What's New in SureCart

New:

• Stripe Payment Element Filter: Developers can customize the Stripe Payment Element per checkout with the surecart_stripe_payment_element_elements_config JavaScript filter. For example, you can hide payment methods like Klarna for specific products.

Improvements:

• Connect an Existing Store: Store setup can now connect your site to an existing store using an API token, instead of always creating a new store.
• Saved Items Setup Guidance: Saved Items settings now show where the Save for Later Button and Saved Items Icon blocks go, with links to edit the Shop page and open the Site Editor.

Fixes:

• Address Autofill: Fixed an issue where browser autofill on the address field didn’t reveal the remaining address fields. It could also clear the country or city that was filled in at the same time.
• Translatable Block Labels: Some block labels and default template text in the cart, product page, product collection, reviews and upsell blocks were hard-coded in English. They can now be translated.

New:

• Save for Later: Shoppers can save products to named lists from product pages, product cards, Quick View and the slide-out cart. Saved products appear on a new Saved Items page and in the customer dashboard.
• Customizable Instant Checkout: Design buy link pages in the Site Editor with blocks, including custom checkout fields. Turn it on under Settings → Orders & Invoices.

Improvements:

• Awaiting Label Status: The Orders list now shows “Awaiting Label” in the Shipping column when a shipment is waiting for a shipping label to be bought.
• 33 Languages: SureCart is now fully translated into 33 languages, and translation updates arrive through WordPress without waiting for a plugin update.
• Clearer Cart Errors: Adding a product priced in a different currency from the store now explains the mismatch instead of showing “Product is invalid.” Errors like out of stock or purchase limit reached also show their specific message again.
• ChatGPT Connection Notice: The AI assistant (MCP) settings now warn that ChatGPT is retiring custom GPTs on December 11, 2026, which will stop the ChatGPT connection. Claude, Cursor and VS Code keep working.

Fixes:

• Custom Translations: Custom translations from Loco Translate or your own files now keep priority. Anything they don’t cover uses SureCart’s translation instead of English.
• Wrong Login Code Message: Entering a wrong login code now shows a clear message instead of “Not found.”

Security:

• Passwordless Login Codes: Strengthened security of the passwordless login code flow.

New:

• Advanced Filters: Filter Orders, Subscriptions and Customers by customer, product, coupon, return status and date. Filtered views are saved in the URL, so you can bookmark or share them.
• Patterns Library: A new Patterns library in the Site Editor includes product page, quick view, sticky purchase and upsell patterns.
• Automatic Caching Compatibility: SureCart now works automatically with WP Super Cache, Autoptimize, Breeze, Cache Enabler and Hummingbird. No manual cache exclusions needed.
• Richer MCP Order Data: Order abilities for AI assistants (MCP) now include the buyer’s name, email and the coupon or promotion code they redeemed.

Fixes:

• 3D Secure on Mobile: Fixed an issue where card payments were lost when the checkout page reloaded during 3D Secure approval on mobile devices.
• Shippo Fulfillment Drawer: Fixed the Shippo fulfillment drawer failing with a generic “Can’t be blank” error when an order had no customer email, with no way to add one.
• Large Admin Lists: Fixed admin lists freezing on stores with very large totals. Lists with more than 100 pages now use a page number input.

Security:

• Login Code Emails: Login code emails are now rate-limited and no longer reveal a user’s email address.
• Email Redirect Links: Redirect links in customer emails can no longer be used to send customers to another site.

New:

• Redesigned Onboarding: A redesigned onboarding helps you create a new store or connect an existing one in a few steps.
• Setup Guide: A new Setup guide page walks you through adding a product, branding, placing a test order, connecting your store, setting up payments and launching.
• Starter Templates: Browse and import Starter Templates right from Settings → Design & Branding.

Fixes:

• Shippo Label Screen: Fixed a crash on the Shippo shipping label screen when the order’s shipping method had no description.
• Wide Checkout Layout: The default Checkout page now uses the wide layout, so the two-column checkout form is no longer cramped on block themes. This applies to newly created or restored Checkout pages.

Security:

• Product Review Data: The Product Review List block no longer includes reviewer data in the page source.
• Passwordless Login Codes: Strengthened security of the passwordless login code flow (props to PatchStack).
• REST API Requests: Hardened REST API request handling so requests only reach the intended endpoints (props to PatchStack).
• Icon and Redirect Validation: Improved validation of block icons and checkout redirect URLs (props to PatchStack).

New:

• Variant Rich Results: Product variants can now appear as individual listings in Google rich results and Google Merchant Center.

Fixes:

• Invoices with Shippo: Fixed an issue where creating an invoice failed for stores using Shippo. A phone number was required, but there was no field to enter it.
• Classic Theme Layout: The product page template no longer puts classic themes into quirks mode, which caused layout issues.

Security:

• Success URL Redirects: The checkout now only redirects to a custom success URL on your own site. A success URL on another domain falls back to the form’s success page.
• Data Access Checks: Hardened data access checks to keep information scoped to the right users (props to Erwan from WPScan).
• Passwordless Login Codes: Strengthened security of the passwordless login code flow (props to Wordfence).

Fixes:

• Review Request Emails: Fixed the “Leave a review” link in Review Request emails, which opened the customer dashboard instead of the product’s review form.

Security:

• Data Access Checks: Hardened data access checks so information stays visible only to the right users (props to Erwan from WPScan).
• Output Escaping & Sanitization: Improved output escaping and input sanitization in several areas (props to dzaku of PatchStack and UKO – Korea University of Wordfence).

Improvements:

• MCP Adapter Installation: The MCP settings tab now installs the MCP Adapter plugin from WordPress.org, so it appears under Plugins and receives normal updates.

Fixes:

• Product Tax Toggle: Fixed a bug where the “Charge tax on this product” toggle showed as off and disabled if you reached a product by navigating within the admin instead of loading the page directly.
• Buy Now Checkout Refresh: Refreshing the checkout page after clicking Buy Now no longer loses the checkout. The checkout is now kept in the URL, so a refresh shows the same items instead of an empty checkout or the saved cart.

Security:

• Local Database Models: Hardened how stored data is restored in local database models to prevent PHP object injection.
• Invoices Admin List: Escaped the status filter links on the Invoices admin list to prevent reflected cross-site scripting.

Fixes:

• Upgrade Group Plan Switching: Fixed an issue in the customer dashboard where switching plans within an upgrade group didn’t show the group’s draft (members-only) products to customers who own a product in that group.

Improvements:

• Product Structured Data: Product structured data now includes the offer URL, item condition, SKU, and sale (strikethrough) pricing, so more product pages qualify for Google rich results.

Fixes:

• Structured Data Offers: Subscription, pay-what-you-want, and free prices are no longer listed as offers. Structured data now uses the price the product page preselects.
• Structured Data Currency: Currency codes in product structured data are now uppercase, as Google expects.
• Classic View Compatibility: The SureCart Dashboard and Learn pages no longer appear blank when the classic view is enabled.
• Draft Products in Checkout Forms: Draft products in the checkout form editor are no longer wrongly shown as “This product has been archived.”