v5.3.3 ( Oct 22, 2026 )
———————————–
– **fix:** Ensured Store Support tickets can only reference the customer’s own orders from that vendor.
– **fix:** Patched a SQL injection in vendor verification request sorting by accepting only ascending or descending order.
– **fix:** Prevented PHP object injection through product attributes meta when vendors save or open a product.
– **fix:** Ensured vendors can only view and change their own MangoPay payout bank accounts.
– **fix:** Hid unpublished and deleted product questions and answers from the public REST endpoint.
– **fix:** Ensured vendors can only view their own Distance Rate Shipping settings.
– **fix:** Prevented cross-site scripting through the staff ID on the vendor staff edit form.