Todas las versiones registradas, de la más nueva a la más antigua, con lo que cambió en cada una.
Última 3.1.33· 29 oct 202615 versionesDesde ene 2025
2026 · 13 versiones
3.1.33
Última
1 cambio
Cambios
Pages with more than one funnel shortcode now work. Only the first funnel responded before: the others showed but their Yes/No answers, destinations and feedback form did nothing. Each funnel now keeps its own feedback record, captcha and settings.
3.1.32
2 correcciones1 de seguridad18 cambios
Corregido
Fixed the funnel editor failing on funnels with more than one destination, and pages with two funnel shortcodes failing to show the second.
Fixed the support chat widget not recognising the signed-in customer.
Seguridad
Security
Cambios
(Premium) Imported review details (reviewer name, title, link, location) are now escaped in the admin Reviews list. A crafted review on a public review site could previously run script in an administrator's browser.
Closed a way to read feedback records (reviewer names, emails and messages) through the REST API without logging in.
(Premium) Review-import callbacks from the reviews service must now carry a secret unique to the site, so they can no longer be forged.
Public feedback and testimonial submissions are rate-limited per visitor, feedback is only accepted for published funnels, and each feedback record sends at most one notification email, to its own funnel's recipients. Sites behind a proxy or CDN can supply the visitor's real IP with the starfish_client_ip filter, or adjust the limits with starfish_rate_limit.
Visitor-entered text can no longer add links or HTML to feedback notification emails.
Feedback CSV exports neutralise values that spreadsheet software would run as formulas.
Creating and editing funnels now requires administrator access (filter: starfish_funnel_capability).
The testimonial form no longer shows internal error details to visitors.
Plugin include files can no longer be run directly from the browser.
Uninstalling now removes the plugin's log files and feedback exports, and with data removal enabled the whole uploads/starfish folder.
Administrators now see a notice when the site runs PHP older than 8.2, or a PHP 8.2-8.5 release that predates the fixes for CVE-2026-109618 and CVE-2026-109619. The next major release of Starfish Reviews will require PHP 8.2.
Feedback CSV export works again on Apache servers (the download returned "403 Forbidden"), new exports appear in the export list, and older exports are moved out of the public plugin folder.
Funnels are centred on the page again. Since 3.1.29 the layout styles they rely on were no longer loaded on public pages, so funnels sat against the left edge.
The funnel feedback form no longer errors when the captcha is turned off, and no longer submits the same feedback more than once.
(Premium) Imported reviews are no longer skipped when a title, location or reviewer title is longer than the database allows, the review has no link, or the language includes a region (e.g. en-GB). This mostly affected Trustpilot and other non-Google sites.
(Premium) Agency plan review profiles are renewed automatically again instead of expiring, so their reviews keep updating.
(Premium) Deleting a review profile no longer clears the profile selection of unrelated collections.
Admin pages no longer pause for several seconds on sites where the WordPress REST API check fails, and the Settings page no longer waits on starfish.reviews each time it loads.
3.1.31
2 correcciones1 de seguridad5 cambios
Corregido
Fixed a stored cross-site scripting issue: the Refresh and Purge buttons in the Settings log viewer displayed log contents as HTML, so script in a public testimonial submission could run in an administrator's browser. Logs are now shown as plain text.
Fixed a fatal error when logging a failed funnel or collection status update.
Seguridad
Security
Cambios
Testimonial and feedback submissions no longer write names, email addresses, phone numbers or messages to the debug log, and feedback requests are checked before anything is logged.
Testimonial ratings are limited to 0-5. A very large submitted rating could previously exhaust memory and break the Testimonials admin screen.
(Premium) The daily review-profile jobs (scrape, expire and Agency auto-renew) now process every profile. Previously only the first 5 profiles were handled.
(Premium) A timeout or connection error from the reviews service no longer stops the import with a fatal error, and a failed manual refresh no longer clears the stored review count and rating.
A testimonial with no rating no longer shows two stars.
3.1.30
1 corrección2 cambios
Corregido
Fixed the WordPress 6.7+ notice "Function _load_textdomain_just_in_time was called incorrectly ... starfish domain was triggered too early". Translations used by the plan title, the "Go Premium!" link and the Freemius opt-in buttons are no longer loaded before WordPress's init hook.
Cambios
Restored Font Awesome on public pages that display a funnel, testimonials or a collection. Since 3.1.26 it was only loaded in wp-admin, so funnels showed the question with no Yes/No (thumbs, faces or circles) answer icons to click, and destination, testimonial and collection icons were blank. It is now loaded only on pages that render Starfish content.
The free-plan check no longer fails on sites where the word "FREE" is translated.
3.1.29
2 mejoras1 de seguridad
Mejora
Updated the bundled Twig template library from 3.3.10 to 3.11.3, fixing a sandbox-bypass vulnerability (CVE-2024-45411). 3.11.3 is the newest Twig release that still supports PHP 7.4, so the plugin's PHP 7.4 minimum is unchanged.
Updated the Freemius WordPress SDK from 2.11.0 to 2.13.4.
Seguridad
Security
3.1.28
1 corrección2 cambios
Corregido
Fixed a faulty success check in profile creation that could treat a failed database insert as successful and return a stale, unrelated ID instead of reporting failure. This previously surfaced much later, and misleadingly, as "Failed to update review summary" when adding a profile with "Scrape for Reviews Now?" enabled.
Cambios
`add_profile` now inserts using the same table-prefix convention (`$wpdb->prefix`) as every other method in this class, instead of `$wpdb->base_prefix`. These are identical on a single-site install, but differ on any WordPress multisite subsite, where the mismatch would have inserted the profile into the wrong site's table entirely.
A profile that genuinely fails to save is now reported correctly and immediately, instead of continuing on to also fail the review summary step.
3.1.27
1 corrección1 cambio
Corregido
Fixed review profile URL validation ("Validate" button) incorrectly reporting a 403 error for valid Yelp profile URLs. The validation request sent the bare hostname as the User-Agent header instead of a browser User-Agent.
Cambios
Yelp and Tripadvisor profile URLs now skip the server-side HTTP validation request entirely once the domain is confirmed authorized. Both sites sit behind bot-protection (DataDome) that blocks server-side requests outright based on the requesting server's IP reputation, so the check could fail for a perfectly valid URL no matter what headers were sent.
3.1.26
1 mejora1 corrección6 cambios
Mejora
Performance
Corregido
Fixed the review-profile duplicate check, which previously passed the wrong number of arguments to the database query and never detected duplicates.
Cambios
Testimonials and Collections carousels no longer fail silently under Bootstrap 5; they now initialize via the Bootstrap 5 Carousel API instead of a jQuery plugin call that Bootstrap 5 no longer provides.
Front-end pages no longer load Bootstrap and jQuery UI dialog/datepicker/sortable assets unconditionally; those now load only in wp-admin or when a Starfish shortcode is actually present, avoiding conflicts with other plugins/themes that use the same generic class names.
The review-profiles admin list and job-id lookups no longer render empty on hosts where the database user lacks CREATE VIEW privileges.
Cron review scraping no longer misclassifies expired profiles as active and logging spurious errors for them nightly.
Saving a review profile no longer triggers PHP warnings for unchecked checkboxes or empty optional fields.
The debug log now rotates at 5MB instead of growing unbounded, and routine logging is skipped entirely when logging is disabled in settings.
3.1.25
2 mejoras2 correcciones1 de seguridad12 cambios
Mejora
Compatibility
Performance
Corregido
Fixed unauthenticated exposure of reviewer names, email addresses and phone numbers through the WordPress REST API.
Fixed shortcode detection missing the element id when a page contained other markup first.
Seguridad
Security
Cambios
Feedback records are no longer published to the REST API, and reviewer contact fields now require administrator access.
Feedback CSV exports are written to a protected location with an unguessable filename instead of the plugin folder.
Review avatars fetched from third-party platforms are now validated and downloaded through WordPress' safe HTTP API.
Adding a review profile now requires administrator rights rather than trusting the browser's Referer header.
Testimonial submissions can no longer create new categories on the site.
Corrected three admin menu registrations that used a role name where a capability was required.
jQuery UI is now loaded from WordPress core rather than a bundled copy, for WordPress 7.1 compatibility.
Tested against WordPress 7.0.4.
Rewrite rules are no longer regenerated on every admin request.
Shortcode detection no longer re-renders page content multiple times per request.
Template rendering now uses a compiled cache instead of recompiling on every view.
Dashboard counts no longer load every matching post to count them.
3.1.24
2 nuevos1 mejora9 correcciones1 de seguridad2 eliminados4 cambios
Nuevo
Added missing capability checks to eight admin AJAX actions.
Added missing capability and nonce checks to the review and profile bulk delete actions.
Mejora
Compatibility
Corregido
Fixed PHP 8 warnings in the logging and migration routines.
Fixed plugin translations not loading due to an incorrect textdomain path.
Fixed a SQL injection in the collection reviews query.
Fixed SQL injection via the sort order on the Reviews and Review Profiles admin screens.
Fixed stored cross-site scripting in the review details and review profile admin dialogs.
Fixed cross-site scripting in the plugin log console and in dismissible admin notices.
Fixed profile lookup by job id, which previously never matched a record.
Fixed collection filter cleanup not running when a review profile was deleted.
Fixed random sort order in collections.
Seguridad
Security
Eliminado
Removed all uses of FILTER_SANITIZE_STRING, deprecated as of PHP 8.1.
Removed a registered AJAX action whose handler did not exist.
Cambios
Tested against WordPress 7.0.2; declared Requires at least 6.0 and Requires PHP 7.4 in the plugin header.
Moved the debug log out of the plugin directory to a protected, non-guessable location and removed any previously exposed log file.
Hardened the review scrape callback endpoint against unsolicited and oversized payloads.
Review URL validation now uses WordPress' safe HTTP API with TLS verification enabled.
3.1.23
1 corrección
Corregido
Fixed an issue Unauthenticated Arbitrary Feedback Modification via 'feedback_id'.
3.1.22
1 corrección
Corregido
Fixed an issue with the cron-based auto-scrape feature.
