chore: sync from ultimate-addons-for-gutenberg master

README.md

@@ -5,7 +5,7 @@
 **Requires at least:** 5.6  
 **Requires PHP:** 7.4  
 **Tested up to:** 7.1  
-**Stable tag:** 2.20.2  
+**Stable tag:** 2.20.3  
 **License:** GPLv2 or later  
 **License URI:** https://www.gnu.org/licenses/gpl-2.0.html  
 
@@ -124,6 +124,9 @@ Our external packages use [Rating Star Component](https://github.com/n49/react-s
 
 Spectra Legacy receives maintenance updates only: security fixes, WordPress and PHP compatibility, and critical bug fixes. New features ship in Spectra Blocks.
 
+### 2.20.3 - Wednesday, 26th August 2026 ###
+* Fix: This update addressed a security bug. Props to Manisha Dilshan for the responsible disclosure. Please make sure you are using the latest version on your website.
+
 ### 2.20.2 - Wednesday, 19th August 2026 ###
 * Improvement: Added compatibility with WordPress v7.1.
 

blocks-config/cf7-styler/class-uagb-cf7-styler.php

@@ -890,7 +890,7 @@ public function register_blocks() {
 		 */
 		public function render_html( $attributes ) {
 
-			$form = $attributes['formId'];
+			$form = isset( $attributes['formId'] ) ? intval( $attributes['formId'] ) : 0;
 
 			$classes = array(
 				'uagb-cf7-styler__align-' . $attributes['align'],

blocks-config/gf-styler/class-uagb-gf-styler.php

@@ -1002,7 +1002,7 @@ public function register_blocks() {
 		 */
 		public function render_html( $attributes ) {
 
-			$form = $attributes['formId'];
+			$form = isset( $attributes['formId'] ) ? intval( $attributes['formId'] ) : 0;
 
 			$classes = array(
 				'uagb-gf-styler__align-' . $attributes['align'],
@@ -1058,7 +1058,7 @@ public function render_html( $attributes ) {
 				$shortcode_attrs = array(
 					'id'       => $form,
 					'ajax'     => ( $attributes['enableAjax'] ) ? 'true' : 'false',
-					'tabindex' => ( $attributes['enableTabSupport'] ) ? $attributes['formTabIndex'] : '',
+					'tabindex' => ( $attributes['enableTabSupport'] ) ? intval( $attributes['formTabIndex'] ) : '',
 				);
 
 				if ( isset( $attributes['titleDescStyle'] ) && 'none' === $attributes['titleDescStyle'] ) {

classes/class-uagb-loader.php

@@ -140,7 +140,7 @@ public function define_constants() {
 			define( 'UAGB_BASE', plugin_basename( UAGB_FILE ) );
 			define( 'UAGB_DIR', plugin_dir_path( UAGB_FILE ) );
 			define( 'UAGB_URL', plugins_url( '/', UAGB_FILE ) );
-			define( 'UAGB_VER', '2.20.2' );
+			define( 'UAGB_VER', '2.20.3' );
 			define( 'UAGB_MODULES_DIR', UAGB_DIR . 'modules/' );
 			define( 'UAGB_MODULES_URL', UAGB_URL . 'modules/' );
 			define( 'UAGB_SLUG', 'spectra' );

classes/class-uagb-onboarding.php

@@ -68,31 +68,31 @@ public function register_onboarding() {
 			\One_Onboarding\Core\Register::register_product(
 				'spectra',
 				array(
-					'title'       => __( 'Spectra Legacy Onboarding', 'ultimate-addons-for-gutenberg' ),
-					'product'     => array(
+					'title'                   => __( 'Spectra Legacy Onboarding', 'ultimate-addons-for-gutenberg' ),
+					'product'                 => array(
 						'id'   => 'spectra',
 						'name' => __( 'Spectra Legacy', 'ultimate-addons-for-gutenberg' ),
 					),
-					'logo'        => UAGB_URL . 'assets/images/logos/spectra.svg',
-					'screens'     => array(
+					'logo'                    => UAGB_URL . 'assets/images/logos/spectra-legacy-wordmark.svg',
+					'screens'                 => array(
 						'welcome'   => array(
 							'heading'     => __( 'Welcome to Spectra Legacy', 'ultimate-addons-for-gutenberg' ),
-							'description' => __( 'Build a fast, beautiful WordPress site—effortlessly.', 'ultimate-addons-for-gutenberg' ),
+							'description' => __( 'Effortlessly build a fast, beautiful WordPress site.', 'ultimate-addons-for-gutenberg' ),
 							'banner'      => array(
 								'type'      => 'video',
 								'url'       => 'https://www.youtube-nocookie.com/embed/GLNzTxArR6Y?showinfo=0&autoplay=1&modestbranding=1&rel=0',
-								'title'     => __( 'Getting Started with Spectra Legacy', 'ultimate-addons-for-gutenberg' ),
+								'title'     => __( 'Getting Started with', 'ultimate-addons-for-gutenberg' ),
 								'thumbnail' => UAGB_URL . 'admin-core/assets/images/onboarding-video-bg.png',
 							),
 							'items'       => array(
 								__( 'Trusted by 1.8M+ websites worldwide', 'ultimate-addons-for-gutenberg' ),
 								__( 'Import ready-made patterns & templates', 'ultimate-addons-for-gutenberg' ),
-								__( 'Easy customization—no coding or design skills', 'ultimate-addons-for-gutenberg' ),
+								__( 'Easy customization with no coding or design skills', 'ultimate-addons-for-gutenberg' ),
 								__( 'Drag & Drop blocks to build your layout', 'ultimate-addons-for-gutenberg' ),
 							),
 						),
 						'user-info' => array(
-							'description'    => __( 'Get helpful updates, new features, and tips to make your website better—while helping us improve Spectra Legacy.', 'ultimate-addons-for-gutenberg' ),
+							'description'    => __( 'Get helpful updates, new features, and tips to make your website better, while helping us improve Spectra Legacy.', 'ultimate-addons-for-gutenberg' ),
 							'sourceOptions'  => array(
 								'wordpress' => __( 'WordPress Plugin Directory', 'ultimate-addons-for-gutenberg' ),
 								'google'    => __( 'Google Search', 'ultimate-addons-for-gutenberg' ),
@@ -118,7 +118,8 @@ public function register_onboarding() {
 							),
 						),
 						'features'  => array(
-							'description' => __( 'Enable the features you need to design faster and build better with Spectra Legacy.', 'ultimate-addons-for-gutenberg' ),
+							'heading'     => __( 'Spectra Legacy features', 'ultimate-addons-for-gutenberg' ),
+							'description' => __( 'Powerful features to design faster and build better with Spectra Legacy.', 'ultimate-addons-for-gutenberg' ),
 							'featureList' => self::get_feature_list(),
 							'upgradeUrl'  => 'https://wpspectra.com/pricing/?utm_source=spectra_dashboard&utm_medium=onboarding&utm_campaign=pro-features',
 						),
@@ -145,13 +146,14 @@ public function register_onboarding() {
 							),
 						),
 					),
-					'exit'        => array(
+					'exit'                    => array(
 						'url' => admin_url( 'admin.php?page=spectra' ),
 					),
-					'colors'      => array(),
-					'option_name' => 'spectra_onboarding',
-					'pro_status'  => self::get_pro_status(),
-					'pro_slug'    => 'spectra-pro',
+					'colors'                  => array(),
+					'option_name'             => 'spectra_onboarding',
+					'pro_status'              => self::get_pro_status(),
+					'pro_slug'                => 'spectra-pro',
+					'select_all_pro_features' => true,
 				)
 			);
 
@@ -172,15 +174,15 @@ private static function get_pro_status() {
 			}
 
 			if ( is_plugin_active( 'spectra-pro/spectra-pro.php' ) ) {
-				return 'Activated';
+				return 'active';
 			}
 
 			$all_plugins = get_plugins();
 			if ( isset( $all_plugins['spectra-pro/spectra-pro.php'] ) ) {
-				return 'Installed';
+				return 'inactive';
 			}
 
-			return 'Not Installed';
+			return 'not-installed';
 		}
 
 		/**
@@ -208,6 +210,8 @@ public function handle_onboarding_completion( $completion_data, $request ) {
 
 				// Update analytics opt-in.
 				update_site_option( 'spectra_usage_optin', $optin ? 'yes' : 'no' );
+				// Mirror to the dashboard analytics setting so both consent sources stay coherent.
+				update_option( 'spectra_analytics_optin', $optin ? 'yes' : 'no' );
 
 				// Only send lead to CRM if user opted in.
 				if ( $optin ) {

languages/ultimate-addons-for-gutenberg.pot

@@ -2,7 +2,7 @@
 # This file is distributed under the same license as the Spectra plugin.
 msgid ""
 msgstr ""
-"Project-Id-Version: Spectra 2.20.2\n"
+"Project-Id-Version: Spectra 2.20.3\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/ultimate-addons-for-gutenberg\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

lib/one-onboarding/.github/workflows/code-analysis.yml

@@ -40,6 +40,9 @@ jobs:
                   coverage: none
                   tools: composer, cs2pr, phpcs
 
+            - name: Set composer token
+              run: composer config github-oauth.github.com ${{ secrets.PRIVATE_ACCESS_TOKEN }}
+
             - name: Install dependencies
               run: composer install --prefer-dist --no-suggest --no-progress && npm install
 

lib/one-onboarding/.github/workflows/tag-release.yml

@@ -26,6 +26,9 @@ jobs:
           coverage: none
           tools: composer, cs2pr
 
+      - name: Set composer token
+        run: composer config github-oauth.github.com ${{ secrets.PRIVATE_ACCESS_TOKEN }}
+
       - name: Use desired version of NodeJS
         uses: actions/setup-node@v4.4.0
         with:

lib/one-onboarding/.prettierignore

@@ -16,4 +16,5 @@ artifacts
 wordpress/
 tests
 *.map
+auth.json
 *.md

lib/one-onboarding/build/main.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'react-jsx-runtime', 'wp-api-fetch', 'wp-element', 'wp-i18n'), 'version' => '555cf7f052936507f304');
+<?php return array('dependencies' => array('react', 'react-dom', 'react-jsx-runtime', 'wp-api-fetch', 'wp-element', 'wp-i18n'), 'version' => '224a5c7bb196ec99c1c4');