October 2026: Mageplaza Extensions Releases

• Security: We closed an unauthenticated gift card cron endpoint, and made gift codes that already have an owner unavailable to other customers.
• Security: We fixed the gift code attempt limit, so repeated wrong codes are now locked out per IP address.
• Bug Fix: We fixed a balance race that allowed two simultaneous checkouts to spend more than the remaining gift card balance.
• Bug Fix: We fixed gift card delivery, so a card is marked as sent only after it is delivered, and expiry reminders are sent once per day.
• Bug Fix: We fixed duplicate gift codes in pool generation and added a unique key on the gift code.
• Bug Fix: Hyvä - We fixed the gift card preview, the cart and the My Gift Card page.

• Compatibility: The extension is now compatible with Hyvä Checkout.
• Bug Fix: We fixed several Hyvä Checkout issues with customer address attributes, including attribute values not being mapped or displayed correctly and the upload button not using the theme colours.
• Bug Fix: We fixed a 500 error on the registration page and duplicated attribute fields on Adobe Commerce.
• Bug Fix: We fixed attribute values being double-escaped, and empty optional select and date attributes blocking forms and checkout.
• Bug Fix: We fixed address attributes always being joined with a line break instead of the address format separator.
• Bug Fix: We added missing output escaping in the Hyvä file upload preview, swatch and visual textarea templates.

• Compatibility: The extension is now compatible with Magento 2.4.9 and PHP 8.5
• Bug Fix: We fixed an issue where the Orders grid failed to load when it contained rows of orders that no longer exist.
• Bug Fix: We fixed mass invoice errors being counted as orders that do not allow an invoice and not being logged. They are now logged and reported separately.

• Compatibility: The extension is now compatible with Magento 2.4.9 and PHP 8.5
• Bug Fix: We fixed an issue where saving a rule without an image logged a critical error.
• Bug Fix: We fixed the rule conditions tab not applying the form object to nested conditions.
• Bug Fix: We fixed the alignment of the Delete Image checkbox on the label edit form.

• Compatibility: The extension is now compatible with Magento 2.4.9 and PHP 8.5
• Bug Fix: We fixed an issue where all bin/magento commands failed with a fatal error when the extension was enabled on Magento 2.4.9.
• Bug Fix: We fixed an issue where the item columns (Item Details, Thumbnail, Product Name, SKU, Qty, Price) were empty when exporting the order grid to CSV/XML.

• Compatibility: The extension is now compatible with Magento 2.4.9 and PHP 8.5
• Bug Fix: We fixed the default sort of the Ordered Products History grid on the customer edit page, which was not being applied.

• Bug Fix: Hyvä - We fixed the option dependency logic for swatch and required options, and fixed hidden options still adding their price to the product total.
• Bug Fix: We fixed an issue where a required option with dependency rules could block adding the product to cart.

• Compatibility: The extension is now compatible with PHP 8.5.
• Security: We restricted shipping label access to the request owner or guests with a valid access key.
• Security: We added server-side reCAPTCHA verification for RMA submissions.
• Bug Fix: We fixed validation of required additional fields when values are missing or contain only whitespace.
• Bug Fix: We fixed reCAPTCHA integration with Mageplaza Security while preserving support for the legacy Google Recaptcha extension.
• Bug Fix: Hyvä - We added an error message when reCAPTCHA is unavailable during request submission.

Standard:

• Security: We replaced the regex filter on post content, short description and author bio with a DOM allowlist sanitizer, and escaped user-supplied values in the category menu and category tree, search suggestions, author sign-up, widgets and the logged-in customer name in comment responses.
• Security: We enforced admin ACL permissions on the blog grids, forms and import, required POST and a form key for deleting posts, author registration, comment preview and view counting, limited author pages to approved authors and post previews to the post's author, rejected comments when the built-in comment system is not enabled or a reply does not belong to the post, hid exception details from comment responses, and made author creation at account registration respect the "Allows customers to register as an author" setting.
• Security: We blocked Import from connecting to private, reserved or malformed database hosts, added an "Allowed Import Database Hosts" setting for trusted hosts, and cleared the stored database credentials from the session after an import.
• Bug Fix: We fixed the Monthly Archive so posts are grouped and month pages are filtered by the store time zone.
• Bug Fix: We fixed several minor issues: logged-in customers could not open or submit the author sign-up when customer approval is enabled, a PHP 8.5 deprecation in the admin category selector, a null error in the author creation observer, the blog search suggestions width on mobile, the My Posts status badge covering the post title, and missing translation entries.
• Bug Fix: Hyvä - We fixed the Add New Post modal on mobile and tablet and the author page styles.

Professional:

• Security: We applied the same sanitizer to post content, author bio and short description on post views, post lists and author pages, and escaped tag links, the sidebar category tree and the article structured data (JSON-LD).
• Security: We hardened Save Post: it now requires a POST request with a form key, respects the enable-save setting, only accepts enabled posts, and matches customers by exact ID so saved lists and the saved icon no longer mix up customers whose IDs overlap.
• Bug Fix: We fixed List Post Save so any logged-in customer can open it, not only authors.
• Bug Fix: Luma - We fixed the left action bar covering post content and jumping while scrolling, the sidebar dropping below the post list at tablet widths, wide post tables overflowing, and the list meta row not wrapping.
• Bug Fix: Hyvä - We fixed the left action bar covering post content on screens below 1600px.

Standard:

• Security: We fixed an issue where registering at checkout with an email that already belongs to an account signed the shopper in to that account. The order is now placed as a guest order, and the shopper is asked to sign in to manage it.
• Bug Fix: We fixed account creation at checkout failing for new email addresses, and the account confirmation and registration messages not appearing on the order success page.
• Bug Fix: We fixed downloadable product links being assigned to the wrong customer when an account was created at checkout.

• New Update: We optimized product data collection for GTM events on category and product listing pages, reducing database queries on large catalogs.
• Bug Fix: We fixed an issue where add_to_cart and remove_from_cart events were not pushed to the data layer on full-page-cached pages.
• Bug Fix: We fixed GA4 item data - GA4-standard parameter names (item_id, item_name, item_list_name, item_brand, item_variant), the full category path sent as item_category levels, quantity 1 for product impressions, and item_brand no longer defaulting to "Default" when a product has no brand.

• Bug Fix: We fixed the coupon popup hiding valid pickup rules when an earlier rule had no coupon codes yet (Hyvä: the popup stopped rendering the remaining rules; Luma: an empty card was shown).