WP Extended Pro

Version 3.3.0 — 10 September 2026

• New Admin: Every module's settings now live under a single "WP Extended" screen, and moving between them no longer reloads the page.
• New Translations: Now ships in German, Spanish, French, Dutch, Brazilian Portuguese and European Portuguese.
• New Code Snippets: Added a Safe Mode switch to the editor, so you can turn every snippet off from the interface instead of by editing a URL.
• Improved Limit Login Attempts: Added an option to trust a proxy header when detecting a visitor's IP address, for sites behind Cloudflare or a load balancer.
• Improved Global: Updated module documentation links to our new documentation URLs.
• Improved Menu Editor: A role granted a page now receives that page's capability only while WordPress is serving that page, not for the rest of the admin session. A delegated page that saves over the REST API or AJAX renders read-only.
• Improved Global: Now requires a minimum of PHP 8.1.
• Fixed Menu Editor: Fixed an issue where granting a role access to a page handed that role the page's capability everywhere in the admin, which could turn an Editor into a full administrator.
• Fixed Menu Editor: Fixed an issue where role restrictions had no effect on plugin pages, and where a denied page could still be reached through its object-edit URL.
• Fixed Menu Editor: Fixed an issue where saving without making a change reshuffled the admin menu.
• Fixed Media Replace: Fixed an issue where an Author could delete another user's attachments through the REST endpoint.
• Fixed Admin Columns: Fixed an issue where a custom meta column did not escape its value.
• Fixed Rollback Manager: Fixed an issue where version lists were fetched over an insecure connection.
• Fixed SVG Upload: Fixed an issue where the sanitiser could be bypassed by certain attributes and animation elements.
• Fixed Code Snippets: Fixed an issue where a snippet description could inject PHP into the generated file.
• Fixed Code Snippets: Fixed an issue where a snippet pasted with its own opening PHP tag could take the site down, and where updating, enabling and deleting failed on hosts that block PUT and DELETE requests.
• Fixed Admin Customiser: Fixed an issue where colour settings were not escaped on the login page.
• Fixed Limit Login Attempts: Fixed an issue where a spoofed IP address could bypass the lockout, or lock out every visitor behind a proxy.
• Fixed Limit Login Attempts: Fixed an issue where diagnostic REST routes were registered in production builds.
• Fixed Limit Login Attempts: Restored the unblock action, and fixed sorting and the status column.
• Fixed Settings: Fixed an issue where imported settings were saved without being sanitised or validated.
• Fixed Export Posts / Export Users / SMTP Email: Fixed an issue where CSV exports were not escaped against spreadsheet formula injection.
• Fixed Export Posts / Export Users: Fixed an issue where meta field exports returned blank values [Pro].
• Fixed User Switching: Fixed an issue where a favourited user's display name was not escaped in the admin bar.
• Fixed Folder Manager: Fixed an issue where a bulk move to a folder did not check permissions for each post.
• Fixed Folder Manager: Fixed an issue where a post duplicated from inside a folder was dropped out of it, and where sort links and status views kept the folder you had just left.
• Fixed User Enumeration: Fixed an issue where author requests were not blocked.
• Fixed Hide Author Slugs: Fixed an issue where author slugs were encrypted with a weak key.
• Fixed Hide Author Slugs: Fixed an issue where the Users screen crashed with a type error.
• Fixed Custom Login URL: Fixed an issue where the disabled-login message was not escaped and returned the wrong status code.
• Fixed Notices: Fixed an issue where notices could be read without logging in, and dismissed by any subscriber.
• Fixed Post ID Display: Fixed an issue where the module crashed when no post types were selected.
• Fixed Hide Admin Notices: Fixed an issue where the module crashed when nothing was selected for update notifications, and where update notices were not suppressed.
• Fixed Duplicate Posts & Pages: Fixed an issue where the module required Pro. It is free again, with its settings remaining Pro.
• Fixed Duplicate Post: Fixed an issue where duplicating an untitled post with content deselected returned an error instead of a clear message, and where editor scripts loaded on the Widgets screen.
• Fixed SMTP Email: Fixed an issue where a duplicate charset in the Content-Type header corrupted accented characters in some mail clients, and where the Download Logs button did nothing.
• Fixed WP-CLI: Fixed an issue where enabling a module that was already enabled turned it off.
• Fixed Post Type Switcher: Fixed an issue where every dropdown option was duplicated.
• Fixed Post Type Order: Fixed an issue where duplicate ordering was not always detected.
• Fixed Quick Add Post: Fixed an issue where the post-type restriction had no effect.
• Fixed Clean Profiles: Fixed an issue where the module did not hide anything.
• Fixed Disable Comments: Fixed an issue where the Comments admin bar link was always removed, and where the per-product exception was ignored in the admin.
• Fixed Disable XML-RPC: Fixed an issue where the content-type check was inconsistent.
• Fixed Translations: Updated the plugin's text domain to wpextended so it matches the plugin header. If you installed translation files by hand, rename them from wp-extended-{locale} to wpextended-{locale}.

Earlier versions

• 3.2.7 (21 June 2026): 3 new, 3 improved, 4 fixed
• 3.2.6 (21 April 2026): 4 new, 1 improved, 6 fixed, 1 security
• 3.2.5 (21 March 2026): 3 security