What’s New

Fixes across PayPal checkout, shipping zones, and the vendor dashboard, with five security and permission fixes that tighten who can act on orders, refunds, and vendor data.

Payments

• Fix: PayPal Marketplace no longer marks an order as paid when the PayPal capture is declined, and a later genuine payment can still complete the order.
• Fix: The PayPal Marketplace “Standard Button” type is now honored on the WooCommerce checkout block, so the “Place order” button stays visible.
• Privacy and security
• Fix: Patched a stored cross-site scripting vulnerability in Product Q&A answers by sanitizing them on save and on load.
• Fix: Patched a cross-site scripting vulnerability in the legacy admin screens.
• Fix: Restricted marking an order as received to the logged-in customer who owns it.
• Fix: Restricted refund requests so a vendor can only submit them for their own orders.
• Fix: Hardened Printful so a size guide can only be added to the vendor’s own products.

Vendor dashboard

• Fix: The vendor statement report now counts and paginates its entries correctly instead of rendering an empty table.
• Fix: Cleared a React defaultProps warning on the vendor dashboard analytics report tables.
• Orders and shipping
• Fix: Vendor shipping methods now appear only in the shipping zone they belong to, instead of being offered in every zone.
• Fix: Delivery Time slots now display on the block checkout in the site’s 12- or 24-hour time format.
• Performance
• Fix: The Export/Import product listing data now loads only on the vendor dashboard instead of on every front-end page.

Admin tools

Fix: The “Create” and “Cancel” buttons in the Vendor Verification method modal are now aligned and sized consistently, and a double click no longer creates duplicate methods.

A security-focused release that restricts review, attribute, and variation changes to the product’s owner and keeps the Stripe secret key out of vendor records, with fixes to admin-screen counts and storefront performance.

Privacy and security

• Fix: Stopped the Stripe secret API key from being saved to vendor account meta, and cleaned up records that already contained it.
• Fix: Hardened product review moderation so reviews can only be moderated or deleted by the vendor who owns the product, including through bulk actions.
• Fix: Hardened product editing so attributes can only be changed by an administrator or the vendor who owns the product.
• Fix: Restricted removing product variations to the vendor who owns the product.
• Fix: Restricted saving product variations to the vendor who owns the product.
• Fix: Hardened Vendor Verification so new verification requests are always created as pending until an administrator reviews them.

Products

• Fix: Restored the “Search similar products in this marketplace” panel on the new product editor, and limited product cloning to published products only.

Performance

• Fix: Rebuilt the Geolocation category filter as a lightweight component so storefront pages no longer load the full WooCommerce Admin bundle, and corrected category names containing HTML entities.

Admin tools

• Fix: The admin Subscriptions list now includes vendors whose selling is disabled, so their subscription packs can still be managed and cancelled.
• Fix: The “All” count on the Abuse Reports and Product Advertising screens now matches the rows shown, since orphaned entries are kept out of both lists.
• Fix: The AI Assist image “Model” setting now defaults to an image-capable model, so the dropdown no longer renders blank.

A security-hardening release: five ownership checks that ensure vendors can only view or change the shipping rates, subscriptions, and verification records that belong to them.

Privacy and security

• Fix: Restricted Table Rate Shipping rates so only the vendor who owns the shipping method can view, change, or delete them.
• Fix: Restricted Distance Rate Shipping settings so only the vendor who owns the shipping method can view, change, or delete them.
• Fix: Scoped vendor subscription schedule changes to the vendor’s own subscription, so one vendor can no longer alter another’s schedule.
• Fix: Scoped vendor subscription status changes to the vendor’s own subscription, so one vendor can no longer alter another’s status.
• Fix: Scoped the verification requests list to the current vendor, so each vendor sees only their own identity documents.

The Stripe Connect gateway now offers Apple Pay, Google Pay, Link, and other modern Stripe payment methods, built on a new PaymentIntents flow with SCA support.

Payments

• New: Added Stripe Payment Elements to the Stripe Connect gateway on both classic and block checkout, so customers can pay with Apple Pay, Google Pay, Link, and other modern Stripe payment methods.
• Update: Stripe Connect now processes payments through a unified PaymentIntents flow with built-in Strong Customer Authentication (SCA) support, so card payments that require extra verification complete without being declined.

Admin tools

• Fix: The Germanized company and tax fields on the legacy Add Vendor form now line up correctly across both columns.

Four fixes: subscription coupons and pack limits behave correctly, WooCommerce 11.0.1 compatibility is restored, and the Vendor Staff API now checks ownership.

Payments

• Fix: Percentage-based subscription coupons (Sign Up Fee and Recurring) now display as percentages instead of currency amounts, so the discount reads correctly.

Privacy and security

• Fix: Added staff-ownership checks across the Vendor Staff API, so a vendor can only manage and delete their own staff members.

Products

• Fix: The subscription pack’s allowed categories and gallery image limit are now enforced whenever a product is saved — including in the new product editor and via the API — so vendors can’t exceed their pack’s allowance.
• Fix: Restored WooCommerce 11.0.1 compatibility across CSV import, coupon product search (GTIN), vendor order item meta, and booking line items, so these work again on the latest WooCommerce.