Nonprofit Manager

Changelog

2026.05.7

• Fix: Calendar and events list now render as self-contained white cards instead of inheriting the surrounding page background. On themes that paint a colored background on .entry-content (with a matching light foreground color) the old version produced unreadable white-on-light text; explicit dark text + white backgrounds with !important on the critical visual properties defeat that pattern.
• Fix: Calendar wrapper now has max-width 1100px (centered) — it was stretching the full content area on wide pages. Events list capped at 760px in one column, 1100px in a two-column grid above 900px viewport width.
• Polish: New palette — #2563eb accent (true brand blue, reads on white and dark theme cards), #dbeafe event chips with #1d4ed8 link text, #fef3c7 warm yellow «today» highlight. Replaced the inheriting-from-theme defaults that were producing low-contrast mush on themes with colored content backgrounds.
• Polish: Event cards on the [npmp_events] list now show subtle box-shadow + accent left border. On wide screens they auto-arrange into a 2-column grid.

2026.05.6

• Fix: Calendar styles now win the CSS cascade against theme rules — every selector is scoped under .npmp-calendar-wrapper / .npmp-events-list / .npmp-event-details, so themes like Astra that ship .entry-content table rules can no longer override the grid layout.
• Fix: Calendar no longer renders twice on the configured calendar page. The auto-inject filter now checks the original stored post_content for the [npmp_calendar] shortcode (not the post-shortcode-processing content) so it correctly recognises that the calendar is already present.
• Change: [npmp_events] no longer dumps full event excerpts into the list by default. Opt in with show_excerpt=»true» and optionally cap the length with excerpt_chars=»N». The default list is title + date + location only, so the page is scannable.
• Polish: Refined default calendar palette — softer borders, neutral mid-blue accent that reads on light and dark themes, distinct «today» highlight in a warm yellow instead of competing with the link color.

2026.05.5

• Security: Public unsubscribe and signup forms now require email-owned confirmation links before changing subscription state. Closes a vector where any visitor could unsubscribe or resubscribe anyone by typing their email.
• Security: PayPal donations are now verified server-side via PayPal’s Orders v2 API before a donation is logged. Removes a trust-the-client vector where an attacker with a page nonce could fabricate donations.
• Security: Stripe donations are no longer logged when the Checkout Session is created — only after Stripe confirms payment_status === 'paid' via a verification endpoint called from the success page.
• Security: Donation idempotency on PayPal order id and Stripe session id stops duplicate logging on webhook retries.
• Security: Stripe donation-session endpoint now refuses to run when Stripe is not in the enabled-gateways list.
• Security: General-settings handler now enforces manage_options capability before mutating options.
• Security: Newsletter «Send Now» now requires manage_options (in addition to edit_post) so lower-privileged editors cannot blast the CRM list.
• Correctness: log_donation() returns WP_Error on failure instead of false — callers that check is_wp_error() now actually catch the failure paths (no more thank-you emails for un-logged donations).
• Cleanup: Removed dead includes/payments/npmp-paypal.php (legacy unused gateway file).
• Cleanup: Default membership level on form signup now reads npmp_default_membership_level instead of hardcoding «member».
• Extension: Added npmp_member_edit_fields action inside the member edit form so Pro custom fields can render. Added npmp_member_saved action after create/update so Pro custom fields can persist their values. Added npmp_email_settings_before_form action above the Email Settings form so the Pro email-provider wizard renders. (Previously Pro hooks pointed at actions that nothing fired — three Pro features were silently broken.)

2026.05.4

• Added: Calendar and events list now ship a proper stylesheet — themed table grid, responsive day-stack layout on mobile, accessible focus states, and a print stylesheet for paper handouts.
• Added: Calendar Settings → Appearance section with theme-integration mode (auto / full / theme-only), density (compact / comfortable / spacious), accent color picker, and show-event-times toggle.
• Added: Stylesheet only loads on pages that render the calendar — no front-end bloat on the rest of the site.
• Added: Three extension filters for theme/Pro integration — npmp_calendar_inline_css, npmp_calendar_settings_fields, npmp_calendar_data_attrs.
• Accessibility: Calendar nav links got descriptive aria-labels; today’s cell now carries aria-current=»date»; nav arrows are aria-hidden so screen readers don’t read «left arrow Previous».

2026.05.3

• Fixed: «View Members» link on the import success screen now lands on the actual members list (was hitting a permission-denied page).
• Fixed: Constant Contact access-token field now respects autocomplete=»off» / spellcheck=»false», matching the Mailchimp key field.
• Accessibility: Added keyboard focus indicator to import-source picker cards.
• Accessibility: Import progress bar now exposes ARIA progressbar role + live region for screen readers.
• Accessibility: Wizard error notices now announce via role=»alert».
• Accessibility: «Auto-detected» column-mapping indicator darkened and bumped to WCAG AA contrast.
• Accessibility: Mailchimp / Constant Contact list-selector labels are now properly associated with their selects.
• Changed: Import upgrade CTA now routes through the npmp_get_upgrade_url() helper.

2026.05.2

• Added: Import members from Mailchimp, Constant Contact, CSV, XLSX, and Google Sheets (up to 50 per import; Pro removes the cap)
• Added: Mailchimp custom merge-field mapping — see every merge tag your audience has, not just FNAME/LNAME/PHONE
• Added: Chunked async Mailchimp import — large audiences no longer hit PHP timeouts
• Added: Import menu now lives under Members → Import

2026.05.1

• Changed: Versioning scheme moved to date-based (yyyy.mm.primary.minor) so Free and Pro stay in lockstep
• Performance: Bulk-load post meta on member admin list (explicit update_post_meta_cache)
• Performance: Cache donation summary statistics for the dashboard (1-hour transient, version-keyed)
• Filter: Added npmp_recaptcha_score_threshold filter for tuning v3 score per action

2.0.1

• Changed: Pro features now work when Pro plugin is installed (license required for updates only)
• Fixed: Class declaration conflict when upgrading Pro plugin

2.0.0

• Added: Stripe payment gateway for free users (one-time donations)
• Added: Social sharing module – auto-share posts and events to Facebook and X (Twitter)
• Added: Subscriber notification preferences (instant or weekly digest for new posts/events)
• Added: Convert any post or page to a calendar event with one click
• Added: Click tracking for newsletter links (previously «coming soon»)
• Added: Manage preferences page with HMAC-secured subscriber links
• Added: Weekly digest cron for automatic summary emails
• Improved: Newsletter tracking now uses HMAC tokens instead of expiring nonces (links work indefinitely)
• Improved: Stripe checkout now includes security nonce in multi-gateway form
• Improved: Upgrade URL now points to nonprofitmanager.ericrosenberg.com
• Security: Fixed missing nonce in multi-gateway Stripe AJAX call
• Pro: License key system with activation, deactivation, and auto-updates
• Pro: Recurring donations with Stripe subscription management
• Pro: Custom member fields (8 field types, drag-and-drop ordering)
• Pro: Email automation engine with 5 trigger types
• Pro: Advanced member segmentation with AND/OR condition builder
• Pro: Import from Mailchimp, Constant Contact, CSV, XLSX, Google Sheets
• Pro: 5 additional social networks (Reddit, Bluesky, Mastodon, Threads, Nextdoor)
• Pro: Guided email provider setup wizard with connection testing
• Pro: Email validation before sending to external provider APIs

1.1.3

• Added: Plugin action links (Overview, Developer, Support) for easy access
• Added: Membership and Donations summary tables on main overview page
• Improved: Main page layout – feature activation box now auto-sizes to content
• Improved: Membership Settings page now includes membership levels management
• Changed: «Membership Forms» renamed to «Membership Settings» for clarity
• Updated: Tested up to WordPress 6.8.3

1.1.2

• Fixed: Dashboard widget member count now displays accurate data using correct meta key

1.1.1

• Fixed: Venmo payment button now uses proper deep link protocol with fallback to profile page

1.1

• Added: Newsletter template system with Gutenberg editor
• Added: «Send to All Members» option for newsletters
• Added: Version mismatch warning for Pro users
• Added: Admin helper functions for consistent UI
• Improved: Security – verified all nonce checks and sanitization
• Improved: Performance – optimized member counting queries
• Improved: UI consistency across all admin pages
• Fixed: Newsletter audience selection and tracking
• Fixed: PayPal button rendering issues

1.0.2

• Fixed: AWS SES validation for email delivery
• Fixed: PayPal/Venmo button display issues
• Fixed: Dashboard widget member counts
• Improved: Email delivery error handling

1.0.1

• Fixed: Activation hooks for better compatibility
• Improved: Setup wizard flow
• Added: Better error messages for payment processing

1.0.0

• Initial release
• Membership management system
• Donation processing (PayPal, Venmo)
• Basic email newsletter functionality
• Event calendar
• Setup wizard