kwayy HTML Sitemap.
   • Compatibility tested up to WordPress 7.1 and PHP 8.2.