UserPro – Community and User Profile WordPress Plugin 5.1.16

Fixed

• Stability fix: PHP warning "Attempt to read property 'post_name' on null" on archive pages, 404s, and any non-single-post context. get_post() returns null on these pages; the userpro_title_tag filter was reading $post->post_name without a null guard, emitting the warning in the site header whenever UserPro was active but no post was in context. (functions/hooks-actions.php)

Improved

• Removed dead get_pending_verify_requests_count() function from admin/admin.php (zero callers; duplicate of the patched function in the requests addon).

Fixed

• Member directory custom-field sort now sorts and paginates in the database query (meta_key + orderby=meta_value). Previously every matching user was fetched, sorted in PHP, then sliced, and the pagination total was miscalculated (page links ran to hundreds of empty pages).
• Stability fix: member directory now survives malformed page/search input. ?userp=abc, ?userp[]=1 and ?searchuser[]=x previously caused a PHP 8 fatal (500); ?userp=-1 produced a negative SQL LIMIT. Page numbers are now cast with absint() and a non-string search is ignored. Same absint() guard applied to the Enhanced Member Directory / collage emd-page parameter.
• Enhanced Member Directory and collage now count matches with a single COUNT query instead of fetching every matching user to count() them (same fix already applied to the core member directory).
• Userpro_badges_admin_users() is now capped at 500 rows via the userpro_badges_admin_users_limit filter (previously fetched every account on the site). Full user objects are kept so the badge user dropdowns still show email addresses and load in a handful of queries.
• SQL injection in the front-end post publish flow. The lookup query in the 'publish' AJAX action concatenated post_content (which passes through wp_kses without escaping quotes) into raw SQL; now uses $wpdb->prepare(). Reachable by any logged-in user.
• Privilege/trust meta can no longer be set through a self-service profile save. A denylist (filter: userpro_protected_profile_meta) blocks userpro_verified, account status, connection lists, secret key, badge and social-id meta from the profile-edit POST for non-admins. Previously any logged-in user could set userpro_verified=1 on their own account.
• The role-change guard in userpro_update_user_profile() used is_admin(), which is always true during admin-ajax, so it never fired. Role changes via profile save now require the promote_users capability.
• Userpro_crop_picupload AJAX action now requires a valid nonce (previously none) and escapes the file link it returns (reflected XSS via the src parameter).

Other

• Hardening: user_id in the display-badges and post-sort AJAX actions is cast with absint().

Improved

• Removed dead get_pending_verify_requests_count() function from admin/admin.php (zero callers; duplicate of the patched function in the requests addon).

Fixed

• Memberlist pagination now applies to custom-field sort keys (previously number/offset were only set for built-in sort keys, leaving custom-field-sorted member directories completely unbounded).
• Member directory search/filter total-count now uses a single COUNT query instead of fetching up to 10,000 full user records.
• Userpro_badges_admin_users() now fetches only ID and user_login, capped at 500 rows via the userpro_badges_admin_users_limit filter (previously fetched full WP_User objects for every account).
• "Delete badge from all users" now fetches only user IDs before the per-user write loop (previously hydrated full WP_User objects).
• User Requests admin panels (both old and new) now use a COUNT query for the pending-user header badges and cap the display list at 200 rows (previously fetched all pending users unbounded).

Fixed

• Userpro_rd_get_users() now requests only ID and user_login (previously fetched full WP_User objects and primed the user-meta cache for every account on the site). Row count capped at 500 via the new userpro_rd_users_dropdown_limit filter. A visible truncation notice renders when the limit is hit. Output is now escaped with esc_attr/esc_html.
• Get_pending_verify_requests_count_only() replaced two unbounded get_users() calls (run on every admin page load) with a single WP_User_Query using count_total=true. One COUNT query, zero rows fetched, zero user-meta cache priming.

Other

• Note: seven additional unbounded user queries identified across the plugin remain unpatched in this release (see addons/badges, functions/memberlist- functions.php, admin/panels/requests.php). Treat large Badges admin screens and filtered/sorted member directories as high-risk on installs with 2000+ users until a follow-up release addresses them.

Fixed

• Issue that caused settings tabs to not display in the UserPro settings page.