BuddyLists changelog

v1.3.0 Latest

September 29, 2026

New 6 Improve 20 Fix 32 Security 20 Dev 1 Compat 1

New

Add and remove members on the list's own page, with a search across the community and suggestions to pick from.
Message any member straight from a list row. This opens your usual messages screen with that person already filled in.
Owners can edit and delete a list from the list's own page, without going back to their profile.
Lists can have a cover image and an icon, and a list without them gets a generated cover and its initial.
Set a list's cover and icon on the list page itself, the way social networks do it.
New lists get a readable web address taken from the list name, so a shared link says what it is.

Improve

Creating a list now asks only for a name and takes you to the new list, where you add people and images.
Replaced the two-step create window and its separate members popup with one screen per job.
Rebuilt the settings screen with a sidebar, an overview of your current configuration, and every setting grouped by what it does.
The plugin now draws its own buttons and fields rather than borrowing the theme's, so it looks right on any theme in light or dark.
The number beside the lists tab stays visible wherever you are on a profile, and only counts lists you are allowed to open.
Removed the hover preview over member names. Everything it showed is already on the row, and the name now simply opens the profile.
Removed the "Show the lists tab" setting. Switching it off hid the tab but left every list page reachable, which helped nobody.
An empty lists tab now explains what lists are for and offers to make the first one.
The list owner is marked on their own row, which carries no Remove.
The private list description now explains who can actually see a private list.
A list page shows the list name in the browser tab instead of the site name.
Screen readers now announce every notification, list names on the delete confirmation, and the private-list padlock; the list name field reports its own error.
The sidebar widgets hide themselves away from a list page, show newest members first on very large lists, and list people as a real list.
Opening a list, its widgets and the Overview screen no longer load member details or count whole tables on every visit.
A private list now says so under its title, and the member list has numbered pages.
Visitors who are not logged in get a "Log in to follow this list" link instead of an empty bar.
The Activity settings tab held a single checkbox, so its options now sit under Visibility. Your saved choices move across on update and old links to the tab still work.
"Cancel Friendship" on a list's member rows is now a quiet outlined button that turns red only when you reach for it.
Dialogs announce themselves as dialogs, move focus in and hand it back, and close on Escape.
The member list can be operated entirely from the keyboard, and icon-only buttons say what they do.

Fix

Changing the web address for lists did nothing. The new address returned a missing page while the old one kept working.
A blank or already-taken web address could be saved, which could stop other pages on the site from loading.
Clicking a notification about being added to a list never marked it as read.
Choosing to suggest only certain roles or member types, with none ticked, suggested everyone on the site instead of no one.
The notice shown when you reach your limit of lists was invisible, and now says what the limit is.
The notice shown after changing a cover or icon could appear behind the site header, where nobody would see it.
Error messages from creating, editing, deleting and messaging were invisible.
The footer rode up the page on a list with no followers or members.
Member rows lined up differently from each other and broke into three stacked bars on a phone.
The plugin could switch itself off. A single admin request where BuddyPress had not finished loading deactivated it silently, taking every list address with it.
Turning on list activity in the directory hid everyone else's posts, including your own, instead of adding list members to the stream.
A list with more than 100 members showed activity from only the first 100 in its feed.
The followed lists tab loaded far more than it needed to, and only ever covered the first ten lists you follow.
A web address for a list that does not exist now says so and returns a proper not-found, rather than an empty page.
A notification about a list that had since been deleted led to a missing page.
Windows taller than the browser cut off their own Save button, leaving no way to finish.
The description field was treated as required even though it is optional, blocking list creation.
Right-to-left sites loaded no list styling at all, because the stylesheet was published under the wrong name.
Email about being added to or removed from a list could be switched on but was never sent.
Settings that were switched on could not be switched off again, and role lists could not be emptied.
Reign no longer prints a second page banner above the list's own banner.
The list options button could not be opened with a mouse, and its dots disappeared on some themes.
Your own colours under BuddyLists > Colors did nothing on BuddyX Pro and Reign.
Dialog titles were unreadable in dark mode on Reign, and text on the accent colour was too faint.
The confirmation after creating or editing a list vanished before it could be read, and the icon in notices sat too high.
The footer still floated up under the private-list message and the missing-list page.
Opening the share dialog also opened the create-list dialog and took keyboard focus.
A member who had never been active showed as active 56 years ago in the Members widget.
Lists showed the account login name instead of the person's display name.
Adding or removing a person, or following a list, now updates the member list, the counts and the pages straight away, in every language.
Asking for a members page past the end now shows the last page instead of "No members".
The camera button on a list's icon was too small to tap on a phone.

Security

A private list's members could be read by anyone, including visitors who were not logged in.
Anyone signed in could gain access to any private list by following it. Following now requires being allowed to see the list.
Private lists no longer appear on a member's profile to people who cannot open them.
"Who can add people to a list" is now enforced. It previously hid buttons while the server still accepted the change.
Uploaded covers and icons are stored in a folder of the list's own, so removing a list can only ever remove its own files.
The Followed tab and its count no longer reveal private lists a member follows to people who cannot open them.
Member search now requires being logged in.
Hardened the bundled licensing component against a request that could load unintended files.
A private list's name showed in the browser tab to people who could not open it, and two background requests returned its name, description and members to any signed-in member. Both now check that you may see the list.
Removed an unused background request that let any signed-in member ask for the whole member list in one go.
"Who can create lists" is now enforced when a list is saved, not only when the button is drawn.
Uploads for covers and icons are checked by what the file actually is. Only JPG, PNG and GIF pictures are accepted, up to 5 MB.
Member search now looks at names only, so it can no longer be used to read out email addresses, and is rate limited.
A list name that was too long could fail to save yet be reported as created, tying the member to another list. It is now refused up front.
Only a list's owner or an administrator can replace or remove its cover and icon. A friend allowed to edit the details can no longer delete the owner's pictures.
Following or viewing a list that does not exist is refused.
Moving covers to the new folders on upgrade now only copies real pictures from the dated uploads folders, never other files.
A list that turns private now drops the people who followed it while it was public, and followers can no longer open a private list.
Adding and removing people from a list is rate limited.
Following a member is refused when the site has following switched off.

Dev

New filters buddylists_widget_member_ceiling and buddylists_active_member_window_days. The removed buddylists_get_members and buddylists_user_details AJAX actions are gone from the documentation.