From 199fd069e292115b0e336c2493879af209f53de0 Mon Sep 17 00:00:00 2001
From: Mykyta Synelnikov <nsinelnikov.work@gmail.com>
Date: Wed, 4 Feb 2026 15:23:26 +0200
Subject: [PATCH 1/2] Update template for members.php to improve filter
 rendering

Replaced triple curly braces with double curly braces in Underscore.js templates to enhance security and consistency. Adjusted the version comment to reflect the update from 2.11.1 to 2.11.2.
---
 templates/members.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/templates/members.php b/templates/members.php
index 109ef27f..ffa4e0a3 100644
--- a/templates/members.php
+++ b/templates/members.php
@@ -6,7 +6,7 @@
  *
  * Page: "Members"
  *
- * @version 2.11.1
+ * @version 2.11.2
  *
  * @var array $args
  */
@@ -343,13 +343,13 @@ $postid = ! empty( $post->ID ) ? $post->ID : '';
 						<# _.each( data.filters, function( filter, key, list ) { #>
 							<div class="um-members-filter-tag">
 								<# if ( filter.type == 'slider' ) { #>
-									{{{filter.value_label}}}
+									{{filter.value_label}}
 								<# } else { #>
-									<strong>{{{filter.label}}}</strong>: {{{filter.value_label}}}
+									<strong>{{filter.label}}</strong>: {{filter.value_label}}
 								<# } #>
-								<div class="um-members-filter-remove um-tip-n" data-name="{{{filter.name}}}"
-									 data-value="{{{filter.value}}}" data-range="{{{filter.range}}}"
-									 data-type="{{{filter.type}}}" title="<?php esc_attr_e( 'Remove filter', 'ultimate-member' ) ?>">&times;</div>
+								<div class="um-members-filter-remove um-tip-n" data-name="{{filter.name}}"
+									 data-value="{{filter.value}}" data-range="{{filter.range}}"
+									 data-type="{{filter.type}}" title="<?php esc_attr_e( 'Remove filter', 'ultimate-member' ) ?>">&times;</div>
 							</div>
 						<# }); #>
 					<# } #>

From db337f2f1c2728d29b0c91be41e7d34f51623fbc Mon Sep 17 00:00:00 2001
From: Mykyta Synelnikov <nsinelnikov.work@gmail.com>
Date: Wed, 4 Feb 2026 15:23:46 +0200
Subject: [PATCH 2/2] Updated readme.txt

---
 readme.txt | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/readme.txt b/readme.txt
index 574efbad..3fb1af4f 100644
--- a/readme.txt
+++ b/readme.txt
@@ -169,9 +169,19 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI
 
 = 2.11.2 2026-02-09 =
 
+**Enhancements**
+
+* Added: Server side validation when Searching Form is submitted.
+
 **Bugfixes**
 
-* Fixed: Security issue CVE ID: CVE-2025-15064. Deprecated ability to use HTML inside the user description.
+* Fixed: Security issue CVE ID: CVE-2025-15064. Deprecated ability to use HTML inside the user description. It's still allowed to use only predefined 'user_description' tags in `wp_kses()`.
+* Fixed: Security issue CVE ID: CVE-2026-1404. Changed template items formatting to avoid using HTML symbols in the filter values.
+
+* Templates required update:
+
+* members.php
+* searchform.php
 
 = 2.11.1 2025-12-16 =