What's New in SureCart

Fixes:

• Review Request Emails: Fixed the “Leave a review” link in Review Request emails, which opened the customer dashboard instead of the product’s review form.

Security:

• Data Access Checks: Hardened data access checks so information stays visible only to the right users (props to Erwan from WPScan).
• Output Escaping & Sanitization: Improved output escaping and input sanitization in several areas (props to dzaku of PatchStack and UKO – Korea University of Wordfence).

Improvements:

• MCP Adapter Installation: The MCP settings tab now installs the MCP Adapter plugin from WordPress.org, so it appears under Plugins and receives normal updates.

Fixes:

• Product Tax Toggle: Fixed a bug where the “Charge tax on this product” toggle showed as off and disabled if you reached a product by navigating within the admin instead of loading the page directly.
• Buy Now Checkout Refresh: Refreshing the checkout page after clicking Buy Now no longer loses the checkout. The checkout is now kept in the URL, so a refresh shows the same items instead of an empty checkout or the saved cart.

Security:

• Local Database Models: Hardened how stored data is restored in local database models to prevent PHP object injection.
• Invoices Admin List: Escaped the status filter links on the Invoices admin list to prevent reflected cross-site scripting.

Fixes:

• Upgrade Group Plan Switching: Fixed an issue in the customer dashboard where switching plans within an upgrade group didn’t show the group’s draft (members-only) products to customers who own a product in that group.

Improvements:

• Product Structured Data: Product structured data now includes the offer URL, item condition, SKU, and sale (strikethrough) pricing, so more product pages qualify for Google rich results.

Fixes:

• Structured Data Offers: Subscription, pay-what-you-want, and free prices are no longer listed as offers. Structured data now uses the price the product page preselects.
• Structured Data Currency: Currency codes in product structured data are now uppercase, as Google expects.
• Classic View Compatibility: The SureCart Dashboard and Learn pages no longer appear blank when the classic view is enabled.
• Draft Products in Checkout Forms: Draft products in the checkout form editor are no longer wrongly shown as “This product has been archived.”

New:

• ChatGPT Integration: Connect SureCart to ChatGPT through a Custom GPT and manage your store by chatting with it.
• Import & Export Menu: Admin list pages now group Import and Export options under one menu, with exports running directly inside your dashboard.

Improvements:

• Post-Purchase Upsell Tracking: Google and Facebook conversion tracking now includes accepted post-purchase upsells.
• Shop Page SEO: Search engines no longer crawl shop page filter and sort variations, keeping unnecessary URLs out of search results.
• Translated Block Labels: Block labels, including button and field text, now appear in your site’s language instead of always displaying in English.

Fixes:

• Admin Date Selection: Dates selected for coupons, invoices, trials, subscriptions, affiliates, payouts, and fees now use your site’s timezone instead of your computer’s.
• Scheduled Subscription Pauses: Subscriptions scheduled to pause now display the correct status in the admin and Customer Dashboard instead of appearing as “cancelling.”
• Physical Product Variants: Specific variants of physical products can now be selected when adding products to a checkout form.
• Name Your Own Price Selection: Fixed indistinguishable price labels and non-working product search when selecting a price for a Name Your Own Price product in the checkout form editor.
• Subscription Updates: Fixed an error that prevented subscription changes from being saved in the admin.
• Astra Design Library Compatibility: Fixed incorrect spacing on SureCart admin pages when Astra’s Design Library is active.

New:

• Bulk Shipping Labels: Pick multiple orders under Orders → Shipping Labels, compare rates, and buy labels in one go to save time on daily fulfillment.
• “Start With a Complete Site” Onboarding: Preview and import a ready-made SureCart starter template to get your store up and running instantly.
• Stacked Tax Display: Checkout, orders, receipts, and subscriptions now show each tax rate on its own line when a region stacks taxes (e.g., Canadian GST + PST).
• Custom Tax Labels: Tax overrides can now carry a custom Tax Label (e.g., “GST + PST”) that is clearly shown at checkout and on customer receipts.
• Limit Location Capture: A new “Limit Location Capture To” setting allows you to ask for location details only from buyers in the specific countries you choose.
• First-Party Performance Integrations: Native integrations with WP Rocket, Perfmatters, and SiteGround Optimizer ensure SureCart automatically registers the necessary cache and delay-JS exclusions they need.

Improvements:

• Reliable Affiliate Tracking: Affiliate click tracking now routes through your own site, ensuring ad blockers no longer drop clicks.
• Accurate Document Wording: Customer-facing “invoice” wording has been updated to “receipt” wherever the downloaded document is actually a receipt.
• Contextual Tax ID Placeholders: The Tax ID input field now dynamically names the expected format for the selected zone (e.g., “Enter EU VAT”).
• Dynamic Pricing Warnings: Dynamic pricing rules now display a helpful warning if a Geo Address Country rule targets a country that location capture will not collect.

Fixes:

• SEO Metadata for Instant Checkout: Fixed an issue where Instant Checkout /buy/ pages were treated as the blog index, which caused SEO plugins to generate incorrect canonical, robots, and duplicate Open Graph tags.
• Product Review Rendering: Resolved an issue with product review pagination disabled states and unfilled rating stars rendering incorrectly.
• Modern Payout Batch Creation: Payout batch creation has been moved from the legacy admin screen to the modern admin, accessible via an “Add Payout Batch” button on the Payouts list.
• Shippo Label File Types: Fixed a bug where Shippo labels ignored the selected “Label file type” when buying a label unless “Re-quote” was clicked first.

Security:

• Hardened Batch Permissions: Strengthened batch permission checks to ensure users can only read and perform batch operations they are explicitly allowed to access.

New:

• Modern Data Views Across SureCart: The rest of the SureCart admin now uses WordPress’ modern Data Views experience, making lists easier to search, sort, filter, and manage.
• Faster Admin Navigation: SureCart admin pages now use fully client-side, SPA-like navigation for quicker transitions without full page reloads.
• Improved Product Integrations List: Product integrations now include an edit action and a more detailed list view.

Improvement:

• Reduced the JavaScript translation catalog from roughly 150 copies to one per page, preventing the block editor from appearing blank in WordPress 7.1 on Chromium-based browsers.

Fixes:

• Checkout now requires a phone number for physical products only when the selected shipping method needs one.
• Collection syncing now connects to an existing unlinked term when a new collection term would duplicate it.
• The sc_product_media shortcode now displays the WordPress media-library gallery correctly when given a product ID.
• Price fields now respect the site locale and accept the appropriate decimal separator.
• PayPal’s Credit Card option no longer loses its button or reverts to the standard PayPal button after checkout fields such as email or address are changed.
• Product page migration no longer wraps WooCommerce’s single-product block template, preventing corrupted product pages on sites using both WooCommerce and SureCart.

Improvement:

• Faster block registration using a build-time metadata manifest.

Fixes:

• Shop pages and Quick View now load in a few seconds instead of 20–30 seconds on stores with many product variants.
• SureCart no longer disables LiteSpeed Cache page caching across the entire site.
• Address autocomplete now preserves the correct street-name and house-number order in countries where the street name appears first.
• Cancelling or editing a subscription that no longer exists now displays a “Not found” message in the Customer Dashboard instead of causing a fatal error.
• The PayPal button no longer reloads whenever a checkout field changes.

Security:

• Hardened product integration permissions against user-role privilege escalation. Props to TurboNexic of PatchStack for responsibly reporting the issue.
• Hardened permission checks for subscriptions, orders, and license activations.

Fix:

• Product images inside Cover blocks are now clickable in Shop page product lists.