v2.4.0 Latest
June 23, 2026
New 1 Improve 3 Fix 12 Security 3 Dev 1 Compat 1
New
- Members can now control their own check-in location precision; turn on "Let members control their own location precision" (Check-ins - General) and each member gets a "Check-in Location Privacy" option in Settings, and can only make their check-ins more private than the site default.
Improve
- The "approximate location" blur is now visibly approximate (about 1 km) instead of landing on the same building, so members who opt in can see the privacy setting working.
- Refreshed the frontend with a design-token system that maps cleanly across BuddyX, BuddyX Pro, and Reign, with full dark-mode and RTL coverage.
- Capped the "Near By Me" exclude list and result set (100 each) and batch-primed the member-mashup user-meta cache, so large communities no longer build unbounded queries or run per-member meta lookups.
Fix
- Privacy levels ("City Only" / "City & State") now hide the exact location everywhere a check-in appears: the map pin, address line, map popup, hover tooltip, and the link people click, not just the visible text.
- Selecting a privacy level now coarsens the coordinates themselves (about 1 km for "City & State", about 11 km for "City Only"), so the exact spot can no longer be recovered from the map link or page source; the owner still sees their own exact location.
- "City & State" now shows the real region or state for non-US addresses instead of the postal code.
- The members directory and member mashup maps no longer expose exact coordinates in the page source, and directory popups and the "Get Directions" form no longer reveal another member's full street address when privacy is active.
- Proximity distances are rounded to whole units when privacy or blurring applies, so a precise distance can't be used to pinpoint a member.
- Privacy and coordinate obfuscation now apply at display time for both new and existing check-ins, so toggling these settings never rewrites or re-dates older posts.
- Every check-in location link now opens the map in a new tab consistently, and older plain-text check-ins show a proper clickable map link again.
- Group activity check-ins render as clickable map links with a correct OpenStreetMap URL, route through the same privacy gate as personal check-ins, and no longer break the activity stream on newer PHP versions.
- Activity check-in link text and tooltip now respect the admin's Member Location Privacy Level for both Google Maps and OpenStreetMap.
- The group Location map and the member privacy settings screen are now fully readable in dark mode, including visible map zoom controls, a clear location pin, and a legible save confirmation; light mode is unchanged.
- Map search and "use my location" lookups now return results in your configured site language more consistently, including reverse-geocode lookups.
- The admin Overview "Current Configuration" panel now correctly reflects whether the xProfile location field is configured.
Security
- Replaced bare unserialize() with maybe_unserialize() on activity check-in meta reads, closing a PHP Object Injection vector.
- Added a logged-in and capability gate on the trash-user-checkins AJAX handler so a leaked nonce alone cannot delete a member's location data.
- Allowlisted distance units in the group directory sanitizer so unexpected values can never reach proximity queries.
Dev
- Registered wp_set_script_translations() for every plugin-owned script handle so JavaScript strings translate on non-English sites.
Compat
- Nominatim reverse-geocode now sends the User-Agent and Accept-Language headers required by OpenStreetMap policy, preventing IP blocks and keeping geocoded text in the site language.