ThumbPress

Changelog

What's new in ThumbPress, release by release.

Latest version: 6.4.1 — last updated 2026-07-21 7:28am GMT

Version 6.4.1

July 21, 2026

  • [add] Added Spanish (es_ES), German (de_DE), French (fr_FR), and Brazilian Portuguese (pt_BR) translations, and refreshed the Bengali (bn_BD) translation
  • [add] Internationalized all frontend strings and numbers so they can be translated
  • [perf] Improved WebP/AVIF conversion performance by batching database URL rewrites across a full convert run
  • [fix] Fixed React SPA and PHP translations not loading for the current site locale

Version 6.4

July 16, 2026

  • [imp] Convert to WebP/AVIF: the single-image convert buttons now show the real reason a conversion failed instead of a generic “Failed to convert image” — including a memory-limit message stating how much memory was needed vs the server limit and how to raise it
  • [perf] Auto Featured Image: fixed an N+1 query on archive/blog/shop pages — the resolved image is now cached per request and persisted in post meta, so thumbnail-less posts no longer trigger a content regex scan and extra database query on every view
  • [perf] Dashboard: added stampede (dog-pile) protection to the large-image and thumbnail stat recompute so a cold cache under concurrent load recomputes once instead of many times
  • [perf] Dashboard: large-image count now uses a single indexed SQL query over stored file-size meta instead of a per-image filesystem scan, and the thumbnail count reads attachment metadata in chunks — the dashboard no longer risks timeouts or memory exhaustion on large media libraries
  • [imp] Header: pointed the community link to the ThumbPress community space and moved it first (before Support and Docs), with icons added to each link
  • [security] WP.org compliance: removed the remote Google Fonts request from the admin build and self-hosted Inter locally — no fonts are loaded from an external server

Version 6.3.3.2

July 14, 2026

  • [compat] Version compatibility tested with 7.0.1
  • [chore] Restructured the PHPUnit test suite

Version 6.3.3.1

June 28, 2026

  • [fix] WP.org compliance: removed legacy/ folder entirely — eliminates all legacy-specific violations (Google Fonts unconditional enqueue, cwebp binary files, 5-star review filter links, unguarded nonce checks, unescaped output in legacy views)
  • [fix] WP.org compliance: removed helpwp.dev in-plugin chat widget — the script was loaded automatically on every admin page without user opt-in (phoning home, Guideline 7); bundle rebuilt
  • [security] REST /option GET endpoint now enforces the same allowlist as the POST endpoint (thumbpress_allowed_option_keys filter) — previously any wp_option key could be read including sensitive WordPress core options
  • [fix] VersionManager simplified: get_version_to_load() always returns ‘new’; legacy routing, load_legacy(), register_rest_routes(), save_preference(), and dismiss_notice() removed
  • [fix] Admin/Init.php: inlined is_new_user() check directly (false === get_option(‘thumbpress_modules’)) to avoid call to removed VersionManager method

Version 6.3.3

June 27, 2026

  • [fix] WP.org compliance: removed Google Fonts enqueue (fonts.googleapis.com) from legacy admin — was loading unconditionally without opt-in consent (phoning home, Guidelines 7 & 9)
  • [fix] WP.org compliance: bumped rosell-dk/webp-convert from 2.9 to 2.9.5 in legacy/composer.json (out-of-date library)
  • [fix] WP.org compliance: documented the helpwp.dev in-plugin chat widget under == External Services == in readme.txt
  • [security] REST API permission callbacks now use current_user_can(‘manage_options’) (capability-based) instead of current_user_can(‘administrator’) (role-string) across all thumbpress/v1 endpoints
  • [security] All wp_verify_nonce() calls in legacy AJAX handlers now sanitize input with sanitize_text_field(wp_unslash()) before verification (8 locations across regenerate-thumbnails, convert-images, social-share, and AJAX classes)
  • [security] Fixed AJAX nonce bypass in legacy bulk WebP conversion (convert_images()): previously set an error message but continued executing file operations on nonce failure; now exits immediately with wp_send_json_error() + return, and added manage_options capability guard
  • [security] Fixed three AJAX handlers that accepted state-changing requests with no authentication: legacy image_sizes_dismiss() (now checks manage_options cap + nonce), AdminNotice::dismiss_pro_outdated_notice() (now checks manage_options + nonce), and legacy Notice::hide_notice() (now checks manage_options cap + sanitizes notice_id input)
  • [fix] WP.org compliance: replaced all bare _e() calls with esc_html_e(), esc_attr_e(), or echo wp_kses_post(__()) depending on context — 27+ locations in legacy views (modules.php, upgrade-pro.php) and controllers (Admin.php, Menu.php, disable-thumbnails, regenerate-thumbnails)
  • [fix] WP.org compliance: added defined(‘ABSPATH’) || exit direct-access guard to 12 PHP files that lacked it (legacy/app/Admin.php, legacy/app/Settings.php, six legacy module entry files, legacy/modules/disable-thumbnails/views/settings.php, legacy/modules/convert-images/inc/functions.php, app/Config/autoload.php, app/Helpers/functions.php)

Version 6.3.2

June 23, 2026

  • [fix] WP.org compliance: removed the bulk AVIF conversion worker from the free plugin — the handler shipped in free code but was only triggerable by the Pro add-on (trialware / locked feature, Guideline 5)
  • [fix] WP.org compliance & privacy: the activation survey and deactivation feedback forms (pluggable.io / FluentCRM) are now fully documented as an opt-in External Service in the readme — they transmit data (name, email, site URL, deactivation reason, feedback) only when you explicitly click “Agree” / “Submit & Deactivate”, never automatically, with Terms of Service and Privacy Policy links provided (Guidelines 6, 7 & 9)
  • [fix] WP.org compliance: replaced the remote secure.gravatar.com reviewer avatars on the Pro page with locally bundled images — the free plugin no longer loads any image from a remote server (Guideline: no calling files remotely)
  • [fix] WP.org compliance: the legacy WebP URL builder now derives the public URL from wp_upload_dir() instead of str_replace(ABSPATH, home_url()), so it works on custom upload paths, subdirectory installs, multisite, and symlinked setups
  • [fix] WP.org compliance: the uncompiled React/TypeScript source (spa/) and its build configuration are now shipped inside the plugin zip so the source of build/admin.js can be reviewed and rebuilt directly, with no external dependency

Version 6.3.1

June 23, 2026

  • [fix] WebP/AVIF conversion now updates the image URL everywhere it is stored — post content, custom fields, and options — so images no longer break in page builders (Elementor, Divi, Beaver Builder), the Customizer, or WooCommerce email and placeholder images after converting (#341, #357)
  • [fix] URL replacement handles plain, PHP-serialized, and escaped-JSON stored values, and matches by URL path so CDN, protocol-relative, and root-relative links are rewritten too
  • [perf] Faster, safer database URL rewriting with a basename pre-filter and per-option cache clearing
  • [fix] Aligned the Compress size selector and button on the media attachment screen

Version 6.3.0

June 17, 2026

  • [fix] WP.org compliance: removed bulk AVIF code from free plugin (trialware violation)
  • [fix] WP.org compliance: restricted REST /option endpoint to allowlisted keys
  • [fix] WP.org compliance: removed external data transmission from deactivation survey
  • [fix] WP.org compliance: replaced remote Font Awesome CDN with WordPress dashicons
  • [fix] WP.org compliance: removed Intercom live chat widget (external service)
  • [fix] WP.org compliance: wrapped core admin includes in is_admin() guards
  • [fix] WP.org compliance: replaced WP_CONTENT_DIR and ABSPATH URL patterns with wp_upload_dir()
  • [fix] WP.org compliance: added ABSPATH guards to view/template files
  • [fix] WP.org compliance: fixed text domain from ‘thumbpress’ to ‘image-sizes’ in 5 strings
  • [fix] WP.org compliance: replaced esc_attr_e($var) with echo esc_attr($var) in legacy views
  • [fix] WP.org compliance: include composer.json in plugin release
  • [fix] WP.org compliance: updated Action Scheduler from 3.7.1 to 3.9.3
  • [add] readme.txt: source code link and build instructions
  • [add] readme.txt: external services documentation
  • [feat] Media library: added Convert to WebP/AVIF Pro feature buttons with an upsell popup in the free version
  • [fix] Convert to WebP/AVIF: conversion no longer corrupts attachment metadata or loses data — the new file is written before old files are deleted, metadata writes are guarded, and -scaled originals are no longer orphaned or served at full size
  • [fix] Regenerate Thumbnails: cancelling a background regeneration no longer leaves a zombie batch chain that corrupts progress
  • [fix] Background jobs: completed Regenerate and Convert to WebP jobs now restore their progress view on page reload instead of showing the initial screen
  • [fix] Regenerate & Convert: orphan attachments are no longer processed silently — a not-found count is now surfaced
  • [fix] Fixed null dereferences, stale debug keys, and unhandled promise rejections in the new SPA
  • [fix] Pro: show an Activate License / Pro activation notice when Pro is installed but its license is inactive
  • [fix] No longer force-redirect to the ThumbPress dashboard on every plugin update
  • [fix] Fixed settings page and general responsiveness issues (including MacBook screens)

Version 6.2.2

June 4, 2026

  • [fix] Fixed stale settings values when switching tabs after save
  • [fix] Fixed WebP convert-on-upload settings screen
  • [fix] Fixed lazy load settings screen
  • [fix] Hide dismiss button in admin notice when in legacy mode
  • [refactor] Removed unused Social_Share API class

Version 6.2

May 22, 2026

  • [fix] Fixed admin redirect loop — AJAX and REST requests now skipped in maybe_redirect
  • [feat] Added thumbpress_media_changed action hook fired after media changes to allow cache rebuilds
  • [fix] Hotlink protection .htaccess writes now gated to Apache only
  • [fix] Hotlink protection URL rewriting now gated to Apache only
  • [refactor] Renamed dashboard API identifiers from fast/medium/slow to counts/optimization/analysis across PHP methods, REST routes, TypeScript interfaces, API functions, and React state

Showing the 10 most recent releases. The full history is on the WordPress.org changelog.