I have a few clients and i was wondering whats the best way to control and watch over the clients wp.

WordPress Click2Shell flaw lets hackers execute PHP on the server.

An attack could start with a crafted link that leads to installing a vulnerable theme in the catalog. Once the Customizer preview loads the inactive theme's PHP, the code is executed on the server.

Read more here: https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/

A security vulnerability has been reported in Ninja Forms 3.15.3.

The patched version 3.15.4 was released today and includes additional security hardening, including strengthened output escaping in the admin submission edit screen.

If your site is still running 3.15.3, check the plugin page directly. The update may not appear immediately in the WordPress dashboard.

Please update to 3.15.4 as soon as possible.

WordPress.org changelog:
Ninja Forms on WordPress.org

Is anyone else seeing an error in their WP dashboard of "WordPress.com requests to your site are being blocked, usually by a firewall or security rule."

It looks to be associated with Jetpack (hence the wordpress.com reference)?

Environment:
Hosted at IONOS using shared hosting. All plugins (very few) updated. No issues until 7.1.1.

Was working with a developer on UpWork. Noticed he used Elementor for theme.

I asked if license needs to be transferred to me. he told me "oh no you don't need to worry about anything. these theme is like public domain"

(Free, GPL, on wordpress.org: https://wordpress.org/plugins/freshet-unused-media/)

What it does: adds a Usage column to the Media library and, per file, lists every place in the database that still refers to it.

I wrote it because WordPress doesn't know.
Core's "Unattached" filter records one thing: the post you had open when you uploaded.

This has been discussed at great length (my favourite thread on the subject: https://www.reddit.com/r/Wordpress/comments/1j2nagv/how\_to\_clean\_up\_images\_in\_media\_library/) and the verdict is basically always the same: it's tricky.

Where mine differs: it's slow, it's one-directional, and it never tries to prove a file unused. Any ambiguity counts as used.

If you deal with larger, older sites with unruly libraries, pull a local copy and test it, or run it on WP's Playground:
https://playground.wordpress.net/?blueprint-url=https%3A%2F%2Ffreshet.studio%2Fplayground%2Ffreshet-unused-media.json%3Futm_source%3Dreddit%26utm_medium%3Dwordpress

An audit, with numbers, is on my blog:
https://freshet.studio/blog/how-to-find-unused-media-in-wordpress?utm_source=reddit&utm_medium=wordpress

Feedback wanted, especially: a place references hide that the list below misses, and whether the per-file evidence is enough for you to trust a delete.

• post content (every generated size and the -scaled variant)
• postmeta
• ACF fields
• block markup that stores only the attachment ID
• options and theme mods
• widgets
• term meta and user meta
• comments and autosaves

Thanks everyone!

Hi everyone. I’m running into an issue and was hoping someone who has encountered it before could help me out.

I’m using WooCommerce, but since the update last August, I can no longer find the option to change the banner for the shop page. I tried editing it with Elementor, but since I don’t have the Pro version, I can’t edit it directly. (Previously, I could easily change the banner via the admin backend, but now I can't change the image at all.) I can still change banner images for product categories, but the shop page banner remains unchangeable. If anyone knows how to fix this, please let me know.

https://preview.redd.it/nag9rm1gosqh1.png?width=1407&format=png&auto=webp&s=d596640311798431b0e6b1867075461fdd6882f5

https://preview.redd.it/is1p0s5mosqh1.png?width=1088&format=png&auto=webp&s=6e152f1ddfcc7bea964b0cd5c0bcfedbfd720493

Hi all,

I have built an AI chatbot plugin for WordPress, it works with WooCommerce, regular blogs and bbPress forums. A few people have installed it, but nobody has left a review so far, so I'm honestly not sure how well it does its job.

I'd love some straight feedback: what works for you, and what doesn't.

The chatbot only learns from your own site content, nothing external. You install it, plug in your own API key (GPT-5.6 Luna, for instance, costs roughly $1 per 500 conversations), and run a scan. After that it can pull information from up to 1,000 products or pages and combine it into one accurate answer for your visitor.

My hope is that it keeps people on your site a bit longer. Most visitors leave within seconds when they can't find what they came for, and that's the problem I'm trying to solve.

Here's the link if you want to give it a try: https://wordpress.org/plugins/fabio-ai-chatbot-lite/

Thanks in advance for any feedback, good or bad!