Prep Plugin for release on WordPress.org

Escape everything that should be escaped.
Add nonce checks where needed.
Sanitize all inputs.
Apply Code style changes across the codebase.
Correct many deprecation notices.
Optimize load order of many filters.

.phpcs.xml.dist

@@ -36,18 +36,18 @@
 	    <exclude name="WordPress.WhiteSpace.OperatorSpacing.NoSpaceBefore" />
 	    <exclude name="Universal.Arrays.DisallowShortArraySyntax" />
 	    <exclude name="Universal.Operators.DisallowShortTernary" />
+	    <exclude name="Squiz.Commenting.FileComment.SpacingAfterOpen" />
+        <exclude name="Squiz.Commenting.FileComment.SpacingAfterComment" />
+        <exclude name="Squiz.Commenting.FileComment.PackageName" />
+        <exclude name="WordPress.WP.GlobalVariablesOverride.Prohibited" />
+        <exclude name="Generic.Commenting.DocComment.MissingShort" />
 	</rule>
 	<rule ref="WordPress.NamingConventions.PrefixAllGlobals">
 		<properties>
 			<!-- Value: replace the function, class, and variable prefixes used. Separate multiple prefixes with a comma. -->
 			<property name="prefixes" type="array" value="wu_,wp_ultimo"/>
 		</properties>
-	</rule>
+		<exclude-pattern>/views/</exclude-pattern>
-	<rule ref="WordPress.WP.I18n">
-		<properties>
-			<!-- Value: replace the text domain used. -->
-			<property name="text_domain" type="array" value="wp-ultimo"/>
-		</properties>
 	</rule>
 	<rule ref="WordPress.WhiteSpace.ControlStructureSpacing">
 		<properties>
@@ -74,8 +74,24 @@
 	</rule>
 	<rule ref="Generic.WhiteSpace.ArbitraryParenthesesSpacing">
         <properties>
-            <property name="spacing" value="0"/>
+            <property name="spacing" value="0"/>read_notes
             <property name="ignoreNewlines" value="true"/>
         </properties>
     </rule>
+    <rule ref="WordPress.WP.Capabilities">
+        <properties>
+            <property name="custom_capabilities" type="array">
+                <element key="0" value="wu_edit_broadcasts"/>
+                <element key="1" value="wu_edit_checkout_forms"/>
+                <element key="2" value="wu_edit_settings"/>
+                <element key="3" value="wu_read_sites"/>
+                <element key="4" value="read_notes"/>
+                <element key="5" value="edit_notes"/>
+                <element key="6" value="delete_notes"/>
+                <element key="7" value="wu_edit_payments"/>
+                <element key="8" value="wu_edit_sites"/>
+            </property>
+        </properties>
+    </rule>
+
 </ruleset>

assets/css/admin.css

@@ -1851,7 +1851,7 @@ a.button.wu-button-delete.wu-border-none {
   border-width: 0;
 }
 a.button.wu-button-delete:hover {
-  border-width: 1 !important;
+  border-width: 1px !important;
   color: #8b0000;
   background-color: transparent;
 }
@@ -5193,7 +5193,7 @@ td.column-id {
   padding: 0;
   margin: -19px 0 0 -19px;
   background-image: url("../img/loader.svg");
-  background-repeat: none;
+  background-repeat: no-repeat;
   background-position: center center;
   width: 38px;
   height: 38px;

assets/js/dns-table.js

@@ -0,0 +1,45 @@
+(function($) {
+
+    wu_dns_table = new Vue({
+        el: '#wu-dns-table',
+        data: {
+            error: null,
+            results: {},
+            loading: true,
+        },
+        updated() {
+            this.$nextTick(function() {
+
+                window.wu_initialize_tooltip();
+
+            });
+        }
+    })
+
+    $(document).ready(function() {
+
+        $.ajax({
+            url: ajaxurl,
+            data: {
+                action: 'wu_get_dns_records',
+                domain: '<?php echo esc_js($domain->get_domain()); ?>',
+            },
+            success: function(data) {
+
+                Vue.set(wu_dns_table, 'loading', false);
+
+                if (data.success) {
+
+                    Vue.set(wu_dns_table, 'results', data.data);
+
+                } else {
+
+                    Vue.set(wu_dns_table, 'error', data.data);
+
+                }
+
+            },
+        })
+
+    });
+})(jQuery);

assets/js/settings-loader.js

@@ -0,0 +1,13 @@
+settings_loader = wu_block_ui('#wp-ultimo-wizard-body');
+
+/**
+ * Remove the block ui after the settings loaded.
+ *
+ * @since 2.0.0
+ * @return void
+ */
+function remove_block_ui() {
+
+	settings_loader.unblock();
+
+}

assets/js/webhook-page.js

@@ -27,9 +27,9 @@
 
 			if (page === 'edit') {
 
-				webhook_url = $('input[name=webhook_url').val();
+				webhook_url = $('input[name=webhook_url]').val();
 
-				webhook_event = $('select[name=event').val();
+				webhook_event = $('select[name=event]').val();
 
 				const id = $(this).data('object');
 

inc/admin-pages/class-broadcast-edit-admin-page.php

@@ -454,7 +454,7 @@ class Broadcast_Edit_Admin_Page extends Edit_Admin_Page {
 			$item = $query->get_item_by('id', $_GET['id']);
 
 			if ( ! $item) {
-				wp_redirect(wu_network_admin_url('wp-ultimo-broadcasts'));
+				wp_safe_redirect(wu_network_admin_url('wp-ultimo-broadcasts'));
 
 				exit;
 			}

inc/admin-pages/class-checkout-form-edit-admin-page.php

@@ -107,7 +107,7 @@ class Checkout_Form_Edit_Admin_Page extends Edit_Admin_Page {
 	 */
 	public function add_width_control_script(): void {
 
-		wp_enqueue_script('wu-checkout-form-edit-modal', wu_get_asset('checkout-form-editor-modal.js', 'js'), [], wu_get_version());
+		wp_enqueue_script('wu-checkout-form-edit-modal', wu_get_asset('checkout-form-editor-modal.js', 'js'), [], wu_get_version(), true);
 	}
 
 	/**
@@ -544,7 +544,7 @@ class Checkout_Form_Edit_Admin_Page extends Edit_Admin_Page {
 			$default_field['wrapper_html_attr'] = array_merge(
 				wu_get_isset($default_field, 'wrapper_html_attr', []),
 				[
-					'v-if'    => sprintf('type && require("type", %s) && require("tab", "%s")', json_encode($reqs), $tab),
+					'v-if'    => sprintf('type && require("type", %s) && require("tab", "%s")', wp_json_encode($reqs), $tab),
 					'v-cloak' => '1',
 				]
 			);
@@ -552,11 +552,11 @@ class Checkout_Form_Edit_Admin_Page extends Edit_Admin_Page {
 			if ('name' === $default_field_slug || 'id' === $default_field_slug || 'default_value' === $default_field_slug) {
 				unset($default_field['wrapper_html_attr']['v-if']);
 
-				$default_field['wrapper_html_attr']['v-show'] = sprintf('type && require("type", %s) && require("tab", "%s")', json_encode($reqs), $tab);
+				$default_field['wrapper_html_attr']['v-show'] = sprintf('type && require("type", %s) && require("tab", "%s")', wp_json_encode($reqs), $tab);
 			}
 
 			if ('id' === $default_field_slug) {
-				$default_field['html_attr']['v-bind:required'] = sprintf('type && require("type", %s) && require("tab", "content")', json_encode($reqs));
+				$default_field['html_attr']['v-bind:required'] = sprintf('type && require("type", %s) && require("tab", "content")', wp_json_encode($reqs));
 			}
 		}
 
@@ -1161,10 +1161,10 @@ class Checkout_Form_Edit_Admin_Page extends Edit_Admin_Page {
 
 		wp_enqueue_script('wu-checkout-form-editor');
 
-		wp_enqueue_script('wu-vue-sortable', '//cdn.jsdelivr.net/npm/sortablejs@1.8.4/Sortable.min.js', [], wu_get_version());
+		wp_enqueue_script('wu-vue-sortable', '//cdn.jsdelivr.net/npm/sortablejs@1.8.4/Sortable.min.js', [], wu_get_version(), true);
-		wp_enqueue_script('wu-vue-draggable', '//cdnjs.cloudflare.com/ajax/libs/Vue.Draggable/2.20.0/vuedraggable.umd.min.js', [], wu_get_version());
+		wp_enqueue_script('wu-vue-draggable', '//cdnjs.cloudflare.com/ajax/libs/Vue.Draggable/2.20.0/vuedraggable.umd.min.js', [], wu_get_version(), true);
 
-		wp_enqueue_style('wu-checkout-form-editor', wu_get_asset('checkout-editor.css', 'css'));
+		wp_enqueue_style('wu-checkout-form-editor', wu_get_asset('checkout-editor.css', 'css'), [], wu_get_version());
 	}
 
 	/**
@@ -1500,7 +1500,7 @@ class Checkout_Form_Edit_Admin_Page extends Edit_Admin_Page {
 		$item = wu_get_checkout_form($item_id);
 
 		if ( ! $item) {
-			wp_redirect(wu_network_admin_url('wp-ultimo-checkout-forms'));
+			wp_safe_redirect(wu_network_admin_url('wp-ultimo-checkout-forms'));
 
 			exit;
 		}

inc/admin-pages/class-checkout-form-list-admin-page.php

@@ -163,7 +163,7 @@ class Checkout_Form_List_Admin_Page extends List_Admin_Page {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'add_checkout_form_field',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'template' => 'single-step',
 						]

inc/admin-pages/class-customer-edit-admin-page.php

@@ -765,7 +765,7 @@ class Customer_Edit_Admin_Page extends Edit_Admin_Page {
 			[
 				'html_attr' => [
 					'data-wu-app' => 'customer_save',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'original_user_id'            => $this->get_object()->get_user_id(),
 							'user_id'                     => $this->get_object()->get_user_id(),
@@ -797,7 +797,7 @@ class Customer_Edit_Admin_Page extends Edit_Admin_Page {
 							'data-label-field'  => 'display_name',
 							'data-search-field' => 'display_name',
 							'data-max-items'    => 1,
-							'data-selected'     => json_encode($this->get_object()->get_user()->data),
+							'data-selected'     => wp_json_encode($this->get_object()->get_user()->data),
 						],
 						'wrapper_html_attr' => [
 							'v-cloak' => '1',
@@ -1082,7 +1082,7 @@ class Customer_Edit_Admin_Page extends Edit_Admin_Page {
 		$item = wu_get_customer($item_id);
 
 		if ( ! $item || $item->get_type() !== 'customer') {
-			wp_redirect(wu_network_admin_url('wp-ultimo-customers'));
+			wp_safe_redirect(wu_network_admin_url('wp-ultimo-customers'));
 
 			exit;
 		}
@@ -1123,7 +1123,7 @@ class Customer_Edit_Admin_Page extends Edit_Admin_Page {
 				]
 			);
 
-			wp_redirect($redirect_url);
+			wp_safe_redirect($redirect_url);
 
 			exit;
 		}

inc/admin-pages/class-customer-list-admin-page.php

@@ -260,7 +260,7 @@ class Customer_List_Admin_Page extends List_Admin_Page {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'add_new_customer',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'set_password' => false,
 							'type'         => 'existing',

inc/admin-pages/class-customizer-admin-page.php

@@ -89,7 +89,16 @@ abstract class Customizer_Admin_Page extends Edit_Admin_Page {
 
 		parent::register_scripts();
 
-		wp_enqueue_script('wu-customizer', wu_get_asset('customizer.js', 'js'), ['jquery', 'wu-vue', 'wu-block-ui'], \WP_Ultimo::VERSION, ['async' => true, 'in_footer' => true]);
+		wp_enqueue_script(
+			'wu-customizer',
+			wu_get_asset('customizer.js', 'js'),
+			['jquery', 'wu-vue', 'wu-block-ui'],
+			\WP_Ultimo::VERSION,
+			[
+				'async'     => true,
+				'in_footer' => true,
+			]
+		);
 
 		wp_enqueue_style('wp-color-picker');
 

inc/admin-pages/class-dashboard-admin-page.php

@@ -604,9 +604,9 @@ class Dashboard_Admin_Page extends Base_Admin_Page {
 
 		$slug = $args['slug'];
 
-		$header_strings = json_encode($args['headers']);
+		$header_strings = wp_json_encode($args['headers']);
 
-		$data_strings = json_encode($args['data']);
+		$data_strings = wp_json_encode($args['data']);
 
 		$html = "<div class='wu-bg-gray-100 wu-p-2 wu-text-right wu-border-0 wu-border-b wu-border-solid wu-border-gray-400'>
 

inc/admin-pages/class-discount-code-edit-admin-page.php

@@ -409,7 +409,7 @@ class Discount_Code_Edit_Admin_Page extends Edit_Admin_Page {
 				'wrapper_classes'   => '',
 				'html_attr'         => [
 					':name'    => "'allowed_products[]'",
-					':checked' => json_encode(!$this->get_object()->get_limit_products() || in_array($product_id, $this->get_object()->get_allowed_products())), // phpcs:ignore
+					':checked' => wp_json_encode(!$this->get_object()->get_limit_products() || in_array($product_id, $this->get_object()->get_allowed_products())), // phpcs:ignore
 					':value'   => $product_id,
 				],
 				'wrapper_html_attr' => [
@@ -609,7 +609,7 @@ class Discount_Code_Edit_Admin_Page extends Edit_Admin_Page {
 			$item = wu_get_discount_code($item_id);
 
 			if ( ! $item) {
-				wp_redirect(wu_network_admin_url('wp-ultimo-discount_codes'));
+				wp_safe_redirect(wu_network_admin_url('wp-ultimo-discount_codes'));
 
 				exit;
 			}

inc/admin-pages/class-domain-edit-admin-page.php

@@ -94,6 +94,26 @@ class Domain_Edit_Admin_Page extends Edit_Admin_Page {
 
 		add_action('wu_after_delete_domain_modal', [$this, 'domain_after_delete_actions']);
 	}
+	/**
+	 * Registers the necessary scripts and styles for this admin page.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function register_scripts(): void {
+		parent::register_scripts();
+
+		wp_enqueue_script(
+			'wu-dns-table',
+			wu_get_asset('dns-table.js', 'js'),
+			['jquery', 'wu-vue'],
+			\WP_Ultimo::VERSION,
+			[
+				'async'     => true,
+				'in_footer' => true,
+			]
+		);
+	}
 
 	/**
 	 * Adds the extra delete fields to the delete form.
@@ -126,8 +146,8 @@ class Domain_Edit_Admin_Page extends Edit_Admin_Page {
 					'data-label-field'  => 'domain',
 					'data-search-field' => 'domain',
 					'data-max-items'    => 1,
-					'data-exclude'      => json_encode([$domain->get_id()]),
+					'data-exclude'      => wp_json_encode([$domain->get_id()]),
-					'data-include'      => json_encode($domain->get_blog_id()),
+					'data-include'      => wp_json_encode($domain->get_blog_id()),
 				],
 				'wrapper_html_attr' => [
 					'v-if' => $is_primary_domain && $has_other_domains ? 'true' : 'false',
@@ -312,7 +332,7 @@ class Domain_Edit_Admin_Page extends Edit_Admin_Page {
 							'data-label-field'  => 'title',
 							'data-search-field' => 'title',
 							'data-max-items'    => 1,
-							'data-selected'     => $this->get_object()->get_site() ? json_encode($this->get_object()->get_site()->to_search_results()) : '',
+							'data-selected'     => $this->get_object()->get_site() ? wp_json_encode($this->get_object()->get_site()->to_search_results()) : '',
 						],
 						'wrapper_html_attr' => [
 							'v-cloak' => '1',
@@ -322,7 +342,7 @@ class Domain_Edit_Admin_Page extends Edit_Admin_Page {
 			]
 		);
 
-		$check_for_active_string = sprintf('%s.includes(stage)', json_encode(\WP_Ultimo\Models\Domain::INACTIVE_STAGES));
+		$check_for_active_string = sprintf('%s.includes(stage)', wp_json_encode(\WP_Ultimo\Models\Domain::INACTIVE_STAGES));
 
 		$this->add_fields_widget(
 			'basic',
@@ -502,7 +522,7 @@ class Domain_Edit_Admin_Page extends Edit_Admin_Page {
 		$item = wu_get_domain($item_id);
 
 		if ( ! $item) {
-			wp_redirect(wu_network_admin_url('wp-ultimo-domains'));
+			wp_safe_redirect(wu_network_admin_url('wp-ultimo-domains'));
 
 			exit;
 		}

inc/admin-pages/class-domain-list-admin-page.php

@@ -196,7 +196,7 @@ class Domain_List_Admin_Page extends List_Admin_Page {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'add_new_domain',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'type'           => 'add',
 							'primary_domain' => false,

inc/admin-pages/class-edit-admin-page.php

@@ -184,7 +184,7 @@ abstract class Edit_Admin_Page extends Base_Admin_Page {
 			 */
 			$this->get_object()->unlock();
 
-			wp_redirect(
+			wp_safe_redirect(
 				remove_query_arg(
 					[
 						'remove-lock',
@@ -856,7 +856,7 @@ abstract class Edit_Admin_Page extends Base_Admin_Page {
 
 			$url = add_query_arg($array_params);
 
-			wp_redirect($url);
+			wp_safe_redirect($url);
 
 			return true;
 		}
@@ -885,7 +885,7 @@ abstract class Edit_Admin_Page extends Base_Admin_Page {
 		$url = str_replace('_', '-', (string) $object->model);
 		$url = wu_network_admin_url("wp-ultimo-{$url}s");
 
-		wp_redirect($url);
+		wp_safe_redirect($url);
 
 		exit;
 	}

inc/admin-pages/class-email-edit-admin-page.php

@@ -528,7 +528,7 @@ class Email_Edit_Admin_Page extends Edit_Admin_Page {
 			$item = $query->get_item_by('id', $_GET['id']);
 
 			if (! $item) {
-				wp_redirect(wu_network_admin_url('wp-ultimo-emails'));
+				wp_safe_redirect(wu_network_admin_url('wp-ultimo-emails'));
 
 				exit;
 			}

inc/admin-pages/class-email-template-customize-admin-page.php

@@ -496,7 +496,7 @@ class Email_Template_Customize_Admin_Page extends Customizer_Admin_Page {
 					'style'                    => 'margin-top: -6px;',
 					'data-wu-app'              => 'email_template_customizer',
 					'data-wu-customizer-panel' => true,
-					'data-state'               => json_encode($state),
+					'data-state'               => wp_json_encode($state),
 				],
 			]
 		);
@@ -577,7 +577,7 @@ class Email_Template_Customize_Admin_Page extends Customizer_Admin_Page {
 
 		$url = add_query_arg('updated', '1');
 
-		wp_redirect($url);
+		wp_safe_redirect($url);
 
 		exit;
 	}

inc/admin-pages/class-event-view-admin-page.php

@@ -178,7 +178,7 @@ class Event_View_Admin_Page extends Edit_Admin_Page {
 			[
 				'title'        => __('Event Payload', 'wp-multisite-waas'),
 				'loading_text' => __('Loading Payload', 'wp-multisite-waas'),
-				'payload'      => json_encode($object->get_payload(), JSON_PRETTY_PRINT),
+				'payload'      => wp_json_encode($object->get_payload(), JSON_PRETTY_PRINT),
 			]
 		);
 	}
@@ -272,7 +272,7 @@ class Event_View_Admin_Page extends Edit_Admin_Page {
 			}
 		}
 
-		wp_redirect(wu_network_admin_url('wp-ultimo-events'));
+		wp_safe_redirect(wu_network_admin_url('wp-ultimo-events'));
 
 		exit;
 	}

inc/admin-pages/class-hosting-integration-wizard-admin-page.php

@@ -93,7 +93,7 @@ class Hosting_Integration_Wizard_Admin_Page extends Wizard_Admin_Page {
 		}
 
 		if ( ! $this->integration) {
-			wp_redirect(network_admin_url('admin.php?page=wp-ultimo-settings'));
+			wp_safe_redirect(network_admin_url('admin.php?page=wp-ultimo-settings'));
 
 			exit;
 		}
@@ -294,7 +294,7 @@ class Hosting_Integration_Wizard_Admin_Page extends Wizard_Admin_Page {
 
 		$this->integration->enable();
 
-		wp_redirect($this->get_next_section_link());
+		wp_safe_redirect($this->get_next_section_link());
 
 		exit;
 	}
@@ -316,7 +316,7 @@ class Hosting_Integration_Wizard_Admin_Page extends Wizard_Admin_Page {
 				]
 			);
 
-			wp_redirect($redirect_url);
+			wp_safe_redirect($redirect_url);
 
 			exit;
 		}
@@ -332,7 +332,7 @@ class Hosting_Integration_Wizard_Admin_Page extends Wizard_Admin_Page {
 
 		$redirect_url = remove_query_arg('manual', $redirect_url);
 
-		wp_redirect($redirect_url);
+		wp_safe_redirect($redirect_url);
 
 		exit;
 	}

inc/admin-pages/class-invoice-template-customize-admin-page.php

@@ -286,7 +286,7 @@ class Invoice_Template_Customize_Admin_Page extends Customizer_Admin_Page {
 					'style'                    => 'margin-top: -6px;',
 					'data-wu-app'              => 'invoice_customizer',
 					'data-wu-customizer-panel' => true,
-					'data-state'               => json_encode($state),
+					'data-state'               => wp_json_encode($state),
 				],
 			]
 		);
@@ -357,7 +357,7 @@ class Invoice_Template_Customize_Admin_Page extends Customizer_Admin_Page {
 
 		$url = add_query_arg('updated', '1');
 
-		wp_redirect($url);
+		wp_safe_redirect($url);
 
 		exit;
 	}

inc/admin-pages/class-membership-edit-admin-page.php

@@ -259,7 +259,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'true',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'confirmed' => false,
 						]
@@ -519,7 +519,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 					'data-label-field'  => 'display_name',
 					'data-search-field' => 'display_name',
 					'data-max-items'    => 1,
-					'data-selected'     => $this->get_object()->get_customer() ? json_encode($this->get_object()->get_customer()->to_search_results()) : '',
+					'data-selected'     => $this->get_object()->get_customer() ? wp_json_encode($this->get_object()->get_customer()->to_search_results()) : '',
 				],
 				'wrapper_html_attr' => [
 					'v-cloak' => '1',
@@ -583,7 +583,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 			[
 				'html_attr' => [
 					'data-wu-app' => 'membership_save',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'status'               => $this->get_object()->get_status(),
 							'original_customer_id' => $this->get_object()->get_customer_id(),
@@ -602,7 +602,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 				'title'     => __('Billing Amount', 'wp-multisite-waas'),
 				'html_attr' => [
 					'data-wu-app' => 'true',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'is_recurring'            => $this->get_object()->is_recurring(),
 							'is_auto_renew'           => $this->get_object()->should_auto_renew(),
@@ -1082,7 +1082,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 		$item = wu_get_membership($item_id);
 
 		if ( ! $item) {
-			wp_redirect(wu_network_admin_url('wp-ultimo-memberships'));
+			wp_safe_redirect(wu_network_admin_url('wp-ultimo-memberships'));
 
 			exit;
 		}
@@ -1162,7 +1162,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 
 		$url = add_query_arg($array_params);
 
-		wp_redirect($url);
+		wp_safe_redirect($url);
 
 		return true;
 	}
@@ -1227,7 +1227,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 
 			$url = remove_query_arg('preview-swap', $url);
 
-			wp_redirect($url);
+			wp_safe_redirect($url);
 
 			return true;
 		}
@@ -1583,7 +1583,7 @@ class Membership_Edit_Admin_Page extends Edit_Admin_Page {
 					'data-label-field'  => 'name',
 					'data-search-field' => 'name',
 					'data-max-items'    => 1,
-					'data-selected'     => json_encode($product->to_search_results()),
+					'data-selected'     => wp_json_encode($product->to_search_results()),
 				],
 			],
 			'update_price'  => [

inc/admin-pages/class-migration-alert-admin-page.php

@@ -163,7 +163,7 @@ class Migration_Alert_Admin_Page extends Wizard_Admin_Page {
 		delete_network_option(null, 'wu_setup_finished');
 		delete_network_option(null, 'wu_is_migration_done');
 
-		wp_redirect(wu_network_admin_url('wp-ultimo-setup'));
+		wp_safe_redirect(wu_network_admin_url('wp-ultimo-setup'));
 
 		exit;
 	}

inc/admin-pages/class-payment-edit-admin-page.php

@@ -689,7 +689,7 @@ class Payment_Edit_Admin_Page extends Edit_Admin_Page {
 					'data-label-field'  => 'name',
 					'data-search-field' => 'name',
 					'data-max-items'    => 1,
-					'data-selected'     => $line_item->get_product() ? json_encode($line_item->get_product()->to_search_results()) : '',
+					'data-selected'     => $line_item->get_product() ? wp_json_encode($line_item->get_product()->to_search_results()) : '',
 				],
 			],
 			'title'              => [
@@ -1073,7 +1073,7 @@ class Payment_Edit_Admin_Page extends Edit_Admin_Page {
 							'data-value-field' => 'id',
 							'data-label-field' => 'reference_code',
 							'data-max-items'   => 1,
-							'data-selected'    => $this->get_object()->get_membership() ? json_encode($this->get_object()->get_membership()->to_search_results()) : '',
+							'data-selected'    => $this->get_object()->get_membership() ? wp_json_encode($this->get_object()->get_membership()->to_search_results()) : '',
 						],
 						'wrapper_html_attr' => [
 							'v-cloak' => '1',
@@ -1141,7 +1141,7 @@ class Payment_Edit_Admin_Page extends Edit_Admin_Page {
 						'value'             => $this->get_object()->get_saved_invoice_number(),
 						'wrapper_classes'   => 'wu-w-full',
 						'wrapper_html_attr' => [
-							'v-show'  => json_encode(wu_get_setting('invoice_numbering_scheme', 'reference_code') === 'sequential_number'),
+							'v-show'  => wp_json_encode(wu_get_setting('invoice_numbering_scheme', 'reference_code') === 'sequential_number'),
 							'v-cloak' => '1',
 						],
 					],
@@ -1280,7 +1280,7 @@ class Payment_Edit_Admin_Page extends Edit_Admin_Page {
 			$item = $query->get_item_by('id', $_GET['id']);
 
 			if ( ! $item || $item->get_parent_id()) {
-				wp_redirect(wu_network_admin_url('wp-ultimo-payments'));
+				wp_safe_redirect(wu_network_admin_url('wp-ultimo-payments'));
 
 				exit;
 			}

inc/admin-pages/class-product-edit-admin-page.php

@@ -162,7 +162,7 @@ class Product_Edit_Admin_Page extends Edit_Admin_Page {
 					'data-label-field'  => 'name',
 					'data-search-field' => 'name',
 					'data-max-items'    => 1,
-					'data-exclude'      => json_encode([$product->get_id()]),
+					'data-exclude'      => wp_json_encode([$product->get_id()]),
 				],
 			],
 		];
@@ -270,7 +270,7 @@ class Product_Edit_Admin_Page extends Edit_Admin_Page {
 			[
 				'html_attr' => [
 					'data-wu-app' => 'product_pricing',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'is_recurring'  => $this->get_object()->is_recurring(),
 							'pricing_type'  => $this->get_object()->get_pricing_type(),
@@ -705,7 +705,7 @@ class Product_Edit_Admin_Page extends Edit_Admin_Page {
 						'data-label-field'  => 'name',
 						'data-search-field' => 'name',
 						'data-max-items'    => 99,
-						'data-selected'     => json_encode(
+						'data-selected'     => wp_json_encode(
 							wu_get_products(
 								[
 									'id__in'     => $this->get_object()->get_available_addons(),
@@ -750,7 +750,7 @@ class Product_Edit_Admin_Page extends Edit_Admin_Page {
 					'fields'            => [
 						'price_variations_remove'        => [
 							'type'            => 'note',
-							'desc'            => sprintf('<a title="%s" class="wu-no-underline wu-inline-block wu-text-gray-600 wu-mt-2 wu-mr-2" href="#" @click.prevent="() => price_variations.splice(index, 1)"><span class="dashicons-wu-squared-cross"></span></a>', __('Remove', 'wp-multisite-waas')),
+							'desc'            => sprintf('<a title="%s" class="wu-no-underline wu-inline-block wu-text-gray-600 wu-mt-2 wu-mr-2" href="#" @click.prevent="() => price_variations.splice(index, 1)"><span class="dashicons-wu-squared-cross"></span></a>', esc_html__('Remove', 'wp-multisite-waas')),
 							'wrapper_classes' => 'wu-absolute wu-top-0 wu-right-0',
 						],
 						'price_variations_duration'      => [
@@ -1036,7 +1036,7 @@ class Product_Edit_Admin_Page extends Edit_Admin_Page {
 			$item = $query->get_item_by('id', $_GET['id']);
 
 			if ( ! $item) {
-				wp_redirect(wu_network_admin_url('wp-ultimo-products'));
+				wp_safe_redirect(wu_network_admin_url('wp-ultimo-products'));
 
 				exit;
 			}

inc/admin-pages/class-settings-admin-page.php

@@ -197,15 +197,15 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<div class="wu-p-4">
 
 				<span class="wu-text-gray-700 wu-font-bold wu-uppercase wu-tracking-wide wu-text-xs">
-					<?php _e('Checkout Forms', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Checkout Forms', 'wp-multisite-waas'); ?>
 				</span>
 
 				<div class="wu-py-2">
-					<img class="wu-w-full" alt="<?php esc_attr_e('Checkout Forms', 'wp-multisite-waas'); ?>" src="<?php echo wu_get_asset('sidebar/checkout-forms.webp'); ?>">
+					<img class="wu-w-full" alt="<?php esc_attr_e('Checkout Forms', 'wp-multisite-waas'); ?>" src="<?php echo esc_attr(wu_get_asset('sidebar/checkout-forms.webp')); ?>">
 				</div>
 
 				<p class="wu-text-gray-600 wu-p-0 wu-m-0">
-					<?php _e('You can create multiple Checkout Forms for different occasions (seasonal campaigns, launches, etc)!', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('You can create multiple Checkout Forms for different occasions (seasonal campaigns, launches, etc)!', 'wp-multisite-waas'); ?>
 				</p>
 
 			</div>
@@ -213,8 +213,8 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<?php if (current_user_can('wu_edit_checkout_forms')) : ?>
 
 				<div class="wu-p-4 wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-t wu-border-gray-300">
-					<a class="button wu-w-full wu-text-center" href="<?php echo wu_network_admin_url('wp-ultimo-checkout-forms'); ?>">
+					<a class="button wu-w-full wu-text-center" href="<?php echo esc_attr(wu_network_admin_url('wp-ultimo-checkout-forms')); ?>">
-						<?php _e('Manage Checkout Forms &rarr;', 'wp-multisite-waas'); ?>
+						<?php esc_html_e('Manage Checkout Forms &rarr;', 'wp-multisite-waas'); ?>
 					</a>
 				</div>
 
@@ -240,15 +240,15 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<div class="wu-p-4">
 
 				<span class="wu-text-gray-700 wu-font-bold wu-uppercase wu-tracking-wide wu-text-xs">
-					<?php _e('Customize the Template Previewer', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Customize the Template Previewer', 'wp-multisite-waas'); ?>
 				</span>
 
 				<div class="wu-py-2">
-					<img class="wu-w-full" alt="<?php esc_attr_e('Customize the Template Previewer', 'wp-multisite-waas'); ?>" src="<?php echo wu_get_asset('sidebar/site-template.webp'); ?>">
+					<img class="wu-w-full" alt="<?php esc_attr_e('Customize the Template Previewer', 'wp-multisite-waas'); ?>" src="<?php echo esc_attr(wu_get_asset('sidebar/site-template.webp')); ?>">
 				</div>
 
 				<p class="wu-text-gray-600 wu-p-0 wu-m-0">
-					<?php _e('Did you know that you can customize colors, logos, and more options of the Site Template Previewer top-bar?', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Did you know that you can customize colors, logos, and more options of the Site Template Previewer top-bar?', 'wp-multisite-waas'); ?>
 				</p>
 
 			</div>
@@ -256,8 +256,8 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<?php if (current_user_can('wu_edit_sites')) : ?>
 
 				<div class="wu-p-4 wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-t wu-border-gray-300">
-					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo wu_network_admin_url('wp-ultimo-customize-template-previewer'); ?>">
+					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo esc_attr(wu_network_admin_url('wp-ultimo-customize-template-previewer')); ?>">
-						<?php _e('Go to Customizer &rarr;', 'wp-multisite-waas'); ?>
+						<?php esc_html_e('Go to Customizer &rarr;', 'wp-multisite-waas'); ?>
 					</a>
 				</div>
 
@@ -283,15 +283,15 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<div class="wu-p-4">
 
 				<span class="wu-text-gray-700 wu-font-bold wu-uppercase wu-tracking-wide wu-text-xs">
-					<?php _e('Customize the Template Placeholders', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Customize the Template Placeholders', 'wp-multisite-waas'); ?>
 				</span>
 
 				<div class="wu-py-2">
-					<img class="wu-w-full" alt="<?php esc_attr_e('Customize the Template Placeholders', 'wp-multisite-waas'); ?>" src="<?php echo wu_get_asset('sidebar/template-placeholders.webp'); ?>">
+					<img class="wu-w-full" alt="<?php esc_attr_e('Customize the Template Placeholders', 'wp-multisite-waas'); ?>" src="<?php echo esc_attr(wu_get_asset('sidebar/template-placeholders.webp')); ?>">
 				</div>
 
 				<p class="wu-text-gray-600 wu-p-0 wu-m-0">
-					<?php _e('If you are using placeholder substitutions inside your site templates, use this tool to add, remove, or change the default content of those placeholders.', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('If you are using placeholder substitutions inside your site templates, use this tool to add, remove, or change the default content of those placeholders.', 'wp-multisite-waas'); ?>
 				</p>
 
 			</div>
@@ -299,8 +299,8 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<?php if (current_user_can('wu_edit_sites')) : ?>
 
 				<div class="wu-p-4 wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-t wu-border-gray-300">
-					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo wu_network_admin_url('wp-ultimo-template-placeholders'); ?>">
+					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo esc_attr(wu_network_admin_url('wp-ultimo-template-placeholders')); ?>">
-						<?php _e('Edit Placeholders &rarr;', 'wp-multisite-waas'); ?>
+						<?php esc_html_e('Edit Placeholders &rarr;', 'wp-multisite-waas'); ?>
 					</a>
 				</div>
 
@@ -326,15 +326,15 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<div class="wu-p-4">
 
 				<span class="wu-text-gray-700 wu-font-bold wu-uppercase wu-tracking-wide wu-text-xs">
-					<?php _e('Customize the Invoice Template', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Customize the Invoice Template', 'wp-multisite-waas'); ?>
 				</span>
 
 				<div class="wu-py-2">
-					<img class="wu-w-full" alt="<?php esc_attr_e('Customize the Invoice Template', 'wp-multisite-waas'); ?>" src="<?php echo wu_get_asset('sidebar/invoice-template.webp'); ?>">
+					<img class="wu-w-full" alt="<?php esc_attr_e('Customize the Invoice Template', 'wp-multisite-waas'); ?>" src="<?php echo esc_attr(wu_get_asset('sidebar/invoice-template.webp')); ?>">
 				</div>
 
 				<p class="wu-text-gray-600 wu-p-0 wu-m-0">
-					<?php _e('Did you know that you can customize colors, logos, and more options of the Invoice PDF template?', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Did you know that you can customize colors, logos, and more options of the Invoice PDF template?', 'wp-multisite-waas'); ?>
 				</p>
 
 			</div>
@@ -342,8 +342,8 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<?php if (current_user_can('wu_edit_payments')) : ?>
 
 				<div class="wu-p-4 wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-t wu-border-gray-300">
-					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo wu_network_admin_url('wp-ultimo-customize-invoice-template'); ?>">
+					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo esc_attr(wu_network_admin_url('wp-ultimo-customize-invoice-template')); ?>">
-						<?php _e('Go to Customizer &rarr;', 'wp-multisite-waas'); ?>
+						<?php esc_html_e('Go to Customizer &rarr;', 'wp-multisite-waas'); ?>
 					</a>
 				</div>
 
@@ -369,15 +369,15 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<div class="wu-p-4">
 
 				<span class="wu-text-gray-700 wu-font-bold wu-uppercase wu-tracking-wide wu-text-xs">
-					<?php _e('Customize System Emails', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Customize System Emails', 'wp-multisite-waas'); ?>
 				</span>
 
 				<div class="wu-py-2">
-					<img class="wu-w-full" alt="<?php esc_attr_e('Customize System Emails', 'wp-multisite-waas'); ?>" src="<?php echo wu_get_asset('sidebar/system-emails.webp'); ?>">
+					<img class="wu-w-full" alt="<?php esc_attr_e('Customize System Emails', 'wp-multisite-waas'); ?>" src="<?php echo esc_attr(wu_get_asset('sidebar/system-emails.webp')); ?>">
 				</div>
 
 				<p class="wu-text-gray-600 wu-p-0 wu-m-0">
-					<?php _e('You can completely customize the contents of the emails sent out by WP Multisite WaaS when particular events occur, such as Account Creation, Payment Failures, etc.', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('You can completely customize the contents of the emails sent out by WP Multisite WaaS when particular events occur, such as Account Creation, Payment Failures, etc.', 'wp-multisite-waas'); ?>
 				</p>
 
 			</div>
@@ -385,8 +385,8 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<?php if (current_user_can('wu_edit_broadcasts')) : ?>
 
 				<div class="wu-p-4 wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-t wu-border-gray-300">
-					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo wu_network_admin_url('wp-ultimo-emails'); ?>">
+					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo esc_attr(wu_network_admin_url('wp-ultimo-emails')); ?>">
-						<?php _e('Customize System Emails &rarr;', 'wp-multisite-waas'); ?>
+						<?php esc_html_e('Customize System Emails &rarr;', 'wp-multisite-waas'); ?>
 					</a>
 				</div>
 
@@ -412,15 +412,15 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<div class="wu-p-4">
 
 				<span class="wu-text-gray-700 wu-font-bold wu-uppercase wu-tracking-wide wu-text-xs">
-					<?php _e('Customize Email Template', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('Customize Email Template', 'wp-multisite-waas'); ?>
 				</span>
 
 				<div class="wu-py-2">
-					<img class="wu-w-full" alt="<?php esc_attr_e('Customize Email Template', 'wp-multisite-waas'); ?>" src="<?php echo wu_get_asset('sidebar/email-template.webp'); ?>">
+					<img class="wu-w-full" alt="<?php esc_attr_e('Customize Email Template', 'wp-multisite-waas'); ?>" src="<?php echo esc_attr(wu_get_asset('sidebar/email-template.webp')); ?>">
 				</div>
 
 				<p class="wu-text-gray-600 wu-p-0 wu-m-0">
-					<?php _e('If your network is using the HTML email option, you can customize the look and feel of the email template.', 'wp-multisite-waas'); ?>
+					<?php esc_html_e('If your network is using the HTML email option, you can customize the look and feel of the email template.', 'wp-multisite-waas'); ?>
 				</p>
 
 			</div>
@@ -428,8 +428,8 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 			<?php if (current_user_can('wu_edit_broadcasts')) : ?>
 
 				<div class="wu-p-4 wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-t wu-border-gray-300">
-					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo wu_network_admin_url('wp-ultimo-customize-email-template'); ?>">
+					<a class="button wu-w-full wu-text-center" target="_blank" href="<?php echo esc_attr(wu_network_admin_url('wp-ultimo-customize-email-template')); ?>">
-						<?php _e('Customize Email Template &rarr;', 'wp-multisite-waas'); ?>
+						<?php esc_html_e('Customize Email Template &rarr;', 'wp-multisite-waas'); ?>
 					</a>
 				</div>
 
@@ -481,6 +481,7 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 		wp_enqueue_script('media');
 		wp_enqueue_script('wu-vue');
 		wp_enqueue_script('wu-selectizer');
+		wp_enqueue_script('wu-settings-loader', wu_get_asset('settings-loader.js', 'js'), ['wu-functions'], wu_get_version(), true);
 
 		do_action('wu_render_settings');
 
@@ -517,7 +518,7 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 	public function default_handler(): void {
 
 		if ( ! current_user_can('wu_edit_settings')) {
-			wp_die(__('You do not have the permissions required to change settings.', 'wp-multisite-waas'));
+			wp_die(esc_html__('You do not have the permissions required to change settings.', 'wp-multisite-waas'));
 		}
 
 		if ( ! isset($_POST['active_gateways']) && 'payment-gateways' === wu_request('tab')) {
@@ -526,7 +527,7 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 
 		WP_Ultimo()->settings->save_settings($_POST);
 
-		wp_redirect(add_query_arg('updated', 1, wu_get_current_url()));
+		wp_safe_redirect(add_query_arg('updated', 1, wu_get_current_url()));
 
 		exit;
 	}
@@ -577,7 +578,7 @@ class Settings_Admin_Page extends Wizard_Admin_Page {
 					'style'        => '',
 					'data-on-load' => 'remove_block_ui',
 					'data-wu-app'  => str_replace('-', '_', $section_slug),
-					'data-state'   => json_encode(wu_array_map_keys('wu_replace_dashes', Settings::get_instance()->get_all(true))),
+					'data-state'   => wp_json_encode(wu_array_map_keys('wu_replace_dashes', Settings::get_instance()->get_all(true))),
 				],
 			]
 		);

inc/admin-pages/class-setup-wizard-admin-page.php

@@ -219,7 +219,7 @@ class Setup_Wizard_Admin_Page extends Wizard_Admin_Page {
 	public function redirect_to_wizard(): void {
 
 		if ( ! \WP_Ultimo\Requirements::run_setup() && wu_request('page') !== 'wp-ultimo-setup') {
-			wp_redirect(wu_network_admin_url('wp-ultimo-setup'));
+			wp_safe_redirect(wu_network_admin_url('wp-ultimo-setup'));
 
 			exit;
 		}
@@ -713,12 +713,12 @@ class Setup_Wizard_Admin_Page extends Wizard_Admin_Page {
 	public function handle_checks(): void {
 
 		if (\WP_Ultimo\Requirements::met() === false) {
-			wp_redirect(add_query_arg());
+			wp_safe_redirect(add_query_arg());
 
 			exit;
 		}
 
-		wp_redirect($this->get_next_section_link());
+		wp_safe_redirect($this->get_next_section_link());
 
 		exit;
 	}
@@ -747,7 +747,7 @@ class Setup_Wizard_Admin_Page extends Wizard_Admin_Page {
 
 		\WP_Ultimo\Settings::get_instance()->save_settings($settings_to_save);
 
-		wp_redirect($this->get_next_section_link());
+		wp_safe_redirect($this->get_next_section_link());
 
 		exit;
 	}
@@ -772,7 +772,7 @@ class Setup_Wizard_Admin_Page extends Wizard_Admin_Page {
 			$url = add_query_arg('dry-run', 0);
 		}
 
-		wp_redirect($url);
+		wp_safe_redirect($url);
 
 		exit;
 	}
@@ -790,7 +790,7 @@ class Setup_Wizard_Admin_Page extends Wizard_Admin_Page {
 
 			$redirect_url = $this->get_next_section_link();
 
-			wp_redirect($redirect_url);
+			wp_safe_redirect($redirect_url);
 
 			exit;
 		}

inc/admin-pages/class-site-edit-admin-page.php

@@ -227,7 +227,7 @@ class Site_Edit_Admin_Page extends Edit_Admin_Page {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'transfer_site',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'confirmed' => false,
 						]
@@ -414,7 +414,7 @@ class Site_Edit_Admin_Page extends Edit_Admin_Page {
 			[
 				'html_attr' => [
 					'data-wu-app' => 'site_type',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'type'                   => $this->get_object()->get_type(),
 							'original_membership_id' => $this->get_object()->get_membership_id(),
@@ -487,7 +487,7 @@ class Site_Edit_Admin_Page extends Edit_Admin_Page {
 							'data-label-field'  => 'reference_code',
 							'data-search-field' => 'reference_code',
 							'data-max-items'    => 1,
-							'data-selected'     => json_encode($membership_selected),
+							'data-selected'     => wp_json_encode($membership_selected),
 						],
 					],
 					'transfer_note' => [
@@ -729,7 +729,7 @@ class Site_Edit_Admin_Page extends Edit_Admin_Page {
 		$item = wu_get_site($item_id);
 
 		if ( ! $item) {
-			wp_redirect(wu_network_admin_url('wp-ultimo-sites'));
+			wp_safe_redirect(wu_network_admin_url('wp-ultimo-sites'));
 
 			exit;
 		}

inc/admin-pages/class-site-list-admin-page.php

@@ -166,7 +166,7 @@ class Site_List_Admin_Page extends List_Admin_Page {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'true',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'confirmed' => false,
 						]
@@ -420,7 +420,7 @@ class Site_List_Admin_Page extends List_Admin_Page {
 				'value'             => $template_id,
 				'html_attr'         => [
 					'data-model'        => 'site',
-					'data-selected'     => $site ? json_encode($site->to_search_results()) : '',
+					'data-selected'     => $site ? wp_json_encode($site->to_search_results()) : '',
 					'data-value-field'  => 'blog_id',
 					'data-label-field'  => 'title',
 					'data-search-field' => 'title',

inc/admin-pages/class-template-previewer-customize-admin-page.php

@@ -233,7 +233,7 @@ class Template_Previewer_Customize_Admin_Page extends Customizer_Admin_Page {
 					'style'                    => 'margin-top: -6px;',
 					'data-wu-app'              => 'site_template_customizer',
 					'data-wu-customizer-panel' => true,
-					'data-state'               => json_encode($state),
+					'data-state'               => wp_json_encode($state),
 				],
 			]
 		);
@@ -308,7 +308,7 @@ class Template_Previewer_Customize_Admin_Page extends Customizer_Admin_Page {
 
 		$url = add_query_arg($array_params);
 
-		wp_redirect($url);
+		wp_safe_redirect($url);
 
 		exit;
 	}

inc/admin-pages/class-top-admin-nav-menu.php

@@ -163,32 +163,32 @@ class Top_Admin_Nav_Menu {
 
 		if (current_user_can('wu_read_sites')) {
 			$wp_admin_bar->add_node($sites);
-		} //end if;
+		} 
 
 		if (current_user_can('wu_read_memberships')) {
 			$wp_admin_bar->add_node($memberships);
-		} //end if;
+		} 
 
 		if (current_user_can('wu_read_customers')) {
 			$wp_admin_bar->add_node($customers);
-		} //end if;
+		} 
 
 		if (current_user_can('wu_read_products')) {
 			$wp_admin_bar->add_node($products);
-		} //end if;
+		} 
 
 		if (current_user_can('wu_read_payments')) {
 			$wp_admin_bar->add_node($payments);
-		} //end if;
+		} 
 
 		if (current_user_can('wu_read_discount_codes')) {
 			$wp_admin_bar->add_node($discount_codes);
-		} //end if;
+		} 
 
 		if (current_user_can('wu_read_settings')) {
 			$wp_admin_bar->add_node($container);
 			$wp_admin_bar->add_node($settings);
-		} //end if;
+		} 
 
 		/*
 		 * Add the sub-menus.

inc/admin-pages/class-view-logs-admin-page.php

@@ -358,7 +358,7 @@ class View_Logs_Admin_Page extends Edit_Admin_Page {
 
 		$url = remove_query_arg('log_file');
 
-		wp_redirect(add_query_arg('deleted', 1, $url));
+		wp_safe_redirect(add_query_arg('deleted', 1, $url));
 
 		exit;
 	}

inc/admin-pages/class-webhook-edit-admin-page.php

@@ -259,7 +259,7 @@ class Webhook_Edit_Admin_Page extends Edit_Admin_Page {
 
 		$event = wu_get_event_type($object_event_slug);
 
-		$payload = isset($event['payload']) ? json_encode(wu_maybe_lazy_load_payload($event['payload']), JSON_PRETTY_PRINT) : '{}';
+		$payload = isset($event['payload']) ? wp_json_encode(wu_maybe_lazy_load_payload($event['payload']), JSON_PRETTY_PRINT) : '{}';
 
 		wu_get_template(
 			'events/widget-payload',
@@ -357,7 +357,7 @@ class Webhook_Edit_Admin_Page extends Edit_Admin_Page {
 			$item = $query->get_item_by('id', wu_request('id'));
 
 			if ( ! $item) {
-				wp_redirect(wu_network_admin_url('wp-ultimo-webhooks'));
+				wp_safe_redirect(wu_network_admin_url('wp-ultimo-webhooks'));
 
 				exit;
 			}
@@ -407,7 +407,7 @@ class Webhook_Edit_Admin_Page extends Edit_Admin_Page {
 
 			$url = add_query_arg($array_params);
 
-			wp_redirect($url);
+			wp_safe_redirect($url);
 
 			exit;
 		}

inc/admin-pages/class-webhook-list-admin-page.php

@@ -157,7 +157,7 @@ class Webhook_List_Admin_Page extends List_Admin_Page {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'edit_line_item',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'event' => '',
 						]

inc/admin-pages/class-wizard-admin-page.php

@@ -299,7 +299,7 @@ abstract class Wizard_Admin_Page extends Base_Admin_Page {
 	 */
 	public function default_handler(): void {
 
-		wp_redirect($this->get_next_section_link());
+		wp_safe_redirect($this->get_next_section_link());
 
 		exit;
 	}

inc/api/class-register-endpoint.php

@@ -93,7 +93,7 @@ class Register_Endpoint {
 	 * @since 2.0.0
 	 *
 	 * @param \WP_REST_Request $request WP Request Object.
-	 * @return array
+	 * @return array|\WP_Error
 	 */
 	public function handle_endpoint($request) {
 
@@ -102,7 +102,7 @@ class Register_Endpoint {
 		$params = json_decode($request->get_body(), true);
 
 		if (\WP_Ultimo\API::get_instance()->should_log_api_calls()) {
-			wu_log_add('api-calls', json_encode($params, JSON_PRETTY_PRINT));
+			wu_log_add('api-calls', wp_json_encode($params, JSON_PRETTY_PRINT));
 		}
 
 		$validation_errors = $this->validate($params);

inc/checkout/class-cart.php

@@ -1830,7 +1830,7 @@ class Cart implements \JsonSerializable {
 		$where_clauses[] = ['type', $type];
 
 		// Cast to array recursively
-		$line_items = json_decode(json_encode($this->line_items), true);
+		$line_items = json_decode(wp_json_encode($this->line_items), true);
 
 		$line_items = Array_Search::find(
 			$line_items,
@@ -2353,7 +2353,7 @@ class Cart implements \JsonSerializable {
 	 */
 	public function jsonSerialize(): string {
 
-		return json_encode($this->done());
+		return wp_json_encode($this->done());
 	}
 
 	/**

inc/checkout/class-checkout-pages.php

@@ -108,8 +108,8 @@ class Checkout_Pages {
 
     <div class="misc-pub-section misc-pub-section-last" style="margin-top: 12px; margin-bottom: 6px; display: flex; align-items: center;">
 				<label for="wu-compat-mode">
-						<span style="display: block; font-weight: 600; margin-bottom: 3px;"><?php _e('WP Multisite WaaS Compatibility Mode', 'wp-multisite-waas'); ?></span>
+						<span style="display: block; font-weight: 600; margin-bottom: 3px;"><?php esc_html_e('WP Multisite WaaS Compatibility Mode', 'wp-multisite-waas'); ?></span>
-						<small style="display: block; line-height: 1.8em;"><?php _e('Toggle this option on if WP Multisite WaaS elements are not loading correctly or at all.', 'wp-multisite-waas'); ?></small>
+						<small style="display: block; line-height: 1.8em;"><?php esc_html_e('Toggle this option on if WP Multisite WaaS elements are not loading correctly or at all.', 'wp-multisite-waas'); ?></small>
 				</label>
 				<div style="margin-left: 6px;">
 					<input id="wu-compat-mode" type="checkbox" value="1" <?php checked($value, true, true); ?> name="_wu_force_elements_loading" />
@@ -243,7 +243,7 @@ class Checkout_Pages {
 				wp_login_url()
 			);
 
-			wp_redirect($url);
+			wp_safe_redirect($url);
 
 			exit;
 		}
@@ -263,7 +263,7 @@ class Checkout_Pages {
 	public function maybe_redirect_to_confirm_screen(): void {
 
 		if (wu_request('redirect_to')) {
-			wp_redirect(wu_request('redirect_to'));
+			wp_safe_redirect(wu_request('redirect_to'));
 
 			exit;
 		}
@@ -395,7 +395,7 @@ class Checkout_Pages {
 			return;
 		}
 
-		wp_redirect($redirect_to);
+		wp_safe_redirect($redirect_to);
 
 		exit;
 	}
@@ -472,7 +472,7 @@ class Checkout_Pages {
 
 			die;
 		} else {
-			wp_redirect($new_login_url);
+			wp_safe_redirect($new_login_url);
 
 			exit;
 		}
@@ -489,7 +489,7 @@ class Checkout_Pages {
 		$registration_url = $this->get_page_url('register');
 
 		if ($registration_url) {
-			wp_redirect($registration_url);
+			wp_safe_redirect($registration_url);
 
 			exit;
 		}

inc/checkout/class-checkout.php

@@ -1960,7 +1960,7 @@ class Checkout {
 				/*
 				 * Redirect go burrr!
 				 */
-				wp_redirect($redirect_url);
+				wp_safe_redirect($redirect_url);
 
 				exit;
 			}
@@ -2002,7 +2002,7 @@ class Checkout {
 				*/
 				$next_step = $this->get_next_step_name();
 
-				wp_redirect(add_query_arg('step', $next_step));
+				wp_safe_redirect(add_query_arg('step', $next_step));
 
 				exit;
 			}
@@ -2165,7 +2165,7 @@ class Checkout {
 				);
 			}
 
-			wp_redirect($redirect_url);
+			wp_safe_redirect($redirect_url);
 
 			exit;
 		} catch (\Throwable $e) {
@@ -2286,12 +2286,12 @@ class Checkout {
 	 * @since 2.0.0
 	 *
 	 * @param string $key Key to retrieve the value for.
-	 * @param mixed  $default The default value to return, when nothing is found.
+	 * @param mixed  $default_value The default value to return, when nothing is found.
 	 * @return mixed
 	 */
-	public function request_or_session($key, $default = false) {
+	public function request_or_session($key, $default_value = false) {
 
-		$value = $default;
+		$value = $default_value;
 
 		if (null !== $this->session) {
 			$session = $this->session->get('signup');

inc/checkout/class-legacy-checkout.php

@@ -1018,7 +1018,7 @@ class Legacy_Checkout {
 	public function next_step($args = []): void {
 
 		/** Redirect the user to the next step */
-		wp_redirect(esc_url_raw($this->get_next_step_link($args)));
+		wp_safe_redirect(esc_url_raw($this->get_next_step_link($args)));
 
 		/** Kill the execution after the redirect */
 		exit;

inc/checkout/class-line-item.php

@@ -1079,6 +1079,13 @@ class Line_Item implements \JsonSerializable {
 		$this->tax_label = $tax_label;
 	}
 
+	/**
+	 * @return string
+	 */
+	public function get_date_created(): string {
+		return $this->date_created;
+	}
+
 	/**
 	 * Returns the amount recurring in a human-friendly way.
 	 *

inc/checkout/signup-fields/class-base-signup-field.php

@@ -360,7 +360,7 @@ abstract class Base_Signup_Field {
 
 					$selected = array_filter($selected);
 
-					$field['html_attr']['data-selected'] = json_encode($selected);
+					$field['html_attr']['data-selected'] = wp_json_encode($selected);
 				}
 			}
 

inc/checkout/signup-fields/class-signup-field-payment.php

@@ -200,7 +200,7 @@ class Signup_Field_Payment extends Base_Signup_Field {
 				],
 				'wrapper_html_attr' => [
 					'v-cloak' => 1,
-					'v-show'  => sprintf('%s.includes(gateway) && order.should_collect_payment && order.has_recurring', json_encode($auto_renewable_gateways)),
+					'v-show'  => sprintf('%s.includes(gateway) && order.should_collect_payment && order.has_recurring', wp_json_encode($auto_renewable_gateways)),
 				],
 			];
 		}

inc/checkout/signup-fields/class-signup-field-products.php

@@ -216,7 +216,7 @@ class Signup_Field_Products extends Base_Signup_Field {
 		});";
 
 		if (did_action('wu-checkout')) {
-			wp_add_inline_script('wu-checkout', sprintf($script, json_encode($products)), 'before');
+			wp_add_inline_script('wu-checkout', sprintf($script, wp_json_encode($products)), 'before');
 
 			return;
 		}
@@ -225,7 +225,7 @@ class Signup_Field_Products extends Base_Signup_Field {
 			'wp_enqueue_scripts',
 			function () use ($script, $products) {
 
-				wp_add_inline_script('wu-checkout', sprintf($script, json_encode($products)), 'before');
+				wp_add_inline_script('wu-checkout', sprintf($script, wp_json_encode($products)), 'before');
 			},
 			11
 		);

inc/class-admin-notices.php

@@ -129,7 +129,7 @@ class Admin_Notices {
 	 */
 	public function enqueue_scripts(): void {
 
-		wp_enqueue_script('wu-admin-notices', wu_get_asset('admin-notices.js', 'js'), ['jquery'], wu_get_version());
+		wp_enqueue_script('wu-admin-notices', wu_get_asset('admin-notices.js', 'js'), ['jquery'], wu_get_version(), true);
 	}
 
 	/**

inc/class-ajax.php

@@ -100,7 +100,7 @@ class Ajax {
 		}
 
 		$args = wp_parse_args(
-			$_REQUEST,
+			$_REQUEST, // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			[
 				'model'   => 'membership',
 				'query'   => [],

inc/class-api.php

@@ -96,12 +96,12 @@ class API {
 			return $result;
 		}
 
-		$current_route = $_SERVER['REQUEST_URI'];
+		$current_route = sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'] ?? ''));
 
 		$rest_url  = rest_url();
-		$rest_path = rtrim(parse_url($rest_url, PHP_URL_PATH), '/');
+		$rest_path = rtrim(wp_parse_url($rest_url, PHP_URL_PATH), '/');
 
-		if (! str_starts_with((string) $current_route, $rest_path . '/' . $this->get_namespace())) {
+		if (! str_starts_with($current_route, $rest_path . '/' . $this->get_namespace())) {
 			return $result;
 		}
 
@@ -324,7 +324,7 @@ class API {
 	 */
 	public function validate_credentials($api_key, $api_secret) {
 
-		return compact('api_key', 'api_secret') === $this->get_auth(); // phpcs:ignore
+		return [$api_key, $api_secret] === $this->get_auth();
 	}
 
 	/**
@@ -355,7 +355,7 @@ class API {
 				'body_params' => $request->get_body(),
 			];
 
-			wu_log_add('api-calls', json_encode($payload, JSON_PRETTY_PRINT));
+			wu_log_add('api-calls', wp_json_encode($payload, JSON_PRETTY_PRINT));
 		}
 	}
 
@@ -383,7 +383,7 @@ class API {
 					'body_params' => $request->get_body(),
 				];
 
-				wu_log_add('api-errors', json_encode($payload, JSON_PRETTY_PRINT));
+				wu_log_add('api-errors', wp_json_encode($payload, JSON_PRETTY_PRINT));
 			}
 
 			wu_log_add('api-errors', $result);
@@ -401,9 +401,9 @@ class API {
 	 */
 	public function check_authorization($request) {
 
-		if (isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER']) {
+		if (! empty($_SERVER['PHP_AUTH_USER']) && ! empty($_SERVER['PHP_AUTH_PW'])) {
-			$api_key    = $_SERVER['PHP_AUTH_USER'];
+			$api_key    = sanitize_text_field(wp_unslash($_SERVER['PHP_AUTH_USER']));
-			$api_secret = $_SERVER['PHP_AUTH_PW'];
+			$api_secret = sanitize_text_field(wp_unslash($_SERVER['PHP_AUTH_PW']));
 		} else {
 			$params = $request->get_params();
 

inc/class-async-calls.php

@@ -38,13 +38,12 @@ class Async_Calls {
 	/**
 	 * Registers a new listener.
 	 *
+	 * @since 2.0.7
 	 * @param string   $id The id of the listener.
 	 * @param callable $callback A callback to be run.
 	 * @param mixed    ...$args Arguments to be passed to the callback.
 	 *
 	 * @return void
-	 *@since 2.0.7
-	 *
 	 */
 	public static function register_listener($id, $callback, ...$args): void {
 

inc/class-dashboard-widgets.php

@@ -281,7 +281,7 @@ class Dashboard_Widgets {
 	public function process_ajax_fetch_rss(): void {
 
 		$atts = wp_parse_args(
-			$_GET,
+			$_GET, // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			[
 				'url'          => 'https://community.wpultimo.com/topics/feed',
 				'title'        => __('Forum Discussions', 'wp-multisite-waas'),

inc/class-domain-mapping.php

@@ -75,7 +75,7 @@ class Domain_Mapping {
 		/*
 		 * Don't run during installation...
 		 */
-		if (defined('WP_INSTALLING') && '/wp-activate.php' !== $_SERVER['SCRIPT_NAME']) {
+		if (defined('WP_INSTALLING') && '/wp-activate.php' !== $_SERVER['SCRIPT_NAME']) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
 			return;
 		}
 
@@ -132,8 +132,6 @@ class Domain_Mapping {
 		 */
 		add_action('ms_loaded', [$this, 'register_mapped_filters'], 11);
 
-		// add_action('allowed_http_origin', array($this, 'add_mapped_domains_as_allowed_origins'));
-
 		/**
 		 * On WP Ultimo 1.X builds we used Mercator. The Mercator actions and filters are now deprecated.
 		 */
@@ -143,7 +141,7 @@ class Domain_Mapping {
 
 		add_action(
 			'wu_sso_site_allowed_domains',
-			function ($list, $site_id): array {
+			function ($domain_list, $site_id): array {
 
 				$domains = wu_get_domains(
 					[
@@ -154,7 +152,7 @@ class Domain_Mapping {
 					]
 				);
 
-				return array_merge($list, $domains);
+				return array_merge($domain_list, $domains);
 			},
 			10,
 			2
@@ -338,7 +336,7 @@ class Domain_Mapping {
 	/**
 	 * Clear mappings for a site when it's deleted
 	 *
-	 * @param WP_Site $site Site being deleted.
+	 * @param \WP_Site $site Site being deleted.
 	 */
 	public function clear_mappings_on_delete($site): void {
 
@@ -356,7 +354,7 @@ class Domain_Mapping {
 				// translators: First placeholder is the mapping ID, second is the site ID.
 				$message = sprintf(__('Unable to delete mapping %1$d for site %2$d', 'wp-multisite-waas'), $mapping->get_id(), $site->blog_id);
 
-				trigger_error($message, E_USER_WARNING);
+				trigger_error(esc_html($message), E_USER_WARNING); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_trigger_error
 			}
 		}
 	}
@@ -376,7 +374,7 @@ class Domain_Mapping {
 		}
 
 		$real_domain = $current_site->domain;
-		$domain      = $_SERVER['HTTP_HOST'];
+		$domain      = $_SERVER['HTTP_HOST']; // phpcs:ignore
 
 		if ($domain === $real_domain) {
 
@@ -474,7 +472,7 @@ class Domain_Mapping {
 		}
 
 		// Replace the domain
-		$domain_base = parse_url($url, PHP_URL_HOST);
+		$domain_base = wp_parse_url($url, PHP_URL_HOST);
 		$domain      = rtrim($domain_base . '/' . $current_mapping->get_site()->get_path(), '/');
 		$regex       = '#^(\w+://)' . preg_quote($domain, '#') . '#i';
 		$mangled     = preg_replace($regex, '${1}' . $current_mapping->get_domain(), $url);

inc/class-faker.php

@@ -351,7 +351,7 @@ class Faker {
 				);
 
 				if (is_wp_error($customer)) {
-					throw new \Exception($customer->get_error_message());
+					throw new \Exception(esc_html($customer->get_error_message()));
 				} else {
 					$this->set_fake_data_generated('customers', $customer);
 				}
@@ -411,7 +411,7 @@ class Faker {
 			$product = wu_create_product($product_data);
 
 			if (is_wp_error($product)) {
-				throw new \Exception($product->get_error_message());
+				throw new \Exception(esc_html($product->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('products', $product);
 			}
@@ -460,7 +460,7 @@ class Faker {
 			$membership = wu_create_membership($membership_data);
 
 			if (is_wp_error($membership)) {
-				throw new \Exception($membership->get_error_message());
+				throw new \Exception(esc_html($membership->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('memberships', $membership);
 			}
@@ -502,7 +502,7 @@ class Faker {
 			);
 
 			if (is_wp_error($domain)) {
-				throw new \Exception($domain->get_error_message());
+				throw new \Exception(esc_html($domain->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('domains', $domain);
 			}
@@ -550,7 +550,7 @@ class Faker {
 			$event_data = wu_create_event($event_data);
 
 			if (is_wp_error($event_data)) {
-				throw new \Exception($event_data->get_error_message());
+				throw new \Exception(esc_html($event_data->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('events', $event_data);
 			}
@@ -599,7 +599,7 @@ class Faker {
 			);
 
 			if (is_wp_error($discount_code)) {
-				throw new \Exception($discount_code->get_error_message());
+				throw new \Exception(esc_html($discount_code->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('discount_codes', $discount_code);
 			}
@@ -635,7 +635,7 @@ class Faker {
 			$checkout_form = wu_create_checkout_form($checkout_form_data);
 
 			if (is_wp_error($checkout_form)) {
-				throw new \Exception($checkout_form->get_error_message());
+				throw new \Exception(esc_html($checkout_form->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('checkout_forms', $checkout_form);
 			}
@@ -691,7 +691,7 @@ class Faker {
 			$email = wu_create_email($email_data);
 
 			if (is_wp_error($email)) {
-				throw new \Exception($email->get_error_message());
+				throw new \Exception(esc_html($email->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('emails', $email);
 			}
@@ -734,7 +734,7 @@ class Faker {
 			$broadcast = wu_create_broadcast($broadcast_data);
 
 			if (is_wp_error($broadcast)) {
-				throw new \Exception($broadcast->get_error_message());
+				throw new \Exception(esc_html($broadcast->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('broadcasts', $broadcast);
 			}
@@ -777,7 +777,7 @@ class Faker {
 			$webhook = wu_create_webhook($webhook_data);
 
 			if (is_wp_error($webhook)) {
-				throw new \Exception($webhook->get_error_message());
+				throw new \Exception(esc_html($webhook->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('webhooks', $webhook);
 			}
@@ -839,7 +839,7 @@ class Faker {
 			$payment = wu_create_payment($payment_data);
 
 			if (is_wp_error($payment)) {
-				throw new \Exception($payment->get_error_message());
+				throw new \Exception(esc_html($payment->get_error_message()));
 			} else {
 				$payment->recalculate_totals()->save();
 
@@ -892,7 +892,7 @@ class Faker {
 			$site = wu_create_site($site_data);
 
 			if (is_wp_error($site)) {
-				throw new \Exception($site->get_error_message());
+				throw new \Exception(esc_html($site->get_error_message()));
 			} else {
 				$this->set_fake_data_generated('sites', $site);
 			}

inc/class-helper.php

@@ -102,14 +102,14 @@ class Helper {
 	 *
 	 * @since 1.9.6
 	 * @param string $option_name Option name.
-	 * @param mixed  $default The default value.
+	 * @param mixed  $default_value The default value.
 	 * @return mixed
 	 */
-	public function get_option($option_name = 'settings', $default = []) {
+	public function get_option($option_name = 'settings', $default_value = []) {
 
 		_deprecated_function(__METHOD__, '2.0.11', 'wu_get_option');
 
-		return wu_get_option($option_name, $default);
+		return wu_get_option($option_name, $default_value);
 	}
 
 	/**

inc/class-light-ajax.php

@@ -31,7 +31,7 @@ class Light_Ajax {
 	 */
 	public function __construct() {
 
-		if (isset($_REQUEST['wu-ajax'])) {
+		if (isset($_REQUEST['wu-ajax'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			$action = $this->get_when_to_run();
 
 			wu_x_header("X-Ultimo-Ajax-When: $action");
@@ -101,7 +101,7 @@ class Light_Ajax {
 			]
 		);
 
-		$action = isset($_REQUEST['wu-when']) ? base64_decode((string) $_REQUEST['wu-when']) : 'plugins_loaded';
+		$action = isset($_REQUEST['wu-when']) ? base64_decode((string) $_REQUEST['wu-when']) : 'plugins_loaded'; // phpcs:ignore WordPress
 
 		return in_array($action, $allowed_list, true) ? $action : 'plugins_loaded';
 	}
@@ -151,7 +151,7 @@ class Light_Ajax {
 
 		header('Pragma: no-cache');
 
-		$action = esc_attr(trim((string) $_REQUEST['action']));
+		$action = esc_attr(trim((string) $_REQUEST['action'])); // phpcs:ignore
 
 		if (is_user_logged_in()) {
 			do_action('wu_ajax_' . $action); // phpcs:ignore

inc/class-logger.php

@@ -65,7 +65,7 @@ class Logger extends AbstractLogger {
 			 *
 			 * Here we are converting the PHP error reporting level to the PSR-3 log level.
 			 */
-			$reporting_level = error_reporting();
+			$reporting_level = error_reporting(); // phpcs:ignore WordPress.PHP
 
 			$psr_log_levels = [
 				E_ERROR             => LogLevel::ERROR,
@@ -131,7 +131,7 @@ class Logger extends AbstractLogger {
 		}
 
 		// read file
-		$content = file_get_contents($file);
+		$content = file_get_contents($file); // phpcs:ignore WordPress.WP.AlternativeFunctions
 
 		// split into lines
 		$arr_content = explode(PHP_EOL, $content);
@@ -280,13 +280,13 @@ class Logger extends AbstractLogger {
 	protected function write_to_file($message) {
 
 		if ( ! file_exists($this->log_file)) {
-			touch($this->log_file);
+			touch($this->log_file); // phpcs:ignore WordPress.WP.AlternativeFunctions
 		}
 
-		if ( ! is_writable($this->log_file)) {
+		if ( ! is_writable($this->log_file)) { // phpcs:ignore WordPress.WP.AlternativeFunctions
 			return;
 		}
 
-		file_put_contents($this->log_file, $message, FILE_APPEND | LOCK_EX);
+		file_put_contents($this->log_file, $message, FILE_APPEND | LOCK_EX); // phpcs:ignore WordPress.WP.AlternativeFunctions
 	}
 }

inc/class-maintenance-mode.php

@@ -71,7 +71,7 @@ class Maintenance_Mode {
 	 * Add maintenance mode Notice to Admin Bar
 	 *
 	 * @since 2.0.0
-	 * @param WP_Admin_Bar $wp_admin_bar The Admin Bar class.
+	 * @param \WP_Admin_Bar $wp_admin_bar The Admin Bar class.
 	 * @return void
 	 */
 	public function add_notice_to_admin_bar($wp_admin_bar): void {
@@ -118,7 +118,7 @@ class Maintenance_Mode {
 			__('Under Maintenance', 'wp-multisite-waas')
 		);
 
-		wp_die($text, $title, 503);
+		wp_die(esc_html($text), esc_html($title), 503);
 	}
 
 	/**
@@ -140,11 +140,18 @@ class Maintenance_Mode {
 	 */
 	public function toggle_maintenance_mode() {
 
-		check_ajax_referer('wu_toggle_maintenance_mode', $_POST['_wpnonce']);
+		if ( ! check_ajax_referer('wu_toggle_maintenance_mode', '_wpnonce', false)) {
+			wp_send_json_error(
+				[
+					'message' => __('Request failed, please refresh and try again.', 'wp-multisite-waas'),
+					'value'   => false,
+				]
+			);
+		}
 
 		$site_id = \WP_Ultimo\Helpers\Hash::decode(wu_request('site_hash'), 'site');
 
-		if ( ! current_user_can_for_blog($site_id, 'manage_options')) {
+		if ( ! current_user_can_for_site($site_id, 'manage_options')) {
 			wp_send_json_error(
 				[
 					'message' => __('You do not have the necessary permissions to perform this option.', 'wp-multisite-waas'),

inc/class-newsletter.php

@@ -39,7 +39,7 @@ class Newsletter {
 	 */
 	public function maybe_update_newsletter_subscription($settings, $settings_to_save, $saved_settings) {
 
-		if ( isset($settings_to_save[ self::SETTING_FIELD_SLUG ]) && $settings_to_save[ self::SETTING_FIELD_SLUG ] && $settings_to_save[ self::SETTING_FIELD_SLUG ] != $saved_settings[ self::SETTING_FIELD_SLUG ] ) {
+		if ( isset($settings_to_save[ self::SETTING_FIELD_SLUG ]) && $settings_to_save[ self::SETTING_FIELD_SLUG ] && $settings_to_save[ self::SETTING_FIELD_SLUG ] !== $saved_settings[ self::SETTING_FIELD_SLUG ] ) {
 			$response = wp_remote_post(
 				'https://wpmultisitewaas.org/wp-json/newsletter/v2/subscribers',
 				[
@@ -55,7 +55,7 @@ class Newsletter {
 					'headers' => [
 						'Accept'        => 'application/json',
 						'Content-Type'  => 'application/json',
-						'Authorization' => 'Basic ' . base64_encode('30220d7fb4ec49a7410b3a309b9346c18410bd56:0407cd731d6f074cd0b96f2643b7619e89af1ed2'),
+						'Authorization' => 'Basic ' . base64_encode('30220d7fb4ec49a7410b3a309b9346c18410bd56:0407cd731d6f074cd0b96f2643b7619e89af1ed2'), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
 					],
 				]
 			);
@@ -73,7 +73,7 @@ class Newsletter {
 					'headers' => [
 						'Accept'        => 'application/json',
 						'Content-Type'  => 'application/json',
-						'Authorization' => 'Basic ' . base64_encode('30220d7fb4ec49a7410b3a309b9346c18410bd56:0407cd731d6f074cd0b96f2643b7619e89af1ed2'),
+						'Authorization' => 'Basic ' . base64_encode('30220d7fb4ec49a7410b3a309b9346c18410bd56:0407cd731d6f074cd0b96f2643b7619e89af1ed2'), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
 					],
 				]
 			);

inc/class-requirements.php

@@ -280,10 +280,19 @@ class Requirements {
 	 */
 	public static function notice_unsupported_php_version(): void {
 
-		// translators: the %1$s placeholder is the required PHP version, while the %2$s is the current PHP version.
+		printf(
-		$message = sprintf(__('WP Multisite WaaS requires at least PHP version %1$s to run. Your current PHP version is <strong>%2$s</strong>. Please, contact your hosting company support to upgrade your PHP version. If you want maximum performance consider upgrading your PHP to version 7.0 or later.', 'wp-multisite-waas'), self::$php_version, phpversion());
+			'<div class="notice notice-error"><p>%s</p></div>',
-
+			sprintf(
-		printf('<div class="notice notice-error"><p>%s</p></div>', $message);
+				// translators: the %1$s placeholder is the required PHP version, while the %2$s is the current PHP version, and %3$s is the recommended PHP version.
+				esc_html__(
+					'WP Multisite WaaS requires at least PHP version %1$s to run. Your current PHP version is %2$s. Please, contact your hosting company support to upgrade your PHP version. If you want maximum performance consider upgrading your PHP to version %3$s or later.',
+					'wp-multisite-waas'
+				),
+				esc_html(self::$php_version),
+				'<strong>' . esc_html(phpversion()) . '</strong>',
+				esc_html(self::$php_recommended_version)
+			)
+		);
 	}
 
 	/**
@@ -296,10 +305,18 @@ class Requirements {
 
 		global $wp_version;
 
+		printf(
+			'<div class="notice notice-error"><p>%s</p></div>',
+			sprintf(
 				// translators: the %1$s placeholder is the required WP version, while the %2$s is the current WP version.
-		$message = sprintf(__('WP Multisite WaaS requires at least WordPress version %1$s to run. Your current WordPress version is <strong>%2$s</strong>.', 'wp-multisite-waas'), self::$wp_version, $wp_version);
+				esc_html__(
-
+					'WP Multisite WaaS requires at least WordPress version %1$s to run. Your current WordPress version is %2$s.',
-		printf('<div class="notice notice-error"><p>%s</p></div>', $message);
+					'wp-multisite-waas'
+				),
+				esc_html(self::$wp_version),
+				'<strong>' . esc_html($wp_version) . '</strong>'
+			)
+		);
 	}
 
 	/**
@@ -310,9 +327,7 @@ class Requirements {
 	 */
 	public static function notice_not_multisite(): void {
 
-		$message = __('WP Multisite WaaS requires a multisite install to run properly. To know more about WordPress Networks, visit this link: <a href="https://wordpress.org/support/article/create-a-network/">Create a Network &rarr;</a>', 'wp-multisite-waas');
+		printf('<div class="notice notice-error"><p>%s <a href="https://wordpress.org/support/article/create-a-network/">%s &rarr;</a></p></div>', esc_html__('WP Multisite WaaS requires a multisite install to run properly. To know more about WordPress Networks, visit this link:', 'wp-multisite-waas'), esc_html__('Create a Network', 'wp-multisite-waas'));
-
-		printf('<div class="notice notice-error"><p>%s</p></div>', $message);
 	}
 
 	/**
@@ -323,9 +338,13 @@ class Requirements {
 	 */
 	public static function notice_not_network_active(): void {
 
-		// translators: %s is a placeholder for the Network Admin plugins page URL.
+		printf(
-		$message = sprintf(__('WP Multisite WaaS needs to be network active to run properly. You can "Network Activate" it <a href="%s">here</a>', 'wp-multisite-waas'), network_admin_url('plugins.php'));
+			'<div class="notice notice-error"><p>%s</p></div>',
-
+			sprintf(
-		printf('<div class="notice notice-error"><p>%s</p></div>', $message);
+				// translators: %s is a placeholder for the Network Admin plugins page URL with link text.
+				esc_html__('WP Multisite WaaS needs to be network active to run properly. You can "Network Activate" it %s', 'wp-multisite-waas'),
+				'<a href="' . esc_attr(network_admin_url('plugins.php')) . '">' . esc_html__('here', 'wp-multisite-waas') . '</a>'
+			)
+		);
 	}
 }

inc/class-session-cookie.php

@@ -137,7 +137,7 @@ class Session_Cookie implements Session {
 			$expire = HOUR_IN_SECONDS;
 		}
 
-		$value = json_encode($this->data, JSON_UNESCAPED_UNICODE);
+		$value = wp_json_encode($this->data, JSON_UNESCAPED_UNICODE);
 
 		$cookie = new Cookie($this->get_cookie_name());
 		$cookie->setValue($value);

inc/class-settings.php

@@ -178,7 +178,7 @@ class Settings {
 		$settings = $this->get_all();
 
 		if (str_contains($setting, '-')) {
-			_doing_it_wrong($setting, __('Dashes are no longer supported when registering a setting. You should change it to underscores in later versions.', 'wp-multisite-waas'), '2.0.0');
+			_doing_it_wrong($setting, esc_html__('Dashes are no longer supported when registering a setting. You should change it to underscores in later versions.', 'wp-multisite-waas'), '2.0.0');
 		}
 
 		$setting_value = $settings[ $setting ] ?? $default_value;
@@ -388,6 +388,7 @@ class Settings {
 	 * @param string $section_slug Section to which this field will be added to.
 	 * @param string $field_slug ID of the field. This is used to later retrieve the value saved on this setting.
 	 * @param array  $atts Field attributes such as title, description, tooltip, default value, etc.
+	 * @param int    $priority Priority of the field. This is used to order the fields.
 	 * @return void
 	 */
 	public function add_field($section_slug, $field_slug, $atts, $priority = 10): void {
@@ -401,7 +402,7 @@ class Settings {
 				* We no longer support settings with hyphens.
 				*/
 				if (str_contains($field_slug, '-')) {
-					_doing_it_wrong($field_slug, __('Dashes are no longer supported when registering a setting. You should change it to underscores in later versions.', 'wp-multisite-waas'), '2.0.0');
+					_doing_it_wrong($field_slug, esc_html__('Dashes are no longer supported when registering a setting. You should change it to underscores in later versions.', 'wp-multisite-waas'), '2.0.0');
 				}
 
 				$default_order = (count($fields) + 1) * 10;
@@ -466,7 +467,7 @@ class Settings {
 								$new_attrs['data-selected'] = $data_selected->to_search_results();
 							}
 
-							$new_attrs['data-selected'] = json_encode($new_attrs['data-selected']);
+							$new_attrs['data-selected'] = wp_json_encode($new_attrs['data-selected']);
 
 							return array_merge($original_html_attr, $new_attrs);
 						};
@@ -479,7 +480,7 @@ class Settings {
 					foreach ($atts['require'] as $attr => $value) {
 						$attr = str_replace('-', '_', $attr);
 
-						$value = json_encode($value);
+						$value = wp_json_encode($value);
 
 						$require_rules[] = "require('{$attr}', {$value})";
 					}
@@ -496,6 +497,7 @@ class Settings {
 		);
 
 		$settings = $this->get_all();
+
 		/*
 		 * Makes sure we install the default value if it is not set yet.
 		 */
@@ -633,7 +635,6 @@ class Settings {
 			[
 				'title'   => __('Currency Position', 'wp-multisite-waas'),
 				'desc'    => __('This setting affects all prices displayed across the plugin elements.', 'wp-multisite-waas'),
-				'desc'    => '',
 				'type'    => 'select',
 				'default' => '%s %v',
 				'options' => [

inc/class-sunrise.php

@@ -26,14 +26,15 @@ class Sunrise {
 	 *
 	 * @var string
 	 */
-	static $version = '2.0.0.8';
+
+	public static $version = '2.0.0.8';
 
 	/**
 	 * Keeps the sunrise meta cached after the first read.
 	 *
 	 * @var null|array
 	 */
-	static $sunrise_meta;
+	public static $sunrise_meta;
 
 	/**
 	 * Initializes sunrise and loads additional elements if needed.
@@ -104,6 +105,7 @@ class Sunrise {
 	 */
 	public static function load_dependencies(): void {
 
+		// We can't use JetPack autoloader because WordPress is not fully loaded yet.
 		require_once __DIR__ . '/deprecated/early-deprecated.php';
 		require_once __DIR__ . '/deprecated/mercator.php';
 		require_once __DIR__ . '/functions/site.php';
@@ -115,6 +117,8 @@ class Sunrise {
 		require_once __DIR__ . '/objects/class-limitations.php';
 		require_once __DIR__ . '/models/traits/trait-limitable.php';
 		require_once __DIR__ . '/models/traits/trait-notable.php';
+		require_once __DIR__ . '/models/traits/trait-billable.php';
+		require_once __DIR__ . '/traits/trait-wp-ultimo-subscription-deprecated.php';
 		require_once __DIR__ . '/traits/trait-wp-ultimo-site-deprecated.php';
 		require_once __DIR__ . '/database/engine/class-enum.php';
 		require_once __DIR__ . '/database/sites/class-site-type.php';
@@ -132,6 +136,8 @@ class Sunrise {
 		require_once __DIR__ . '/class-settings.php';
 		require_once __DIR__ . '/limits/class-plugin-limits.php';
 		require_once __DIR__ . '/limits/class-theme-limits.php';
+		require_once __DIR__ . '/limits/class-theme-limits.php';
+		require_once __DIR__ . '/models/class-membership.php';
 	}
 
 	/**
@@ -206,7 +212,7 @@ class Sunrise {
 					 */
 					add_filter('option_active_plugins', fn() => []);
 
-					add_filter('site_option_active_sitewide_plugins', fn($plugins) => [basename(dirname(__DIR__)) . '/wp-ultimo.php' => 1]);
+					add_filter('site_option_active_sitewide_plugins', fn() => [basename(dirname(__DIR__)) . '/wp-ultimo.php' => 1], 10, 0);
 				}
 			}
 		}
@@ -255,7 +261,7 @@ class Sunrise {
 	 */
 	public static function try_upgrade() {
 
-		$copy_results = @copy(
+		$copy_results = copy(
 			dirname(WP_ULTIMO_PLUGIN_FILE) . '/sunrise.php',
 			WP_CONTENT_DIR . '/sunrise.php'
 		); // phpcs:ignore

inc/class-views.php

@@ -42,10 +42,11 @@ class Views {
 	 * @since 1.9.0
 	 * @param string|array $template_names Template file(s) to search for, in order.
 	 * @param bool         $load           If true the template file will be loaded if it is found.
-	 * @param bool         $require_once   Whether to require_once or require. Default true. Has no effect if $load is false.
+	 * @param bool         $use_require_once   Whether to require_once or require. Default true. Has no effect if $load is false.
+	 *
 	 * @return string The template filename if one is located.
 	 */
-	public function custom_locate_template($template_names, $load = false, $require_once = true) {
+	public function custom_locate_template($template_names, $load = false, $use_require_once = true) {
 
 		is_multisite() && switch_to_blog(get_current_site()->blog_id);
 
@@ -76,7 +77,7 @@ class Views {
 		}
 
 		if ($load && '' !== $located) {
-			load_template($located, $require_once);
+			load_template($located, $use_require_once);
 		}
 
 		return $located;

inc/class-whitelabel.php

@@ -84,7 +84,6 @@ class Whitelabel {
 			add_action('wp_user_dashboard_setup', [$this, 'remove_dashboard_widgets'], 11);
 
 			add_action('wp_dashboard_setup', [$this, 'remove_dashboard_widgets'], 11);
-
 		}
 
 		if (wu_get_setting('hide_sites_menu', true)) {
@@ -338,16 +337,11 @@ class Whitelabel {
 
 		global $menu;
 
-		$index = '';
-
 		foreach ($menu as $i => $menu_item) {
 			if ('sites.php' === $menu_item[2]) {
-				$index = $i;
+				unset($menu[ $i ]);
-
+				break;
-				continue;
 			}
 		}
-
-		unset($menu[ $index ]);
 	}
 }

inc/debug/class-debug.php

@@ -72,37 +72,37 @@ class Debug {
 			<a  
 				href="<?php wu_network_admin_url('wp-ultimo-debug-pages'); ?>" 
 				class="wu-ml-2 wu-no-underline wu-text-gray-600"
-				title="<?php _e('Pages', 'wp-multisite-waas'); ?>"
+				title="<?php esc_html_e('Pages', 'wp-multisite-waas'); ?>"
 			>
 				<span class="dashicons-wu-documents"></span>
-				<?php _e('Pages', 'wp-multisite-waas'); ?>
+				<?php esc_html_e('Pages', 'wp-multisite-waas'); ?>
 			</a>
 
 			<a  
 				href="<?php echo wu_get_form_url('add_debug_generator_form'); ?>" 
 				class="wubox wu-ml-2 wu-no-underline wu-relative wu-text-gray-600"
-				title="<?php _e('Generator', 'wp-multisite-waas'); ?>"
+				title="<?php esc_html_e('Generator', 'wp-multisite-waas'); ?>"
 			>
 				<span class="dashicons-wu-rocket"></span>
-				<?php _e('Generator', 'wp-multisite-waas'); ?>
+				<?php esc_html_e('Generator', 'wp-multisite-waas'); ?>
 			</a>
 
 			<a  
 				href="<?php echo wu_get_form_url('add_debug_reset_database_form'); ?>" 
 				class="wubox wu-ml-2 wu-no-underline wu-text-gray-600"
-				title="<?php _e('Reset Database', 'wp-multisite-waas'); ?>"
+				title="<?php esc_html_e('Reset Database', 'wp-multisite-waas'); ?>"
 			>
 				<span class="dashicons-wu-back-in-time"></span>
-				<?php _e('Reset Database', 'wp-multisite-waas'); ?>
+				<?php esc_html_e('Reset Database', 'wp-multisite-waas'); ?>
 			</a>
 
 			<a  
 				href="<?php echo wu_get_form_url('add_debug_drop_database_form'); ?>" 
 				class="wubox wu-ml-2 wu-no-underline wu-text-gray-600"
-				title="<?php _e('Drop Database', 'wp-multisite-waas'); ?>"
+				title="<?php esc_html_e('Drop Database', 'wp-multisite-waas'); ?>"
 			>
 				<span class="dashicons-wu-database"></span>
-				<?php _e('Drop Database', 'wp-multisite-waas'); ?>
+				<?php esc_html_e('Drop Database', 'wp-multisite-waas'); ?>
 			</a>
 
 		<?php
@@ -298,7 +298,7 @@ class Debug {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'debug_generator',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'customers'      => false,
 							'products'       => false,
@@ -430,7 +430,7 @@ class Debug {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'debug_reset_database_form',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'reset_only' => true,
 						]
@@ -510,7 +510,7 @@ class Debug {
 				'field_wrapper_classes' => 'wu-w-full wu-box-border wu-items-center wu-flex wu-justify-between wu-p-4 wu-m-0 wu-border-t wu-border-l-0 wu-border-r-0 wu-border-b-0 wu-border-gray-300 wu-border-solid',
 				'html_attr'             => [
 					'data-wu-app' => 'debug_drop_database_form',
-					'data-state'  => json_encode(
+					'data-state'  => wp_json_encode(
 						[
 							'reset_only' => true,
 						]

inc/development/assets/development.css

@@ -9,7 +9,7 @@ body {
     width: 200px;
     content: " ";
     position: absolute;
-    top: 30;
+    top: 30px;
     background: url("../../../assets/img/logo.webp");
     background-size: contain;
     height: 40px;

inc/development/assets/development.scss

@@ -20,7 +20,7 @@ body {
 		width: 200px;
 		content: " ";
 		position: absolute;
-		top: 30;
+		top: 30px;
 		background: url("../../../assets/img/logo.webp");
 		background-size: contain;
 		height: 40px;

inc/development/class-toolkit.php

@@ -125,7 +125,7 @@ class Toolkit {
 
 		$args = $manager->get_arguments_schema('update' === $context);
 
-		file_put_contents(wu_path("/mpb/data/endpoint/.endpoint-$class_name-$context"), json_encode($args)); // phpcs:ignore
+		file_put_contents(wu_path("/mpb/data/endpoint/.endpoint-$class_name-$context"), wp_json_encode($args)); // phpcs:ignore
 	}
 
 	/**

inc/functions/compatiblity.php

@@ -0,0 +1,35 @@
+<?php
+/**
+ * Backport of WordPress 6.7.0 current_user_can_for_site() function.
+ *
+ * @package WP_Ultimo
+ */
+
+if ( ! function_exists('current_user_can_for_site')) {
+
+	/**
+	 * Returns whether the current user has the specified capability for a given site.
+	 *
+	 * This function also accepts an ID of an object to check against if the capability is a meta capability. Meta
+	 * capabilities such as `edit_post` and `edit_user` are capabilities used by the `map_meta_cap()` function to
+	 * map to primitive capabilities that a user or role has, such as `edit_posts` and `edit_others_posts`.
+	 *
+	 * This function replaces the current_user_can_for_blog() function.
+	 *
+	 * Example usage:
+	 *
+	 *     current_user_can_for_site( $site_id, 'edit_posts' );
+	 *     current_user_can_for_site( $site_id, 'edit_post', $post->ID );
+	 *     current_user_can_for_site( $site_id, 'edit_post_meta', $post->ID, $meta_key );
+	 *
+	 * @since 6.7.0
+	 *
+	 * @param int    $site_id    Site ID.
+	 * @param string $capability Capability name.
+	 * @param mixed  ...$args    Optional further parameters, typically starting with an object ID.
+	 * @return bool Whether the user has the given capability.
+	 */
+	function current_user_can_for_site($site_id, $capability, ...$args) { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound
+		return current_user_can_for_blog($site_id, $capability, ...$args);
+	}
+}

inc/functions/date.php

@@ -74,9 +74,9 @@ function wu_get_days_ago($date_1, $date_2 = false) {
 
 	$datetime_2 = wu_date($date_2);
 
-	$dateIntervar = $datetime_1->diff($datetime_2, false);
+	$date_intervar = $datetime_1->diff($datetime_2, false);
 
-	return - $dateIntervar->days;
+	return - $date_intervar->days;
 }
 
 /**
@@ -121,7 +121,6 @@ function wu_filter_duration_unit($unit, $length) {
 			$new_unit = $length > 1 ? __('Years', 'wp-multisite-waas') : __('Year', 'wp-multisite-waas');
 			break;
 		default:
-			$new_unit = $new_unit;
 			break;
 	}
 
@@ -181,10 +180,10 @@ function wu_convert_php_date_format_to_moment_js_format($php_date_format): strin
 		'g' => 'h',
 		'H' => 'HH',
 		'h' => 'hh',
-		'I' => '',       // Daylight Saving Time? => moment().isDST();
+		'I' => '',       // Daylight Saving Time?: moment().isDST().
 		'i' => 'mm',
 		'j' => 'D',
-		'L' => '',       // Leap year? => moment().isLeapYear();
+		'L' => '',       // Is Leap year?: moment().isLeapYear().
 		'l' => 'dddd',
 		'M' => 'MMM',
 		'm' => 'MM',

inc/functions/financial.php

@@ -358,7 +358,7 @@ function wu_calculate_taxes_by_day($start_date = false, $end_date = false, $incl
 
 	foreach ($line_items_groups as $line_items_group) {
 		foreach ($line_items_group as $line_item) {
-			$date = gmdate('Y-m-d', strtotime((string) $line_item->date_created));
+			$date = gmdate('Y-m-d', strtotime($line_item->get_date_created()));
 
 			if ( ! wu_get_isset($data, $date)) {
 				$data[ $date ] = [

inc/functions/legacy.php

@@ -149,7 +149,7 @@ function wu_print_signup_field($field_slug, $field, $results) {
 
     <script type="text/javascript">
 			document.addEventListener('DOMContentLoaded', function() {
-				var requires = <?php echo json_encode($field['requires']); ?>,
+				var requires = <?php echo wp_json_encode($field['requires']); ?>,
 						target_field = document.getElementById('<?php echo $field_slug; ?>-field');
 
         var display_field = function(target_field, requires, velocity) {

inc/functions/markup-helpers.php

@@ -21,7 +21,7 @@ function wu_convert_to_state($state_array = []) {
 
 	$object = (object) $state_array; // Force object to prevent issues with Vue.
 
-	return json_encode($object);
+	return wp_json_encode($object);
 }
 
 /**

inc/functions/options.php

@@ -12,16 +12,16 @@ defined('ABSPATH') || exit;
 /**
  * Get the value of a slugfied network option
  *
- * @since 1.9.6
  * @param string $option_name Option name.
- * @param mixed  $default The default value.
+ * @param mixed  $default_value The default value.
+ *
  * @return mixed
  */
-function wu_get_option($option_name = 'settings', $default = []) {
+function wu_get_option($option_name = 'settings', $default_value = []) {
 
-	$option_value = get_network_option(null, wu_slugify($option_name), $default);
+	$option_value = get_network_option(null, wu_slugify($option_name), $default_value);
 
-	return apply_filters('wu_get_option', $option_value, $option_name, $default);
+	return apply_filters('wu_get_option', $option_value, $option_name, $default_value);
 }
 
 /**

inc/functions/sort.php

@@ -45,15 +45,15 @@ function wu_sort_by_order($a, $b) {
  *
  * @since 2.0.7
  *
- * @param array  $list The list of sortable elements.
+ * @param array  $items The list of sortable elements.
  * @param string $order_key The order key.
  * @return array
  */
-function wu_set_order_from_index($list, $order_key = 'order') {
+function wu_set_order_from_index($items, $order_key = 'order') {
 
 	$index = 1;
 
-	foreach ($list as &$item) {
+	foreach ($items as &$item) {
 		if (isset($item[ $order_key ]) === false) {
 			$index = $index ?: 1; // phpcs:ignore
 
@@ -63,5 +63,5 @@ function wu_set_order_from_index($list, $order_key = 'order') {
 		}
 	}
 
-	return $list;
+	return $items;
 }

inc/functions/string-helpers.php

@@ -12,14 +12,14 @@ defined('ABSPATH') || exit;
 /**
  * Converts a string (e.g. 'yes' or 'no' or '1' or '0') to a bool.
  *
- * @since 2.0.0
+ * @param string $input_string The string to convert.
  *
- * @param string $string The string to convert.
  * @return bool
+ * @since 2.0.0
  */
-function wu_string_to_bool($string) {
+function wu_string_to_bool($input_string) {
 
-	return is_bool($string) ? $string : ('on' === strtolower($string) || 'yes' === strtolower($string) || 1 === $string || 'true' === strtolower($string) || '1' === $string);
+	return is_bool($input_string) ? $input_string : ('on' === strtolower($input_string) || 'yes' === strtolower($input_string) || 1 === $input_string || 'true' === strtolower($input_string) || '1' === $input_string);
 }
 
 /**
@@ -59,13 +59,13 @@ function wu_replace_dashes($str) {
  *
  * @since 2.0.0
  *
- * @param string  $string String to process.
+ * @param string  $str String to process.
  * @param integer $max_size Number of initials to return.
  * @return string
  */
-function wu_get_initials($string, $max_size = 2) {
+function wu_get_initials($str, $max_size = 2) {
 
-	$words = explode(' ', $string);
+	$words = explode(' ', $str);
 
 	$initials = '';
 

inc/functions/sunrise.php

@@ -30,20 +30,20 @@ function wu_should_load_sunrise() {
  * @since 2.0.0
  *
  * @param string $setting Setting to get.
- * @param mixed  $default Default value.
+ * @param mixed  $default_value Default value.
  * @return mixed
  */
-function wu_get_setting_early($setting, $default = false) {
+function wu_get_setting_early($setting, $default_value = false) {
 
 	if (did_action('wp_ultimo_load')) {
-		_doing_it_wrong('wu_get_setting_early', __('Regular setting APIs are already available. You should use wu_get_setting() instead.', 'wp-multisite-waas'), '2.0.0');
+		_doing_it_wrong('wu_get_setting_early', esc_html__('Regular setting APIs are already available. You should use wu_get_setting() instead.', 'wp-multisite-waas'), '2.0.0');
 	}
 
 	$settings_key = \WP_Ultimo\Settings::KEY;
 
 	$settings = get_network_option(null, 'wp-ultimo_' . $settings_key);
 
-	return wu_get_isset($settings, $setting, $default);
+	return wu_get_isset($settings, $setting, $default_value);
 }
 
 /**
@@ -59,7 +59,7 @@ function wu_get_setting_early($setting, $default = false) {
 function wu_save_setting_early($key, $value) {
 
 	if (did_action('wp_ultimo_load')) {
-		_doing_it_wrong('wu_save_setting_early', __('Regular setting APIs are already available. You should use wu_save_setting() instead.', 'wp-multisite-waas'), '2.0.20');
+		_doing_it_wrong('wu_save_setting_early', esc_html__('Regular setting APIs are already available. You should use wu_save_setting() instead.', 'wp-multisite-waas'), '2.0.20');
 	}
 
 	$settings_key = \WP_Ultimo\Settings::KEY;

inc/functions/url.php

@@ -21,10 +21,10 @@ function wu_get_current_url() {
 	 * the initiator URL.
 	 */
 	if (wp_doing_ajax() && isset($_SERVER['HTTP_REFERER'])) {
-		return $_SERVER['HTTP_REFERER'];
+		return wp_unslash($_SERVER['HTTP_REFERER']);
 	}
 
-	return (is_ssl() ? 'https://' : 'http://') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+	return (is_ssl() ? 'https://' : 'http://') . strtolower(wp_unslash($_SERVER['HTTP_HOST'])) . $_SERVER['REQUEST_URI'];
 }
 
 /**
@@ -86,7 +86,7 @@ function wu_ajax_url($when = null, $query_args = [], $site_id = false, $scheme =
 	$query_args['r']       = wp_create_nonce('wu-ajax-nonce');
 
 	if ($when) {
-		$query_args['wu-when'] = base64_encode($when);
+		$query_args['wu-when'] = base64_encode($when); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
 	}
 
 	$url = add_query_arg($query_args, $base_url);

inc/gateways/class-base-stripe-gateway.php

@@ -2446,7 +2446,7 @@ class Base_Stripe_Gateway extends Base_Gateway {
 
 			<fieldset id="wu-card-name-wrapper" class="wu_card_fieldset">
 				<p id="wu_card_name_wrap">
-					<label for="wu-update-card-name"><?php _e('Name on Card', 'wp-multisite-waas'); ?></label>
+					<label for="wu-update-card-name"><?php esc_html_e('Name on Card', 'wp-multisite-waas'); ?></label>
 					<input type="text" size="20" id="wu-update-card-name" name="wu_card_name" class="wu_card_name card-name" />
 				</p>
 			</fieldset>

inc/gateways/class-manual-gateway.php

@@ -385,7 +385,7 @@ class Manual_Gateway extends Base_Gateway {
 
 					<h4 class="wu-m-0 <?php echo wu_env_picker('', 'wu-widget-title'); ?>">
 
-						<?php _e('Instructions for Payment', 'wp-multisite-waas'); ?>
+						<?php esc_html_e('Instructions for Payment', 'wp-multisite-waas'); ?>
 
 					</h4>
 

inc/helpers/class-screenshot.php

@@ -91,7 +91,7 @@ class Screenshot {
 		$upload = wp_upload_bits('screenshot-' . gmdate('Y-m-d-H-i-s') . '.png', null, $response['body']);
 
 		if ( ! empty($upload['error'])) {
-			wu_log_add('screenshot-generator', $log_prefix . json_encode($upload['error']), LogLevel::ERROR);
+			wu_log_add('screenshot-generator', $log_prefix . wp_json_encode($upload['error']), LogLevel::ERROR);
 
 			return false;
 		}

inc/helpers/validation-rules/class-unique.php

@@ -46,6 +46,9 @@ class Unique extends Rule {
 	 */
 	public function check($value): bool {
 
+		if (empty($value)) {
+			return true;
+		}
 		$this->requireParameters(
 			[
 				'model',

inc/integrations/host-providers/class-base-host-provider.php

@@ -92,7 +92,8 @@ abstract class Base_Host_Provider {
 			/*
 			 * Adds an admin notice telling the admin that they should probably enable this integration.
 			 */
-			return $this->alert_provider_detected();
+			$this->alert_provider_detected();
+			return;
 		}
 
 		/*
@@ -106,7 +107,8 @@ abstract class Base_Host_Provider {
 				/*
 				 * Adds an admin notice telling the admin that the provider is not correctly setup.
 				 */
-				return $this->alert_provider_not_setup();
+				$this->alert_provider_not_setup();
+				return;
 			}
 
 			/*
@@ -301,7 +303,7 @@ abstract class Base_Host_Provider {
 	 * Get Fields for the integration.
 	 *
 	 * @since 2.0.0
-	 * @return string
+	 * @return array
 	 */
 	public function get_fields() {
 

inc/integrations/host-providers/class-cloudways-host-provider.php

@@ -11,10 +11,6 @@ namespace WP_Ultimo\Integrations\Host_Providers;
 
 use Psr\Log\LogLevel;
 use WP_Ultimo\Domain_Mapping\Helper;
-use WP_Ultimo\Integrations\Host_Providers\Base_Host_Provider;
-
-// Exit if accessed directly
-defined('ABSPATH') || exit;
 
 /**
  * This base class should be extended to implement new host integrations for SSL and domains.
@@ -120,7 +116,7 @@ class Cloudways_Host_Provider extends Base_Host_Provider {
 		if (is_wp_error($ssl_response)) {
 			wu_log_add('integration-cloudways', '[SSL]' . $ssl_response->get_error_message(), LogLevel::ERROR);
 		} else {
-			wu_log_add('integration-cloudways', '[SSL]' . print_r($ssl_response, true));
+			wu_log_add('integration-cloudways', '[SSL]' . print_r($ssl_response, true)); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
 		}
 	}
 
@@ -246,7 +242,7 @@ class Cloudways_Host_Provider extends Base_Host_Provider {
 		if (is_wp_error($alias_response)) {
 			wu_log_add('integration-cloudways', '[Alias]' . $alias_response->get_error_message(), LogLevel::ERROR);
 		} else {
-			wu_log_add('integration-cloudways', '[Alias]' . print_r($alias_response, true));
+			wu_log_add('integration-cloudways', '[Alias]' . print_r($alias_response, true)); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
 		}
 	}
 

inc/integrations/host-providers/class-runcloud-host-provider.php

@@ -10,7 +10,6 @@
 namespace WP_Ultimo\Integrations\Host_Providers;
 
 use Psr\Log\LogLevel;
-use WP_Ultimo\Integrations\Host_Providers\Base_Host_Provider;
 
 // Exit if accessed directly
 defined('ABSPATH') || exit;
@@ -260,7 +259,7 @@ class Runcloud_Host_Provider extends Base_Host_Provider {
 				'body'        => $data,
 				'method'      => $method,
 				'headers'     => [
-					'Authorization' => 'Basic ' . base64_encode($username . ':' . $password),
+					'Authorization' => 'Basic ' . base64_encode($username . ':' . $password), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
 				],
 			]
 		);
@@ -325,7 +324,7 @@ class Runcloud_Host_Provider extends Base_Host_Provider {
 		} else {
 			$data = $this->maybe_return_runcloud_body($response);
 
-			wu_log_add('integration-runcloud', json_encode($data));
+			wu_log_add('integration-runcloud', wp_json_encode($data));
 
 			if (property_exists($data, 'id')) {
 				$ssl_id = $data->id;

inc/integrations/host-providers/class-serverpilot-host-provider.php

@@ -10,10 +10,6 @@
 namespace WP_Ultimo\Integrations\Host_Providers;
 
 use Psr\Log\LogLevel;
-use WP_Ultimo\Integrations\Host_Providers\Base_Host_Provider;
-
-// Exit if accessed directly
-defined('ABSPATH') || exit;
 
 /**
  * This base class should be extended to implement new host integrations for SSL and domains.
@@ -219,9 +215,9 @@ class ServerPilot_Host_Provider extends Base_Host_Provider {
 			'timeout'  => 45,
 			'blocking' => true,
 			'method'   => $method,
-			'body'     => $data ? json_encode($data) : [],
+			'body'     => $data ? wp_json_encode($data) : [],
 			'headers'  => [
-				'Authorization' => 'Basic ' . base64_encode(WU_SERVER_PILOT_CLIENT_ID . ':' . WU_SERVER_PILOT_API_KEY),
+				'Authorization' => 'Basic ' . base64_encode(WU_SERVER_PILOT_CLIENT_ID . ':' . WU_SERVER_PILOT_API_KEY), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
 				'Content-Type'  => 'application/json',
 			],
 		];
@@ -243,7 +239,7 @@ class ServerPilot_Host_Provider extends Base_Host_Provider {
 	 * Makes sure ServerPilot autoSSL is always on, when possible.
 	 *
 	 * @since 1.7.4
-	 * @return bool
+	 * @return object
 	 */
 	public function turn_server_pilot_auto_ssl_on() {
 
@@ -273,8 +269,8 @@ class ServerPilot_Host_Provider extends Base_Host_Provider {
 		 * Log response so we can see what went wrong
 		 */
 
-		// translators: %s is the json_encode of the error.
+		// translators: %s is the wp_json_encode of the error.
-		wu_log_add('integration-serverpilot', sprintf(__('An error occurred while trying to get the current list of domains: %s', 'wp-multisite-waas'), json_encode($app_info)), LogLevel::ERROR);
+		wu_log_add('integration-serverpilot', sprintf(__('An error occurred while trying to get the current list of domains: %s', 'wp-multisite-waas'), wp_json_encode($app_info)), LogLevel::ERROR);
 
 		return false;
 	}

inc/integrations/host-providers/cpanel-api/class-cpanel-api.php

@@ -128,11 +128,10 @@ class CPanel_API {
 	 *
 	 * @since 1.6.2
 	 * @param string $message Message to be logged.
-	 * @return boolean
 	 */
 	public function log($message) {
 
-		return wu_log_add('integration-cpanel', $message);
+		wu_log_add('integration-cpanel', $message);
 	}
 
 	/**
@@ -152,7 +151,7 @@ class CPanel_API {
 		if ( ! file_exists($this->cookie_file)) {
 			try {
 				fopen($this->cookie_file, 'w');
-			} catch (Exception $ex) {
+			} catch (\Exception $ex) {
 				if ( ! file_exists($this->cookie_file)) {
 					$this->log($ex . __('Cookie file missing.', 'wp-multisite-waas'));
 
@@ -232,12 +231,11 @@ class CPanel_API {
 	 * Signs in on the cPanel.
 	 *
 	 * @since 1.6.2
-	 * @return boolean
 	 */
 	private function sign_in() {
 
 		$url  = $this->get_base_url() . '/login/?login_only=1';
-		$url .= '&user=' . $this->username . '&pass=' . urlencode($this->password);
+		$url .= '&user=' . $this->username . '&pass=' . rawurlencode($this->password);
 
 		$reply = $this->request($url);
 
@@ -249,7 +247,7 @@ class CPanel_API {
 			$this->homepage = $this->get_base_url() . $reply['redirect'];
 			$this->ex_page  = $this->get_base_url() . "/{$this->cpsess}/execute/";
 		} else {
-			return $this->log(__('Cannot connect to your cPanel server : Invalid Credentials', 'wp-multisite-waas'));
+			$this->log(__('Cannot connect to your cPanel server : Invalid Credentials', 'wp-multisite-waas'));
 		}
 	}
 
@@ -257,22 +255,22 @@ class CPanel_API {
 	 * Executes API calls, taking the request to the right API version
 	 *
 	 * @since 1.6.2
-	 * @throws Exception Throwns exception when the api is invalid.
+	 * @throws \Exception Throwns exception when the api is invalid.
 	 * @param string $api API version.
 	 * @param string $module Module name, to build the endpoint.
-	 * @param string $function Endpoint function to call.
+	 * @param string $function_name Endpoint function to call.
 	 * @param array  $parameters Parameters to the API endpoint.
 	 * @return boolean
 	 */
-	public function execute($api, $module, $function, array $parameters = []) {
+	public function execute($api, $module, $function_name, array $parameters = []) {
 
 		switch ($api) {
 			case 'api2':
-				return $this->api2($module, $function, $parameters);
+				return $this->api2($module, $function_name, $parameters);
 			case 'uapi':
-				return $this->uapi($module, $function, $parameters);
+				return $this->uapi($module, $function_name, $parameters);
 			default:
-				throw new Exception('Invalid API type : api2 and uapi are accepted', 1);
+				throw new \Exception('Invalid API type : api2 and uapi are accepted', 1);
 		}
 	}
 
@@ -281,11 +279,11 @@ class CPanel_API {
 	 *
 	 * @since 1.6.2
 	 * @param string $module Module name, to build the endpoint.
-	 * @param string $function Endpoint function to call.
+	 * @param string $function_name Endpoint function to call.
 	 * @param array  $parameters Parameters to the API endpoint.
 	 * @return mixed
 	 */
-	public function uapi($module, $function, array $parameters = []) {
+	public function uapi($module, $function_name, array $parameters = []) {
 
 		if (count($parameters) < 1) {
 			$parameters = '';
@@ -293,7 +291,7 @@ class CPanel_API {
 			$parameters = (http_build_query($parameters));
 		}
 
-		return json_decode((string) $this->request($this->ex_page . $module . '/' . $function . '?' . $parameters));
+		return json_decode((string) $this->request($this->ex_page . $module . '/' . $function_name . '?' . $parameters));
 	}
 
 	/**
@@ -301,11 +299,11 @@ class CPanel_API {
 	 *
 	 * @since 1.6.2
 	 * @param string $module Module name, to build the endpoint.
-	 * @param string $function Endpoint function to call.
+	 * @param string $function_name Endpoint function to call.
 	 * @param array  $parameters Parameters to the API endpoint.
 	 * @return mixed
 	 */
-	public function api2($module, $function, array $parameters = []) {
+	public function api2($module, $function_name, array $parameters = []) {
 
 		if (count($parameters) < 1) {
 			$parameters = '';
@@ -315,7 +313,7 @@ class CPanel_API {
 
 		$url = $this->get_base_url() . $this->cpsess . '/json-api/cpanel' .
 		       '?cpanel_jsonapi_version=2' .
-		"&cpanel_jsonapi_func={$function}" .
+		       "&cpanel_jsonapi_func={$function_name}" .
 		       "&cpanel_jsonapi_module={$module}&" . $parameters;
 
 		return json_decode((string) $this->request($url, $parameters));

inc/limitations/class-limit.php

@@ -266,7 +266,7 @@ abstract class Limit implements \JsonSerializable {
 	#[\ReturnTypeWillChange]
 	public function jsonSerialize() {
 
-		return json_encode($this->to_array());
+		return wp_json_encode($this->to_array());
 	}
 
 	/**

inc/limits/class-post-type-limits.php

@@ -135,7 +135,7 @@ class Post_Type_Limits {
 			$upgrade_message = __('Your plan does not support this post type.', 'wp-multisite-waas');
 
 			// translators: %s is the URL.
-			wp_die($upgrade_message, __('Limit Reached', 'wp-multisite-waas'), ['back_link' => true]);
+			wp_die(esc_html($upgrade_message), esc_html(__('Limit Reached', 'wp-multisite-waas')), ['back_link' => true]);
 		}
 
 		// Check if that is more than our limit
@@ -143,7 +143,7 @@ class Post_Type_Limits {
 			$upgrade_message = __('You reached your plan\'s post limit.', 'wp-multisite-waas');
 
 			// translators: %s is the URL
-			wp_die($upgrade_message, __('Limit Reached', 'wp-multisite-waas'), ['back_link' => true]);
+			wp_die(esc_html($upgrade_message), esc_html__('Limit Reached', 'wp-multisite-waas'), ['back_link' => true]);
 		}
 	}
 

inc/list-tables/class-base-list-table.php

@@ -171,7 +171,7 @@ class Base_List_Table extends \WP_List_Table {
 		if ('grid' === $this->current_mode) {
 			printf(
 				'<button id="cb-select-all-grid" v-on:click.prevent="select_all" class="button">%s</button>',
-				__('Select All', 'wp-multisite-waas')
+				esc_html__('Select All', 'wp-multisite-waas')
 			);
 		}
 	}
@@ -192,13 +192,8 @@ class Base_List_Table extends \WP_List_Table {
 
 		$list_table_name = $this->id;
 
-		if ( ! empty($_REQUEST['mode'])) {
+		if ( ! empty($_REQUEST['mode']) && in_array($_REQUEST['mode'], array_keys($this->modes), true)) {
 			$mode = $_REQUEST['mode'];
-
-			if (in_array($mode, array_keys($this->modes), true)) {
-				$mode = $_REQUEST['mode'];
-			}
-
 			set_user_setting("{$list_table_name}_list_mode", $mode);
 		} else {
 			$mode = get_user_setting("{$list_table_name}_list_mode", current(array_keys($this->modes)));
@@ -502,7 +497,7 @@ class Base_List_Table extends \WP_List_Table {
 		 * Any items at all?
 		 */
 		if ( ! $this->has_items() && 'page' === $this->context) {
-			echo wu_render_empty_state(
+			echo wu_render_empty_state( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 				[
 					'message'      => sprintf(__("You don't have any %s yet.", 'wp-multisite-waas'), $this->labels['plural']),
 					'sub_message'  => $this->_args['add_new'] ? __('How about we create a new one?', 'wp-multisite-waas') : __('...but you will see them here once they get created.', 'wp-multisite-waas'),
@@ -531,7 +526,6 @@ class Base_List_Table extends \WP_List_Table {
 
 		$views = apply_filters("wu_{$this->id}_get_views", $this->get_views());
 
-		if (true) {
 		$args = array_merge(
 			$filters,
 			[
@@ -546,7 +540,6 @@ class Base_List_Table extends \WP_List_Table {
 
 		wu_get_template('base/filter', $args);
 	}
-	}
 
 	/**
 	 * Overrides the single row method to create different methods depending on the mode.
@@ -596,7 +589,7 @@ class Base_List_Table extends \WP_List_Table {
 			'<div class="wu-py-6 wu-text-gray-600 wu-text-sm wu-text-center">
 			<span class="">%s</span>
 		</div>',
-			__('No items found', 'wp-multisite-waas')
+			esc_html__('No items found', 'wp-multisite-waas')
 		);
 	}
 
@@ -1095,7 +1088,7 @@ class Base_List_Table extends \WP_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Product $item Product object.
+	 * @param \WP_Ultimo\Models\Product $item Product object.
 	 */
 	public function column_featured_image_id($item): string {
 
@@ -1122,7 +1115,7 @@ class Base_List_Table extends \WP_List_Table {
 	/**
 	 * Render the bulk edit checkbox.
 	 *
-	 * @param WP_Ultimo\Models\Product $item Product object.
+	 * @param \WP_Ultimo\Models\Product $item Product object.
 	 *
 	 * @return string
 	 */
@@ -1158,7 +1151,7 @@ class Base_List_Table extends \WP_List_Table {
 		<script type='text/javascript'>
 			document.addEventListener('DOMContentLoaded', function() {
 
-				let table_id = '<?php echo $this->_get_js_var_name(); ?>';
+				let table_id = '<?php echo esc_js($this->_get_js_var_name()); ?>';
 
 				/**
 				 * Create the ajax List Table
@@ -1166,8 +1159,8 @@ class Base_List_Table extends \WP_List_Table {
 				if (typeof window[table_id] === 'undefined') {
 
 					window[table_id + '_config'] = {
-						filters: <?php echo json_encode($this->get_filters()); ?>,
+						filters: <?php echo wp_json_encode($this->get_filters()); ?>,
-						context: <?php echo json_encode($this->context); ?>,
+						context: <?php echo wp_json_encode($this->context); ?>,
 					}
 
 					window[table_id] = wu_create_list(table_id).init();
@@ -1409,6 +1402,7 @@ class Base_List_Table extends \WP_List_Table {
 			'all' => [
 				'field' => 'type',
 				'url'   => '#',
+				// translators: %s will be replaced with a plural label
 				'label' => sprintf(__('All %s', 'wp-multisite-waas'), $this->get_label('plural')),
 				'count' => 0,
 			],

inc/list-tables/class-checkout-form-list-table.php

@@ -154,6 +154,7 @@ class Checkout_Form_List_Table extends Base_List_Table {
 
 			$new_checkout_form = $checkout_form->duplicate();
 
+			// translators: 1st placeholder is the original form name.
 			$new_name = sprintf(__('Copy of %s', 'wp-multisite-waas'), $checkout_form->get_name());
 
 			$new_checkout_form->set_name($new_name);
@@ -178,7 +179,7 @@ class Checkout_Form_List_Table extends Base_List_Table {
 				]
 			);
 
-			wp_redirect($redirect_url);
+			wp_safe_redirect($redirect_url);
 
 			exit;
 		}

inc/list-tables/class-customer-list-table.php

@@ -66,7 +66,7 @@ class Customer_List_Table extends Base_List_Table {
 
 		$_filter_fields = parent::get_extra_query_fields();
 
-		$search = isset($_GET['s']) ? sanitize_text_field($_GET['s']) : false;
+		$search = isset($_GET['s']) ? sanitize_text_field(wp_unslash($_GET['s'])) : false;
 
 		if ( ! empty($search)) {
 

inc/list-tables/class-customers-payment-list-table.php

@@ -44,7 +44,7 @@ class Customers_Payment_List_Table extends Payment_List_Table {
 	 */
 	public function column_responsive($item): void {
 
-		echo wu_responsive_table_row(
+		echo wu_responsive_table_row( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 			[
 				'id'     => $item->get_id(),
 				'title'  => $item->get_hash(),

inc/list-tables/class-email-list-table.php

@@ -276,7 +276,7 @@ class Email_List_Table extends Base_List_Table {
 				]
 			);
 
-			wp_redirect($redirect_url);
+			wp_safe_redirect($redirect_url);
 
 			exit;
 		}

inc/list-tables/class-membership-line-item-list-table.php

@@ -42,7 +42,7 @@ class Membership_Line_Item_List_Table extends Product_List_Table {
 	 * @param integer $per_page Items per page. This gets overridden as well.
 	 * @param integer $page_number The page number.
 	 * @param boolean $count Return as count or not.
-	 * @return array
+	 * @return array|int
 	 */
 	public function get_items($per_page = 5, $page_number = 1, $count = false) {
 
@@ -74,7 +74,7 @@ class Membership_Line_Item_List_Table extends Product_List_Table {
 		$item = $item['product'];
 
 		if ( ! $item) {
-			echo wu_responsive_table_row(
+			echo wu_responsive_table_row( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 				[
 					'url'    => false,
 					'id'     => 'not-found',
@@ -86,6 +86,7 @@ class Membership_Line_Item_List_Table extends Product_List_Table {
 					'quantity' => [
 						'icon'  => 'dashicons-wu-package wu-align-middle wu-mr-1',
 						'label' => __('Quantity', 'wp-multisite-waas'),
+						// translators: %d is a quantity number
 						'value' => sprintf(__('x%d', 'wp-multisite-waas'), $quantity),
 					],
 				]
@@ -98,6 +99,7 @@ class Membership_Line_Item_List_Table extends Product_List_Table {
 			'quantity' => [
 				'icon'  => 'dashicons-wu-package wu-align-middle wu-mr-1',
 				'label' => __('Quantity', 'wp-multisite-waas'),
+				// translators: %d = quantity
 				'value' => sprintf(__('x%d', 'wp-multisite-waas'), $quantity),
 			],
 			'total'    => [
@@ -145,7 +147,7 @@ class Membership_Line_Item_List_Table extends Product_List_Table {
 			];
 		}
 
-		echo wu_responsive_table_row(
+		echo wu_responsive_table_row( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 			[
 				'id'     => $item->get_id(),
 				'title'  => $item->get_name(),

inc/list-tables/class-membership-list-table-widget.php

@@ -105,9 +105,6 @@ class Membership_List_Table_Widget extends Base_List_Table {
 	public function get_extra_query_fields() {
 
 		$_filter_fields                = parent::get_extra_query_fields();
-
-		$search = isset($_GET['s']) ? sanitize_text_field($_GET['s']) : false;
-
 		$_filter_fields['customer_id'] = wu_request('customer_id');
 
 		return $_filter_fields;
@@ -143,7 +140,7 @@ class Membership_List_Table_Widget extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Membership $item Membership object.
+	 * @param \WP_Ultimo\Models\Membership $item Membership object.
 	 * @return string
 	 */
 	public function column_status($item) {
@@ -160,7 +157,7 @@ class Membership_List_Table_Widget extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Membership $item Membership object.
+	 * @param \WP_Ultimo\Models\Membership $item Membership object.
 	 * @return string
 	 */
 	public function column_amount($item) {

inc/list-tables/class-membership-list-table.php

@@ -56,9 +56,6 @@ class Membership_List_Table extends Base_List_Table {
 	public function get_extra_query_fields() {
 
 		$_filter_fields                = parent::get_extra_query_fields();
-
-		$search = isset($_GET['s']) ? sanitize_text_field($_GET['s']) : false;
-
 		$_filter_fields['customer_id'] = wu_request('customer_id');
 
 		return $_filter_fields;
@@ -177,7 +174,6 @@ class Membership_List_Table extends Base_List_Table {
 			'customer'        => __('Customer', 'wp-multisite-waas'),
 			'product'         => __('Product', 'wp-multisite-waas'),
 			'amount'          => __('Price', 'wp-multisite-waas'),
-			// 'sites'              => __('Sites', 'wp-multisite-waas'),
 			'date_created'    => __('Created at', 'wp-multisite-waas'),
 			'date_expiration' => __('Expiration', 'wp-multisite-waas'),
 			'id'              => __('ID', 'wp-multisite-waas'),

inc/list-tables/class-memberships-site-list-table.php

@@ -44,9 +44,9 @@ class Memberships_Site_List_Table extends Customers_Site_List_Table {
 	 */
 	public function column_responsive($item): void {
 
-		$redirect = current_user_can('wu_edit_sites') ? 'wp-ultimo-edit-site' : 'wp-ultimo-sites';
+		$redirect = current_user_can('edit_others_posts') ? 'wp-ultimo-edit-site' : 'wp-ultimo-sites';
 
-		echo wu_responsive_table_row(
+		echo wu_responsive_table_row( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 			[
 				'id'     => $item->get_id(),
 				'title'  => $item->get_title(),

inc/list-tables/class-payment-line-item-list-table.php

@@ -104,6 +104,7 @@ class Payment_Line_Item_List_Table extends Line_Item_List_Table {
 		$first_row['subtotal'] = [
 			'icon'  => 'dashicons-wu-info1 wu-align-middle wu-mr-1',
 			'label' => '',
+			/* translators: %s is a currency amount */
 			'value' => sprintf(__('Subtotal: %s', 'wp-multisite-waas'), wu_format_currency($item->get_subtotal())),
 		];
 
@@ -132,7 +133,7 @@ class Payment_Line_Item_List_Table extends Line_Item_List_Table {
 			'value' => $item->get_description(),
 		];
 
-		echo wu_responsive_table_row(
+		echo wu_responsive_table_row( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 			[
 				'id'     => '',
 				'title'  => $item->get_title(),

inc/list-tables/class-payment-list-table-widget.php

@@ -101,7 +101,7 @@ class Payment_List_Table_Widget extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Payment $item Payment object.
+	 * @param \WP_Ultimo\Models\Payment $item Payment object.
 	 */
 	public function column_hash($item): string {
 
@@ -126,7 +126,7 @@ class Payment_List_Table_Widget extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Payment $item Payment object.
+	 * @param \WP_Ultimo\Models\Payment $item Payment object.
 	 * @return string
 	 */
 	public function column_status($item) {
@@ -144,7 +144,7 @@ class Payment_List_Table_Widget extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Membership $item Membership object.
+	 * @param \WP_Ultimo\Models\Membership $item Membership object.
 	 * @return string
 	 */
 	public function column_customer($item) {
@@ -181,8 +181,6 @@ class Payment_List_Table_Widget extends Base_List_Table {
 
 		$id = $customer->get_id();
 
-		$email = $customer->get_email_address();
-
 		$customer_link = wu_network_admin_url('wp-ultimo-edit-customer', $url_atts);
 
 		$html = "<a href='{$customer_link}' class='wu-p-1 wu-flex wu-flex-grow wu-bg-gray-100 wu-rounded wu-items-center wu-border wu-border-solid wu-border-gray-300'>
@@ -200,7 +198,7 @@ class Payment_List_Table_Widget extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Payment $item Payment object.
+	 * @param \WP_Ultimo\Models\Payment $item Payment object.
 	 */
 	public function column_total($item): string {
 

inc/list-tables/class-payment-list-table.php

@@ -58,13 +58,8 @@ class Payment_List_Table extends Base_List_Table {
 	public function get_extra_query_fields() {
 
 		$_filter_fields                  = parent::get_extra_query_fields();
-
-		$search = isset($_GET['s']) ? sanitize_text_field($_GET['s']) : false;
-
 		$_filter_fields['membership_id'] = wu_request('membership_id', false);
-
 		$_filter_fields['customer_id']   = wu_request('customer_id', false);
-
 		$_filter_fields['parent_id__in'] = ['0', 0, '', null];
 
 		return $_filter_fields;
@@ -75,7 +70,7 @@ class Payment_List_Table extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Payment $item Payment object.
+	 * @param \WP_Ultimo\Models\Payment $item Payment object.
 	 * @return string
 	 */
 	public function column_hash($item) {
@@ -129,7 +124,7 @@ class Payment_List_Table extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Payment $item Payment object.
+	 * @param \WP_Ultimo\Models\Payment $item Payment object.
 	 * @return string
 	 */
 	public function column_product($item) {
@@ -158,7 +153,7 @@ class Payment_List_Table extends Base_List_Table {
 	 *
 	 * @since 2.0.0
 	 *
-	 * @param WP_Ultimo\Models\Payment $item Payment object.
+	 * @param \WP_Ultimo\Models\Payment $item Payment object.
 	 * @return string
 	 */
 	public function column_total($item) {