Author: Leonardus N.

WordPress marked a huge milestone in May – its 20th anniversary! WordPress communities around the world were arranging Meetups events for the celebration.

But that didn’t make everyone in the WordPress ecosystem sit back and relax. In fact, we had two maintenance and security releases plus the WordPress 6.3 planning roundup. In addition, many popular plugins received important updates to fix vulnerability issues.

WordPress 20th Anniversary

WordPress communities all around the world were celebrating 20 years of WordPress. From in-person parties to interactive workshops, every community had its own way of commemorating the milestone.

Hostinger gave tribute to this milestone too. We did a Podcast with Tammie Lister, a prolific core contributor, to talk about Gutenberg’s evolution and how experimentation and feedback power WordPress development.

Watch the full podcast on our YouTube channel or read the summary blog post.

Another tribute we gave is the special edition Customer Spotlight blog post. We interviewed four our clients and discovered how they use WordPress to achieve online success:

• Lotte Johansen – a web accessibility advocate.
• Verônica Naka – the architect and CEO of Nakasa.
• Phoebe Poon – the CEO and co-founder of Liker Land and Web3Press plugin.
• Michelle Frechette – the marketer and podcaster of Audacity Marketing.

WordPress Updates

Interestingly, the month WordPress celebrates its anniversary turned out to be one of the busiest months for the core project. We had two new releases in just a span of four days.

WordPress 6.2.1 and 6.2.2

WordPress 6.2.1 and 6.2.2 was released on May 16, 2023, and May 20, 2023, respectively. So, what happened?

WordPress 6.2.1 fixed 20 core and 10 editor bugs. But most importantly, it addressed five security issues, including Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities, KSES sanitization bypass, and path traversal vulnerability.

However, there was still one security issue left due to the shortcode parsing in user-generated data in block themes. This means attackers could use user-generated content, like blog post comments, to execute shortcodes, resulting in exploitation risks.

The problem was that WordPress 6.2.1 fixed the issue simply by removing shortcode support from block templates. Unfortunately, this quick fix broke hundreds of websites that rely on block themes and shortcodes.

This is why WordPress 6.2.2 was released a few days after, with the sole purpose of resolving the shortcode vulnerability. In addition to restoring the shortcode support, this release also prevents the shortcode parsing that led to the vulnerability in the first place.

Gutenberg Updates

All of those WordPress core maintenance updates and release planning didn’t interrupt the Gutenberg release cycle, with two new versions launched this month. If you’re a block theme user, we recommend installing this plugin to have extensive features for the block editor.

Here are some of the highlighted features from the two Gutenberg versions released this month – 15.7 and 15.8:

Pages Menu on the Navigation Sidebar

Suppose you’re customizing your site with the site editor and need to edit a page. Instead of returning to the dashboard and opening the Pages panel, you can do it immediately from the site editor, thanks to the Pages menu on the left sidebar. It will display the 10 most recently updated pages to choose from.

Global Styles Revision UI.

Tracking revisions is one of the trickiest things to do in WordPress, but that’s improved with the revision UI for global styles. You can now revert to the past styles using the revision UI.

The revision tool is accessible through the ellipsis icon on the global styles panel. It will show you how many revisions are available, the time stamps, and the users who made the changes. To revert, select any of the versions and click Apply.

New Controls on the Block Settings Panel

Two blocks got new tools on their respective block settings panel to streamline the editing experience.

First, the site logo block now has the tool to add, replace, or reset the image. Although this functionality is the same as the block placeholder and the tool on the block toolbar, it still helps people who prefer to work on the block via the settings panel.

Second, the duotone control is now available on the block settings panel, specifically in the styles tab. Similar to the site logo block’s case, the functionality of this feature is the same as the duotone control on the toolbar. That said, having it on the block settings panel eliminates the need to go back and forth between those two areas to make the customization.

WordPress 6.3 Schedule

The next WordPress major release will be version 6.3, and the core team has finished the planning and schedule with the following dates:

• First beta version: June 27, 2023
• First release candidate: July 18, 2023
• WordPress 6.3 release: August 8, 2023

Testing the beta or release candidate versions can give you a sneak peek of the new features and test how your website will work with the upcoming release. Or, if you’re interested in contributing, report all bugs you’ve discovered in the WordPress forum.

WordPress Security News

Plugin developers were busy in May, as plenty of vulnerabilities were discovered. We ran through the Patchstack database and highlighted some popular plugins exposed to security risks.

But don’t worry. The developers have fixed the issues with the updates. All you have to do is check whether you run the latest version of the plugin and update it if necessary.

Easy Digital Downloads Privilege Escalation

CVSS Score: 9.8 (Critical Vulnerability)

In late April 2023, a privilege escalation vulnerability in the Easy Digital Downloads plugin was discovered that allows users – regardless of their roles – to run any function with the edd_ prefix.

Crucially, this prefix is used in the password reset function. Any malicious user can reset any user’s password, including the administrator, as long as they know the username and, thus, take over the website.

Given that Easy Digital Downloads is one of the most popular eCommerce plugins for selling digital goods, such vulnerabilities can cause a lot of damage.

Luckily, the patch to fix this issue – version 3.1.1.4.2, was released earlier this month. If you are still using the older version, we strongly advise updating it as soon as possible.

Essential Addons for Elementor Privilege Escalation

CVSS Score: 9.8 (Critical Vulnerability)

A similar privilege escalation vulnerability was also found in the Essential Addons for Elementor plugin. Due to the password reset function directly changing the user’s password instead of validating the reset key, it’s possible to reset any user’s password, given the attacker knows the username.

Like the Easy Digital Downloads vulnerability, an attacker can reset an administrator’s password and take over the website. The worse part is that over 1 million websites have this plugin installed on, and the Patchstack database shows that attackers have exploited this vulnerability.

The vulnerability affects versions 5.4.0 to 5.7.1. The patch for this issue is released in version 5.7.2, so if you use this plugin, be sure to have this version or higher installed.

LearnDash SQL Injection Vulnerability

CVSS Score: 8.5 (High Severity)

The popular WordPress LMS plugin – LearnDash, was exposed to SQL injection vulnerability. This type of security issue allows malicious users to access the database and sensitive information, including customer data.

Thus, such vulnerability can be extremely harmful to businesses, especially since LearnDash is most likely used by online course websites.

This issue affected LearnDash version 4.5.3 or lower. If you use LearnDash on your site, update to version 4.5.3.1 or higher to eliminate the risk.

Advanced Custom Fields XSS Vulnerability

CVSS Score: 7.1 (High Severity)

Advanced Custom Fields (ACF) free and premium versions were exposed to cross-site scripting (XSS) vulnerability. If you’re unfamiliar, XSS allows attackers to inject malicious code or script. It can result in a wide array of consequences.

The Patchstack report shows this vulnerability could lead to sensitive data theft and user privilege escalation. Although ACF is one of the most popular custom field plugins with over two million installations, Patchstack claims there are no exploitations detected.

The vulnerability affected version 6.1.5 or lower, and free and premium users are recommended to update to version 6.1.6.

Jetpack API Vulnerability

The Jetpack plugin’s team uncovered an API vulnerability during one of the internal security audits. The issue allows authors on the site to tweak any WordPress installation files – a privilege usually only available to administrators.

The API itself is available on Jetpack version 2.0 to 12.1. As a result, the Jetpack team release a patch for every version to fix this vulnerability, with the latest version being version 12.1.1.

Jetpack will force update the plugins on most websites with the vulnerable version. That said, we recommend you check your website if you use Jetpack and update it immediately if necessary.

What’s Coming In June

As we’ve mentioned, the beta testing phase for the next WordPress major release will start in June, and it’s always exciting to see the new features coming to the WordPress core.

However, there’s one more event that will delight the WordPress community even more.WordCamp Europe 2023 will take place on June 8-10, 2023, in Athens, Greece! We proudly support this event as a Super Admin sponsor and are excited to see you there. If you haven’t got your ticket already, it’s still available on the official WordCamp Europe website.

The post This Month in WordPress: May Roundup appeared first on Hostinger Blog.

WordPress marked a huge milestone in May – its 20th anniversary! WordPress communities around the world were arranging Meetups events for the celebration.

But that didn’t make everyone in the WordPress ecosystem sit back and relax. In fact, we had two maintenance and security releases plus the WordPress 6.3 planning roundup. In addition, many popular plugins received important updates to fix vulnerability issues.

WordPress 20th Anniversary

WordPress communities all around the world were celebrating 20 years of WordPress. From in-person parties to interactive workshops, every community had its own way of commemorating the milestone.

Hostinger gave tribute to this milestone too. We did a Podcast with Tammie Lister, a prolific core contributor, to talk about Gutenberg’s evolution and how experimentation and feedback power WordPress development.

Watch the full podcast on our YouTube channel or read the summary blog post.

Another tribute we gave is the special edition Customer Spotlight blog post. We interviewed four our clients and discovered how they use WordPress to achieve online success:

• Lotte Johansen – a web accessibility advocate.
• Verônica Naka – the architect and CEO of Nakasa.
• Phoebe Poon – the CEO and co-founder of Liker Land and Web3Press plugin.
• Michelle Frechette – the marketer and podcaster of Audacity Marketing.

WordPress Updates

Interestingly, the month WordPress celebrates its anniversary turned out to be one of the busiest months for the core project. We had two new releases in just a span of four days.

WordPress 6.2.1 and 6.2.2

WordPress 6.2.1 and 6.2.2 was released on May 16, 2023, and May 20, 2023, respectively. So, what happened?

WordPress 6.2.1 fixed 20 core and 10 editor bugs. But most importantly, it addressed five security issues, including Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities, KSES sanitization bypass, and path traversal vulnerability.

However, there was still one security issue left due to the shortcode parsing in user-generated data in block themes. This means attackers could use user-generated content, like blog post comments, to execute shortcodes, resulting in exploitation risks.

The problem was that WordPress 6.2.1 fixed the issue simply by removing shortcode support from block templates. Unfortunately, this quick fix broke hundreds of websites that rely on block themes and shortcodes.

This is why WordPress 6.2.2 was released a few days after, with the sole purpose of resolving the shortcode vulnerability. In addition to restoring the shortcode support, this release also prevents the shortcode parsing that led to the vulnerability in the first place.

Gutenberg Updates

All of those WordPress core maintenance updates and release planning didn’t interrupt the Gutenberg release cycle, with two new versions launched this month. If you’re a block theme user, we recommend installing this plugin to have extensive features for the block editor.

Here are some of the highlighted features from the two Gutenberg versions released this month – 15.7 and 15.8:

Pages Menu on the Navigation Sidebar

Suppose you’re customizing your site with the site editor and need to edit a page. Instead of returning to the dashboard and opening the Pages panel, you can do it immediately from the site editor, thanks to the Pages menu on the left sidebar. It will display the 10 most recently updated pages to choose from.

Global Styles Revision UI.

Tracking revisions is one of the trickiest things to do in WordPress, but that’s improved with the revision UI for global styles. You can now revert to the past styles using the revision UI.

The revision tool is accessible through the ellipsis icon on the global styles panel. It will show you how many revisions are available, the time stamps, and the users who made the changes. To revert, select any of the versions and click Apply.

New Controls on the Block Settings Panel

Two blocks got new tools on their respective block settings panel to streamline the editing experience.

First, the site logo block now has the tool to add, replace, or reset the image. Although this functionality is the same as the block placeholder and the tool on the block toolbar, it still helps people who prefer to work on the block via the settings panel.

Second, the duotone control is now available on the block settings panel, specifically in the styles tab. Similar to the site logo block’s case, the functionality of this feature is the same as the duotone control on the toolbar. That said, having it on the block settings panel eliminates the need to go back and forth between those two areas to make the customization.

WordPress 6.3 Schedule

The next WordPress major release will be version 6.3, and the core team has finished the planning and schedule with the following dates:

• First beta version: June 27, 2023
• First release candidate: July 18, 2023
• WordPress 6.3 release: August 8, 2023

Testing the beta or release candidate versions can give you a sneak peek of the new features and test how your website will work with the upcoming release. Or, if you’re interested in contributing, report all bugs you’ve discovered in the WordPress forum.

WordPress Security News

Plugin developers were busy in May, as plenty of vulnerabilities were discovered. We ran through the Patchstack database and highlighted some popular plugins exposed to security risks.

But don’t worry. The developers have fixed the issues with the updates. All you have to do is check whether you run the latest version of the plugin and update it if necessary.

Easy Digital Downloads Privilege Escalation

CVSS Score: 9.8 (Critical Vulnerability)

In late April 2023, a privilege escalation vulnerability in the Easy Digital Downloads plugin was discovered that allows users – regardless of their roles – to run any function with the edd_ prefix.

Crucially, this prefix is used in the password reset function. Any malicious user can reset any user’s password, including the administrator, as long as they know the username and, thus, take over the website.

Given that Easy Digital Downloads is one of the most popular eCommerce plugins for selling digital goods, such vulnerabilities can cause a lot of damage.

Luckily, the patch to fix this issue – version 3.1.1.4.2, was released earlier this month. If you are still using the older version, we strongly advise updating it as soon as possible.

Essential Addons for Elementor Privilege Escalation

CVSS Score: 9.8 (Critical Vulnerability)

A similar privilege escalation vulnerability was also found in the Essential Addons for Elementor plugin. Due to the password reset function directly changing the user’s password instead of validating the reset key, it’s possible to reset any user’s password, given the attacker knows the username.

Like the Easy Digital Downloads vulnerability, an attacker can reset an administrator’s password and take over the website. The worse part is that over 1 million websites have this plugin installed on, and the Patchstack database shows that attackers have exploited this vulnerability.

The vulnerability affects versions 5.4.0 to 5.7.1. The patch for this issue is released in version 5.7.2, so if you use this plugin, be sure to have this version or higher installed.

LearnDash SQL Injection Vulnerability

CVSS Score: 8.5 (High Severity)

The popular WordPress LMS plugin – LearnDash, was exposed to SQL injection vulnerability. This type of security issue allows malicious users to access the database and sensitive information, including customer data.

Thus, such vulnerability can be extremely harmful to businesses, especially since LearnDash is most likely used by online course websites.

This issue affected LearnDash version 4.5.3 or lower. If you use LearnDash on your site, update to version 4.5.3.1 or higher to eliminate the risk.

Advanced Custom Fields XSS Vulnerability

CVSS Score: 7.1 (High Severity)

Advanced Custom Fields (ACF) free and premium versions were exposed to cross-site scripting (XSS) vulnerability. If you’re unfamiliar, XSS allows attackers to inject malicious code or script. It can result in a wide array of consequences.

The Patchstack report shows this vulnerability could lead to sensitive data theft and user privilege escalation. Although ACF is one of the most popular custom field plugins with over two million installations, Patchstack claims there are no exploitations detected.

The vulnerability affected version 6.1.5 or lower, and free and premium users are recommended to update to version 6.1.6.

Jetpack API Vulnerability

The Jetpack plugin’s team uncovered an API vulnerability during one of the internal security audits. The issue allows authors on the site to tweak any WordPress installation files – a privilege usually only available to administrators.

The API itself is available on Jetpack version 2.0 to 12.1. As a result, the Jetpack team release a patch for every version to fix this vulnerability, with the latest version being version 12.1.1.

Jetpack will force update the plugins on most websites with the vulnerable version. That said, we recommend you check your website if you use Jetpack and update it immediately if necessary.

What’s Coming In June

As we’ve mentioned, the beta testing phase for the next WordPress major release will start in June, and it’s always exciting to see the new features coming to the WordPress core.

However, there’s one more event that will delight the WordPress community even more.WordCamp Europe 2023 will take place on June 8-10, 2023, in Athens, Greece! We proudly support this event as a Super Admin sponsor and are excited to see you there. If you haven’t got your ticket already, it’s still available on the official WordCamp Europe website.

The post This Month in WordPress: May Roundup appeared first on Hostinger Blog.

WordPress community is always in motion to create a better experience for its content management system users. This month, we’re treated with updates, patches, and feature development for various WordPress plugins.

In addition, sticking with the AI trend, we saw more AI adoption in the WordPress ecosystem. Most notably, Elementor, one of the big players, announced its plans to introduce more AI-powered features into the site builder. But more on that later – let’s look at what April has brought us.

WordPress Updates

Despite being a relatively quiet month for the WordPress core, there are still some interesting and important updates to talk about. Some experimental features got rolled out in Gutenberg, and Yoast updated its minimum requirements. 

Experimental Features in Gutenberg

April saw the release of Gutenberg versions 15.5 and 15.6, which brought three new interesting experimental features to users. To try them out, you must install and activate the Gutenberg plugin and activate the experiments from the Gutenberg → Experiments panel.

Grid Block

The grid block was introduced in Gutenberg 15.5. Acting as the new container block, the grid layout enables users to arrange content, such as displaying product features, in a way that wasn’t previously possible with the “group, row, and stack” block.

Currently, the grid block has a single setting to change the minimum column width, which will affect the number of columns. This block is also included in the container block transformation option, making it easier to transform the different blocks into each other. This way, if you want to change a stack block to a grid block, you simply click a button and get on with your day. 

Details Block

The details block, introduced in Gutenberg 15.6, lets users add a collapsible section to their pages to hide content. 

For example, you might want to hide a transcript or product details that may take up too much space if displayed by default. This block also comes in handy when users want to create an accordion menu.

The details block consists of a heading for the details summary and a child block. You can insert any core block you want into this block, including a query loop and an image. This gives great flexibility for adding any content inside the accordion.

Command Center

The last experimental feature we want to highlight is the command center. Also introduced as an experiment in Gutenberg 15.6, this feature acts as a shortcut for users to go to other posts, pages, templates, and template parts.

Users simply have to press Cmd/Ctrl + K in the Site Editor, and the command center pop-up will appear, showing the available items to jump to. Alternatively, use the search bar to find the item you want to pick.

Yoast SEO Increases PHP Requirement

Yoast launched two updates in April – version 20.5 and 20.6. But it’s the first update you should really pay attention to.

Version 20.5 will increase the PHP requirement to a minimum of PHP 7.2.5 or higher. This means that the plugin will no longer be compatible with previously supported versions – PHP 5.6, 7.0, and 7.1.

Yoast already posted a notice in November 2022 about increasing the minimum PHP requirement for the plugin. While it was initially planned for March 2023, Yoast finally implemented it in version 20.5, launched in mid-April 2023.

Elementor AI

Crafting a website with AI is still a hot topic online, and Elementor just jumped on the bandwagon. They just announced that AI technology is being introduced to their products.

Elementor’s first notable AI tool is the text generator. This tool lets users generate text for headings and content blocks with simple prompts. Thanks to the several handy quick prompts, you can refine the results by making the suggested text shorter or longer, simplifying the language, and fixing grammar issues. There are options to change the tone and translate the text.

The second intriguing feature is code-writing AI. Created to help write CSS and custom HTML code, this tool is useful for anyone who wants to create specific visual customization but doesn’t know how to code.

Currently, Elementor AI is available in the beta version of 3.13, with the final release estimation will be on May 8, 2023.

Upcoming Updates

Although we just got the latest major WordPress release last month, the WordPress team is already working on future updates.

The WordPress 6.2 release squad is working on the 6.2.1 minor updates to fix several bugs. While there is still no schedule for the update, the team is expected to deliver it in May.

As for the major update, the proposed plan is to ship WordPress 6.3 around August. The WordPress team is still calling for a release squad. If you’re interested, you can check out the Core Team blog post for more information.

WordPress Security News

This month, we had a rather unusual security breach: an abandoned plugin was exploited to create a backdoor on compromised websites. Not something you wish to happen to your site, right? We have also rounded up some plugins that launched patches to cover cross-site scripting (XSS) vulnerabilities.

Eval PHP

A security threat was found related to an abandoned Eval PHP plugin. Considered an abandonware, given the last update was over 10 years ago, the plugin was used to add PHP code to WordPress posts and pages. This created an opportunity for attackers to use it to create a backdoor to sites that had the plugin installed.

The attackers first need to install Eval PHP on compromised websites. Then they could insert the PHP code into posts and pages to create the backdoor.

The vulnerability was identified when an unusual spike of installs happened in the last few months despite the plugin’s dormant activity. This resulted in the WordPress Plugins team removing Eval PHP from the repository to prevent more installation and subsequent security threats.

It is recommended to check your website to ensure Eval PHP is not installed on your site. We recommend also securing your WordPress credentials to prevent compromising your site in the future.

Cross-Site Scripting (XSS) Vulnerabilities

Throughout April, some plugins were affected by cross-site scripting vulnerabilities. We’ve scanned through Patchstack data and listed some notable plugins detected with such vulnerabilities:

• All In One WP Security (1+ million active downloads). The cross-site scripting vulnerability affected version 5.1.4 or lower, with version 5.1.0 or lower also affected by cross-site request forgery (CSRF). Version 5.1.5 fixed all the issues, although we recommend updating to the latest version, 5.1.8, if you haven’t done so.
• MetaSlider (700,000+ active downloads). MetaSlider version 3.29 and lower are affected by a high-severity reflected cross-site scripting vulnerability. Version 3.30 fixes this issue, but only 22.8% of active downloads currently use the latest version. If you’re using this plugin, check your version and update it immediately if necessary.
• Limit Login Attempts (600,000+ active downloads). Two cross-site scripting vulnerabilities were detected in April, affecting version 1.7.1 and lower. The developer has patched them in version 1.7.2.

Featured WordPress Tools

WordPress is driven by creative contributors who develop themes, plugins, and other tools to improve the website creation experience. Here are some new additions to the WordPress family that we found interesting and worth mentioning.

Lovebird Theme

One of the captivating new WordPress block themes is Lovebird – a multipurpose block theme with a bold design and a feature-rich premium version. The demo version boasts a clean pink-themed style with a noisy image background, giving off retro vibes.

The magazine-inspired design makes Lovebird suitable for fashion or online magazine websites. Its bold and catchy style easily captures readers’ attention, and the strong typography selection makes the text pop out for max readability. The theme is also WooCommerce-ready, so starting a fashion store or charging for a magazine subscription is possible from the get-go.

Flusso AI

AI technology is here to stay, and the Flusso AI plugin is one of the latest examples of how it can be leveraged for content creation. 

Flusso AI brings four AI functionalities to your site:

• Image generator. Use prompts to create AI-generated images. There are options to set the number of images generated, resolution, image type, and style.
• Chat and text content generator. This feature is based on the well-known ChatGPT. You can use prompts to generate text content for your post or page copy. There’s even an option to automatically create a new post based on the generated text.
• Key points. Available in the post editor, the AI will generate the post summary or list the article’s key points. Great for social media posts or summarizing what your articles are all about.
• Speech to text. Need a transcript for your podcast or video? You can upload an audio file to the plugin panel and generate the transcription. Like the text generator, you can quickly create a new post based on the generated transcription.

The plugin uses OpenAI, meaning that you must connect the plugin to your OpenAI account using the secret key.

WordPress Plugins Periodic Table

Curious to see what are the most popular WordPress plugins? Pascal Birchler created a periodic table of 108 WordPress plugins from the official repository with the most active downloads.

The table is interactive, too. Click on any element, and it will expand to show more information about the plugin, what it’s used for, and so on.

Although this periodic table was built to celebrate the 20th anniversary of WordPress, it still provides useful information to users, especially if you’re looking for the most popular and reputable WordPress plugins for your website.

WordPress Is Turning 20 in May

On May 27, 2023, we celebrate a great milestone in WordPress – the software’s 20th anniversary!

It’s rare for a community-supported software to grow and evolve for so long, and it’s surely something WordPress fans are keen to celebrate. Check out the official WordPress 20th Anniversary website for community events near you.

Hostinger will take part too! Stay tuned: we have special content planned for celebrating 20 years of WordPress.

The post This Month in WordPress: April Roundup appeared first on Hostinger Blog.

Throughout March, the WordPress core team was busy preparing the first major release of the year – WordPress 6.2, working on various release candidate versions and making last-minute changes to ensure bug-free core functionality.

But that’s not all that’s happened in March. Gutenberg and WooCommerce also rolled out updates to enhance the block editing experience. What’s more, various security patches have been released to ensure the content management system is safe from attackers.

In addition to WordPress news and updates, we’ll go over some new WordPress tools that will help you with website development. We have much to cover in this month’s WordPress roundup – let’s dive right in.

WordPress Updates

On top of the WordPress 6.2 launch, there have been other great updates that have made the site editor and Gutenberg better, like the distraction-free Gutenberg mode and WooCommerce block improvements.

WordPress 6.2

Wrapping up phase two of the Gutenberg project, WordPress 6.2 has revamped the Site Editor interface and taken it out of beta. This effectively means that the block editor is more stable than ever and will be the staple of site editing from here onwards.

We have covered the updates extensively in our WordPress 6.2 overview article. Here’s a quick recap:

• Browse mode. The new interface lets users browse and preview templates and template parts, seamlessly switch between them, and start editing.
• Style book. It displays all website elements with a given style variation, making it easy to check how it will impact the site.
• Openverse integration. A new interface lets users search and pick free-to-use stock images straight from the block editor.
• Navigation block improvement. A new UI for the navigation block tools is now available. It helps manage menu items more easily from the block settings panel.
• Distraction-free mode. A new feature that removes all panels and toolbars from the editor canvas, allowing users to focus on content creation.

Gutenberg Updates

Even though WordPress 6.2 came out this month, the developers still rolled out two Gutenberg updates – versions 15.3 and 15.4.

Note that these versions are not included in the WordPress 6.2 core backport. If you want to check out the new features, you must install and activate the plugin.

• Time-to-read block (15.3). The block displays estimated reading time, allowing visitors to decide whether to save the article for later.

• Global duotone filter (15.3). The global block styles panel now contains duotone global settings, allowing site-wide filter application customization.

• Color for Cover block (15.4). You can now customize the inner block color with a single setting.
• Template descriptions (15.4). New template descriptions for better documentation.

WooCommerce Updates

WooCommerce rolled out version 7.5.0 this month with the following updates:

• Global styles support for blocks. You can now customize Product Button, Product Rating, and Product Price blocks using the core editor settings panel.
• Support for style book. A WooCommerce tab has been added to the Style Book, showcasing various WooCommerce blocks.

Other than improving the existing blocks, WooCommerce also introduced three new ones:

• Store Breadcrumbs block. The block displays breadcrumb navigation to let visitors know their position on the website and access parent pages quickly.
• Product Results Count block. Based on the query, it shows the number of displayed products and the total available products – useful when you have a large product collection.
• Catalog Sorting block. It lets visitors sort the displayed products based on several criteria. This comes in handy if you have many product categories.

Gutenberg Phase Three Planning

With WordPress 6.2 marking the end of Gutenberg Phase Two, the project now enters Phase Three, centered around real-time collaboration.

While this phase is still in the planning stage, the development team has already laid down the Preliminary Outline for the Phase Three. Mat Mullenweg mentioned a lot of the points in his State of the Word 2022 presentation. Here are some highlights:

• Real-time collaboration. Collaborate with your colleagues in real time using the WordPress Editor.
• Asynchronous collaboration. No matter your time zone or physical location, draft sharing and inline-block commenting empower teams across the globe to work together.
• Publishing process. From time-saving flow improvements to easier editing, the publishing experience should be improved further.

WordPress Security News

Keeping the WordPress ecosystem customization-rich is not the only objective of the community. WordPress is always a target of security threats, and the developers constantly work to keep it safe.

WooCommerce Payments Vulnerability

A WooCommerce Payments plugin vulnerability affecting over 500,000 websites was discovered on March 22, 2023. It could be exploited by unauthorized parties to access the admin area and take over the site.

It impacts websites that use WooCommerce Payments versions 4.8.0 to 5.6.1. A security patch has been released – it comes with version 5.6.2.

The WooCommerce team collaborated with the WordPress.org Plugins team to force updates on affected websites. However, if you use this plugin, we recommend checking your plugin version and updating immediately if required.

Elementor Pro Vulnerability

A severe Elementor Pro vulnerability has also been discovered. It allows unauthorized parties to instantly create an administrator account.

The vulnerability affects websites with Elementor Pro version 3.11.6 or older and WooCommerce installed. Version 3.11.7 has addressed this issue – make sure the plugin is up to date if you use it.

Patchstack State of WordPress Security 2022

Are you curious about WordPress security stats for 2022? If so, the Patchstack State of WordPress Security 2022 whitepaper is a good read.

This document compiles all WordPress security facts, statistics, and trends in 2022 – immensely valuable to anyone building WordPress websites or developing extensions.

Here are some of the highlights:

• 26% of plugins with severe vulnerabilities were never patched.
• There’s been a 328% rise in security bug reports in 2022.
• Almost 30% of security bugs in 2022 were cross-site request forgery (CSRF), with cross-site scripting (XSS) coming second at just over 27%.

Featured WordPress Tools

One of the coolest characteristics of the WordPress ecosystem is the abundance of tools and extensions that can help you with website development. Here are our picks for this month’s featured WordPress tools.

docs_dangit

A Cloudfest 2023 Hackathon project initiated by Milana Cap, docs_dangit is a search engine that helps WordPress developers find code examples from various documentation resources. All you need to do is enter the keyword – be it a PHP variable, WP-CLI command, or a function snippet – and the results will show up.

Currently, docs_dangit relies on WP Code Reference, WP Dev Notes, WP-CLI Documentation, and PHP Docs as its references.

Inspiro Blocks Theme

Released in mid-February, the Inspiro Blocks theme from WPZOOM has already racked up over 1,000 active users, and that’s for good reason.

This theme has six style variations and 23 built-in patterns, so it’s got plenty of overall site design options. Combined with a modern and minimalist design, this theme is perfect for anyone looking to quickly build a portfolio or business website.

AI Tools for WordPress

AI is a growing trend in web development, and the WordPress ecosystem is no exception. A few weeks ago, we covered how to build a WordPress website with ChatGPT, showing that AI has become a useful tool for WordPress development.

This month, we checked out a couple of interesting AI tools that can simplify WordPress content creation.

AIOSEO AI Title/Description Generator

Meta titles and descriptions can make or break your content marketing campaign. A good meta title helps you rank higher in search engines, while a meta description encourages readers to click on your post.

Writing a great meta title and description can be challenging. That’s why AIOSEO have launched a new feature called AI Title/Description Generator – a result of their partnership with OpenAI, the creators of ChatGPT.

The feature is quite simple. On the post editor’s AIOSEO section, click the robot icon next to the post title and meta description fields, and it will generate five suggestions based on your content.

One caveat of this feature is that it’s only available in the premium version. So if you wish to use this new AI tool, choose one of their premium plans that start from $49.6/year.

EveryAlt

Alt text helps visually-impaired readers – effectively, it’s a text description for an image. Having alt text on your images is a must to ensure your content is accessible.

EveryAlt can help you with this. It will generate an alt text suggestion based on a given image. Simply drag and drop the image to the interface, and it will generate the text which you can also modify.

Here’s an example of an image with the alt text generated by EveryAlt.

Currently, a free account will get 25 image credits. It costs $9.99 to get an allowance of 1,000 images.

The EveryAlt WordPress plugin, which is currently in beta. Once it’s fully released, you can expect the same convenience in your WordPress admin panel.

What’s Coming in April

Even though WordPress 6.2 has finally been released, that doesn’t mean the community is slowing down. For instance, there are thousands of WordPress plugins and themes out there that still haven’t been compatibility-tested with WordPress 6.2.

Always keep an eye on your WordPress update admin panel and update your plugins and themes whenever a new version is available.

The post This Month in WordPress: March Roundup appeared first on Hostinger Blog.

The first major release of the year – WordPress 6.2 “Dolphy”, is finally here. This version brought over 900 enhancements and bug fixes in the core software.

WordPress 6.2 also marks the end of the Gutenberg Phase Two project focused on customization. The next major update will begin Phase Three for better collaboration.

This version comes with an improved site editor to make your workflow even more efficient and open more customization possibilities. Let’s dive into WordPress 6.2 and see what it has to offer.

Improved Workflow With the New Site Editor Interface

The Site Editor interface has received several significant changes. Most notably – the Browse Mode. What’s more, the new color-coding system and block settings panel updates result in a more intuitive and better workflow.

Browse Mode

Users can see the new interface immediately when they enter the Site Editor. Instead of taking you to the homepage template with no sidebar, it will start with the template preview that includes a sidebar to navigate the different templates. This interface is also called Browse Mode.

The dark-gray left sidebar lets you browse through the available templates and template parts, while the main editor canvas on the right will preview the selected template. What’s cool is that now you can switch and preview between templates and template parts seamlessly.

While it may not seem significant, this lets you see subtle differences between templates for better design consistency. Previously, you’d have to open the template panel, which took up the whole screen, hindering you from seeing the preview and switching between templates quickly.

Moreover, the sidebar width is adjustable. The preview will also change according to the canvas area, letting you see how the template responds to the changes to the viewport width.

When you’d like to edit the selected template, click on the editor canvas or the Edit icon on the sidebar.

Click the Add New Template button on the sidebar to add a new template or template part from the browse mode. Alternatively, you can still access the old templates and templates parts panel by clicking the Manage all templates or Manage all template parts buttons.

Block Settings With Split Controls

The interface changes don’t end there. The Block Settings panel is also improved – it now has split controls.

Have you ever customized a block and felt annoyed at having to scroll to find a specific setting? Starting from WordPress 6.2, the block settings panel will have two tabs for the controls – Settings and Styles.

The Settings tab – represented by a gear icon, contains block-specific options. For example, you can find the layout and position settings in the group block settings, while the post date block contains the Date Format and Link to the Post options. All advanced block settings to add CSS classes or HTML anchors are also in the Settings tab.

The Styles tab – represented by the WordPress style icon, contains the general style settings, such as color, dimensions, typography, and border. The customization options may differ for each block.

It’s worth noting that the Site Editor block settings icon has been changed. Instead of a gear, it now resembles a screen with a right sidebar.

Color-Coded Template Parts and Reusable Blocks

Have you ever accidentally changed or deleted any reusable block or template component? Doing so may affect other parts of the website that use the same component.

In WordPress 6.2, template parts and reusable blocks are color-coded to differentiate them from other blocks. You will see a purple outline and icons when you select them, helping identify them. This change is applied in the list view, the block toolbar, and the editor canvas.

Improved Content Editing Experience

WordPress is all about creating content. Thus, every update improves the writing and editing experience, and WordPress 6.2 is no exception.

Distraction-Free Mode

The distraction-free mode is available in the page and post editor. It hides all sidebars, the top navigation panel, and the block toolbar, leaving only the editor canvas and your content on the screen.

To activate it, open the Options menu at the top-right corner of the screen and select Distraction free. When you want to return to the standard editing, hover over the screen’s top section. The top navigation panel will appear, allowing you to access the Options menu again.

What we like the most about this feature is that it hides the block toolbar. It can be annoying when the block toolbar hides a portion of the text when writing. With the distraction-free mode, this won’t happen.

The beauty of the distraction-free mode is that you can still add various blocks using the inserter in the editor area. This means that you’re not restricted to editing text, and you can create content with images, videos, and other visual elements.

Openverse Integration

Need to add openly-licensed media to your content? There’s no more need to look for it on a separate site, download it, and re-upload it to your site. The Openverse integration now lets you browse these images straight from your editor.

All you need to do is open the Block inserter from the top-left corner of the editor screen, open the Media tab, and select Openverse. Use the search bar to enter a query and find suitable images you need. When you finally find one, click on it, and it will be automatically inserted into your content.

This integration has also been improved since the beta version. It now uploads the image to the media library to avoid problems with hotlinking. If it can’t upload the image to the library, it will warn you before proceeding.

Pattern Inserter Categorization and Interface Improvements

Using block patterns is an easy way to get your content layout done. WordPress 6.2 features a redesigned pattern inserter to improve user-friendliness and at-a-glance navigation.

Now, pattern categories are listed in the inserter panel instead of a drop-down menu. This makes it easier to navigate between categories. The inserter panel also expands rightwards for a preview.

If you want to browse for a pattern using the dedicated block pattern panel, click Explore all patterns, and the pop-up will appear.

Other than the interface, block patterns are also recategorized in this version for better user-friendliness. Some of the changes are as follows:

• Query patterns renamed to posts
• Columns merged with text patterns
• Buttons replaced with calls to action
• Three new categories – banner, header, and footer

Post Outline

The post outline is now moved into the list view panel. Therefore, you’ll notice the panel is now split into two tabs – List view and Outline.

In the outline tab, you can see the structure of your content, including its word count, time to read, and heading structure.

Styles Customization

Switching and customizing global styles is now more convenient with the refined global styles panel. Some new features will make your life easier, too.

New Global Styles Preview and Style Book

The global styles panel now offers two improved ways to preview any style variation.

The first is the zoomed-out editor canvas to better provide a style overview when you enter the style browser. Previously, when selecting a style variation, the editor canvas would remain the same, so you’d have to scroll down to see the changes on other parts of the site, such as the header and footer.

You can also add patterns while in the zoomed-out editor canvas. This will let you experiment with different styles and patterns and choose one you see fit.

Another way to see a broad preview of style variations involves using the style book. You can access it by clicking the Eye icon on the Global Styles panel.

This will show you how all website elements will look with every style variation. For example, in the text section, you can see all the heading levels, paragraphs, and quotes. The design section shows how buttons, columns, and links will look with a style variation.

The style book has five tabs – text, media, design, widget, and theme. Each contains main blocks that are often used for site customization.

Inline Block Styles Preview

The global styles panel lets you change block styles globally. However, the previous versions were missing the block preview feature. This means you couldn’t see the changes unless the block in question was in the editor canvas.

This is solved in WordPress 6.2, which introduces the inline preview in the global style panels. Now you can see how the block will look at the top of the global styles panel.

Shadow UI Tools

Gutenberg introduced shadow support via the theme.json file in January 2023, allowing theme developers to incorporate shadow elements. This customization was code-based only.

WordPress 6.2 introduces UI tools to let end users change the shadow presets via the global styles panel.

Currently, four shadow presets are available by default, but you can add more via the theme.json file.

Here is a sample code snippet you can use to add a shadow preset:

{
	"version": 2,
	"settings": {
		"shadow": {
			"presets": [
				{
					"name": "Small",
					"slug": "sm",
					"shadow": "0 1px 3px 0 rgba(0, 0, 0, 0.1), 0 1px 2px 0 rgba(0, 0, 0, 0.06)"
				},
				{
					"name": "Medium",
					"slug": "md",
					"shadow": "0 4px  10px 0 rgba( 0, 0, 0, 0.3 )"
				},
				{
					"name": "Large",
					"slug": "lg",
					"shadow": "0 8px  15px 0 rgba( 0, 0, 0, 0.3 )"
				}
			]
		}
	}
}

Push Block Styles to Global Settings & Copy and Paste Block Styles

When editing a block’s style, you may decide to apply it to other similar blocks. For example, after styling a heading, you like the look and want to apply it to all the heading blocks on your site.

Instead of editing other blocks individually or making the same edit in the global styles panel, you can now open the block settings panel and select the Apply globally option from the Advanced section.

Or, if you want to use the same style for a specific block, you can open the More options menu in the block toolbar, select Copy styles, and click Paste styles on the receiving block.

Intuitive Navigation Block Tools

WordPress 6.2 brings a new way of creating navigation links in the editor with the new navigation block UI tool.

This tool is accessible through the block settings panel. You will notice another tab for the navigation block list view. While this functions similarly to the block editor list view, the tools offer a more focused experience for editing the navigation, helping you implement good navigation on your site.

First, it’s now easier to rearrange navigation items by dragging and dropping them on the UI. This is a great addition – you won’t have to use the main list view or the block-moving tools.

You can also use the drag-and-drop system to create a sub-menu or move a sub-menu level to a higher level. Alternatively, you can open the options menu for each page link block to remove it or add a sub-menu.

When you click an individual page link, it will open the link settings where you can change the label, URL, description, and link rel attribute.

Another improvement is adding more block types to the navigation block. For example, you can insert a page list block, and it will automatically add all pages to the navigation. Most importantly, it will have a simple single-button option to turn them into individual page link blocks, where you can edit and arrange them more freely.

This new process is amazing when you have plenty of pages to add. Adding a page list block lets you get all the pages there without inserting the links individually.

To prevent any link and submenu changes, the Restrict Editing feature is now accessible via the block-locking tool. This feature is helpful for site admins or agencies to ensure the site’s navigation won’t be changed unexpectedly, which may cause the navigation to break.

Other Improvements

Other than the holistic updates we’ve discussed above, some major updates were also made to improve the editing experience in WordPress.

Sticky Positioning

The new sticky position support lets you keep a block at the top of the viewport when users scroll down the page. Currently, this feature is available in group, stack, and row blocks at the root level. You can use these container blocks to put an important notice on your website and set it sticky.

To set a sticky block, make sure it’s in the root level. Then, open the block settings panel and find the Position option. Choose Sticky from the drop-down menu.

Variation Picker in the Group Block Placeholder

Group, row, and stack blocks have been easily transformable to each other with the dedicated transform tool in the block settings. WordPress 6.2 takes this flexibility further with the variation picker when you add a group block to the editor.

You will see the layout options, which let you start the group block as a row or stack block. Note that these options are not available in row and stack block placeholders.

Drag-and-Drop Support to Add Images Into an Empty Paragraph Block

Adding an image from your computer is now easier than ever. You can drag and drop it from a local folder to an empty paragraph block. It will automatically transform into an image block and upload the image to the media library.

Beta Label Removal and Site Editor Rename

While this seems minor, removing the beta status means that the Site Editor is more stable than ever for WordPress website creation and customization. Plus, it’s been renamed to just Editor.

Although this release officially ends the beta status of the site editor and Phase Two of Gutenberg, the WordPress team will still improve the editor and fix bugs through future WordPress and Gutenberg updates.

Update Your Site to WordPress 6.2 Now

Updating WordPress is relatively simple. However, be sure to create a website backup beforehand and use a staging environment to test the update before committing. WordPress 6.2 is a major release, and updating your live site may result in compatibility issues and errors.

Once you’ve created a backup and tested the new version in a staging environment, you can update your main site without worry. Follow our tutorials to update your WordPress website, and enjoy the new features in WordPress 6.2!

The post WordPress 6.2 Is Finally Here: A Detailed Overview appeared first on Hostinger Blog.

There’s hardly been time to stay idle in February. WordPress 6.2 is now just around the corner, and WooCommerce’s latest update thrilled us with new exciting features. On top of that, WordCamp Asia 2023 and the upcoming WordPress Community Summit are bound to keep the community engaged.

WordPress 6.2 Update

Beta Releases

The first WordPress 6.2 Beta was launched on February 7, 2023. Now, we are already on the fourth beta version, with refined features and bug fixes.

We have an article covering the new features of WordPress 6.2. To recap, here are some of the highlights:

• Browse mode. Quickly preview the templates and template parts with the new browse mode UI. This saves you time as you don’t have to open each template or the sidebar to switch templates.
• Style book. See how the overall look of your website changes with the style book. It shows all the elements’ styles, from text and media files to block designs and widgets.
• Distraction-free mode. The distraction-free mode disables the block toolbar and all the other panels on the editor, letting you focus on writing the content.
• Improved navigation block UI. Add navigation items and drag and drop them to rearrange your menu from the block settings panel. This way, you won’t have to fiddle with the navigation block directly on the editor canvas.
• Openverse integration. Easily insert public-licensed images to your content from the Openverse menu on the editor. You won’t have to manually download and reupload images for your content.

WordPress 6.2 will be significant as it will mark the end of Gutenberg phase two. The site editor is now more stable than ever and ready to take website customization to the next level.

Live Product Demo

Keeping with the WordPress 6.2 release timeline, the team will hold a live product demo on March 2, 2023. They will review the new features in a live Zoom call, and the attendees will be able to ask the team any questions about the new release.

The call will let end users discover how the new features will make their work easier. In contrast, developers will learn of new opportunities to create more advanced WordPress customizations, plugins, and themes.

The product demo call will be recorded for future on-demand viewing.

WooCommerce Update

WooCommerce launched version 7.4 on February 14, 2023, containing 274 commits in the WooCommerce Core and 220 commits in WooCommerce Blocks. Some interesting new features include:

• Local pickup. The latest version of WooCommerce adds the new Local Pickup block, allowing your buyers to pick up the purchased item from a pick-up location. This new feature has a dedicated admin screen to manage the pickup locations, making it easier for sellers to offer deliveries to buyers.

• Link to add reviews on the All Products block. The All Products block now has a link for visitor reviews. The link will appear on products that don’t have any reviews yet, helping you to get more social proof from your buyers and build trust with your audience.

• Editable cart and checkout button. The Proceed to Checkout and Place Order buttons on the cart and checkout blocks are now editable, allowing you to be creative with your calls to action.

In addition to the new WooCommerce 7.4, the developers are already working on WooCommerce 7.5; its beta has already been released. The next WooCommerce update is scheduled for March 14, 2023, and we can’t wait to see what the team has in store.

WordCamp and Community News

WordCamp Asia 2023

WordCamp Asia 2023 took place between February 17-19, 2023, and it was the first flagship WordCamp in Asia. Over 1,200 people attended the event – most from neighboring countries like India, Bangladesh, Nepal, and Indonesia.

Like all WordCamps, WordCamp Asia kicked off with Contributor Day. The attendees got together and worked on various WordPress projects. This was a great opportunity for contributors to meet and talk.

During the other conference days, more than 50 speakers discussed topics ranging from mental health and productivity to WordPress contributions. They shared many inspiring stories from within the community.

During the closing, Taipei was announced as the next host for WordCamp Asia 2024. If you live in a nearby country and want to attend a flagship WordCamp, we recommend blocking off some time in your calendar in the next year.

Interested in learning more? We have a dedicated blog post that rounds up WordCamp Asia 2023.

WordCamp Europe 2023

Want to get involved with WordCamp Europe 2023? The organizers are calling for photographers and media partners to join the next flagship event.

If you have experience capturing moments at events, apply as a photographer to immortalize the WordCamp Europe 2023. Or, apply as a media partner to spread the WordCamp news to the community.

Note that applications are accepted until March 31, 2023.

The event will take place between June 8-10, 2023, in Athens, Greece. General tickets are up for grabs if you just want to attend the event as a regular attendee.

WordPress Community Summit

WordPress Community Summit gathers WordPress open-source project contributors to improve collaboration and workflow within the community.

The event will take place on August 22-23, 2023, just before WordCamp US, and cover various submitted topics, like:

• Improving multilingualism in the WordPress community.
• Improving cross-team communication and collaboration.
• Adopting an accessible-first approach in WordPress.
• Streamlining work for Gutenberg components that are already in the WordPress core.

If you’ve been involved in any WordPress project and are keen to attend with other contributors, the application to attend the WordPress Community Summit is now open. Be sure to apply, as this is an invitation-only event.

Featured WordPress Extensions

We like to test and review WordPress plugins, themes, and other tools and recommend them to our readers. This month, we have five WordPress extensions we want to talk about:

Bibimbap WordPress theme

The new block-based theme from Automattic focuses on restaurant websites. This delicious theme has five custom block patterns for menu pages, featured dishes, and restaurant information. This isn’t a lot, but the available options are enough to kickstart a restaurant website without designing page elements from scratch.

The custom home template utilizes a cover block to display a hero image with contact information and a call-to-action button. This lets you have an engaging homepage design from the get-go. All you have to do is customize the image, text, and color scheme, and your site is ready for launch.

Web3Press WordPress NFT plugin

Web3Press lets you earn money by publishing your blog posts to the blockchain as NFTs. It adds a simple interface in the editor to mint your content as a Writing NFT, and it will embed a mini NFT widget to let readers purchase your article.

Essential Blocks for Gutenberg plugin

Add over 40 new WordPress blocks using the Essential Blocks for Gutenberg plugin to level up your website design and site functionality.

The Instagram feed, social icons, and social share blocks help you integrate your site and social media accounts. Meanwhile, post carousel, toggle content, and parallax slider blocks add interactivity elements without installing a bundle of plugins or coding from scratch.

Fluent Forms plugin

This plugin has pre-designed templates that let you quickly create a contact form. Its comprehensive features, such as conditional logic, multi-step form format, and drag-and-drop form builder, make Fluent Forms one of the most flexible contact form plugins.

Whether you want a simple subscription or a conversational form with conditional logic, this plugin has you covered.

TasteWP Chrome extension

TasteWP just launched a Chrome extension that detects if the website you’re visiting is built on WordPress. It will also tell you what theme and plugins the site is using.

You can use it to take inspiration from websites with fascinating design and user interactivity. TasteWP will tell you whether the website uses WordPress. Simply look at the extension icon – if it turns full color, the site runs on WordPress.

The extension will also display some notable plugins used by the website. This will be useful to know how the website makes some design elements work, like an image slider or lightbox.

Identified themes and plugins will feature links to their homepages. This way, you can quickly create a TasteWP sandbox to try any of the detected plugins.

What Can We Anticipate for March?

February was a busy month on all fronts. WordPress shows no signs of slowing down, with WordPress 6.2 development still being the main focus of the community for March.

The upcoming walkthrough chat with the team will let us watch a demonstration from the experts themselves. And with three Release Candidate versions coming, we will get better acquainted with the next major update, too.

We expect plenty more updates for WooCommerce and Gutenberg that will enhance the WordPress experience even more.

The post This Month in WordPress: February News Roundup appeared first on Hostinger Blog.