v3.9.1 Latest
October 6, 2026
Improve 5 Fix 17 Security 3 Dev 5
Improve
- Pagination, buttons and links now use the active theme's own button and link colors, in light and dark mode.
- The Top Rated Groups widget reads cached group ratings instead of loading every review, and its ratings now match the group header.
- The review CSV export now runs in batches, so large sites can export without running out of memory.
- The criteria Remove and Add controls use standard WordPress buttons, each Remove labelled with its criterion for screen readers.
- Reviews created through the REST API now get the same notifications, emails, activity and hooks as reviews submitted in the group.
Fix
- Submitting a review after the rating criteria changed could fail with an error or save stars against the wrong criteria.
- Approving or denying a review from wp-admin, bulk actions or the post editor now emails the reviewer.
- The approval email now links the reviewer to the group's reviews instead of wp-admin.
- Turning BuddyPress Notifications off now stops every review notification.
- Group reviews now appear as an option in the activity stream Show filter.
- The Submit button no longer wraps onto two lines when the review label is renamed or translated.
- Uninstalling Group Reviews no longer deletes BuddyPress Member Reviews, which share the same review type.
- Uninstall now removes all of the plugin's own data, including per-group criteria, cached ratings and saved options.
- The Documentation links open the current documentation page directly.
- Review acceptance and denial notification emails could not be turned off; the enable toggles now persist an explicit off state.
- The acceptance and denial email toggles now hide their subject and message fields when switched off, matching the submission toggle.
- Removed the stray filled background bar behind each rating criterion in the Add Review form.
- Reworked the reviews pagination into a single consistent, theme-aware style with a clearly marked active page.
- Corrected the feedback slug so plugin activation data is stored under the plugin's own key.
- Corrected a double-escaped ampersand in the Help and Support heading.
- Fixed missing spaces before placeholders and a mistranslation in the French strings, and corrected the Portuguese (Brazil) New Post string.
- The plugin name is no longer translatable, so no locale can rename the product. French rendered it as "BuddyPress Group Evaluations" in the settings heading, the browser title and the feedback prompt.
Security
- Reviews and ratings of private and hidden groups are no longer shown to non-members through the REST API, the ratings filter, the group page or the widgets.
- Group and member names are now escaped in review notification emails.
- Removed logged-out AJAX registrations for the accept, deny, remove and submit review endpoints, which require an authenticated user.
Dev
- The bgr_group_review_after_review_insert action now passes the review, group and reviewer IDs and fires for REST-created reviews too.
- Added bgr_can_view_group_reviews() so integrations can apply the same review visibility rule.
- Replaced HSL colors in the admin accordion with hex, and removed the unused .bgr-switch/.bgr-slider toggle CSS.
- Corrected two PHPStan findings in the translation tooling and the script-textdomain filter, so static analysis runs clean at the configured level.
- Tracked composer.json and the contract-audit baseline, which the blanket *.json ignore rule had been excluding, so the static analysis and contract gates are reproducible.