-Version 2.0 - 26/10/2026
- Security: image and file uploads now enforce the IMG and FILE permissions on the server side, images are verified by content and saved with a safe, unique name, SVG images are cleaned from scripts and external references, and uploaded files are never overwritten (a counter is added to a duplicated name)
- Security: the HTML kept in comments is now sanitized, also in the backend comments list and in the latest comments module
- Security: the download of comment attachments is now restricted to the files of the comment folder
- New option "Load comments when visible": when the comments are loaded through AJAX, they are requested only when the comments area scrolls into view or the visitor interacts with it, so readers who never reach the comments no longer trigger the extra request
- New option "Send notifications" (Immediately / By cron only): with "By cron only" visitors never wait for notification emails, which are sent by a cron job; when it is selected, the Settings page shows the cron address already filled in with your site URL and secret, with a copy button and ready-to-use examples for Linux, cPanel, Plesk and Windows
- Notification emails are now sent over a single SMTP connection per batch instead of opening a new connection for every message
- Faster comment pages with avatar integrations (Community Builder, Kunena, Membership Pro, K2 and others): the avatars of all the commenters of a page are loaded with a single query instead of two queries for every comment
- The Disqus import now keeps the formatting of the imported comments (bold, italic, lists, links, quotes, code and images) and stores line breaks like native comments
- Frontend language strings for the guest avatar gallery added for fr-FR, de-DE, es-ES and it-IT
- Various bug fixes and stability improvements
CLEAR THE BROWSER CACHE AFTER THE UPDATE
