chore: prepare for 4.16.3 release

glaubersilva · glaubersilva · commit 9366b333f780 · 2026-07-03T15:33:39.000-03:00
diff --git a/changelog.txt b/changelog.txt
@@ -1,5 +1,10 @@
 == Changelog ==
 
+= 4.16.3: July 6th, 2026 =
+* Security: Added additional validation to ensure donation gateway selection respects the enabled payment gateway settings.
+* Security: Improved escaping of donation form template output.
+* Security: Improved the security of the recurring donation REST API.
+
 = 4.16.2: July 1st, 2026 =
 * Security: Added additional escaping and sanitization to the Sequoia (Multi-Step Form) template settings and donation form markup (CVE-2026-13704).
 
diff --git a/changelog/svul-28-give-4161-unauthenticated-payment-gateway-restriction-bypass.yaml b/changelog/svul-28-give-4161-unauthenticated-payment-gateway-restriction-bypass.yaml
diff --git a/changelog/svul-29-give-4161-stored-xss-via-donation-form-submit-button-label.yaml b/changelog/svul-29-give-4161-stored-xss-via-donation-form-submit-button-label.yaml
diff --git a/changelog/svul-30-give-4161-unauthenticated-recurring-donor-information.yaml b/changelog/svul-30-give-4161-unauthenticated-recurring-donor-information.yaml
diff --git a/give.php b/give.php
@@ -6,7 +6,7 @@
  * Description: The most robust, flexible, and intuitive way to accept donations on WordPress.
  * Author: GiveWP
  * Author URI: https://givewp.com/
- * Version: 4.16.2
+ * Version: 4.16.3
  * Requires at least: 6.6
  * Requires PHP: 7.4
  * Text Domain: give
@@ -426,7 +426,7 @@ private function setup_constants()
     {
         // Plugin version.
         if (!defined('GIVE_VERSION')) {
-            define('GIVE_VERSION', '4.16.2');
+            define('GIVE_VERSION', '4.16.3');
         }
 
         // Plugin Root File.
diff --git a/readme.txt b/readme.txt
@@ -5,7 +5,7 @@ Tags: donation, donate, recurring donations, fundraising, crowdfunding
 Requires at least: 6.6
 Tested up to: 7.0
 Requires PHP: 7.4
-Stable tag: 4.16.2
+Stable tag: 4.16.3
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
@@ -273,6 +273,11 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
 10. Use almost any payment gateway integration with GiveWP through our add-ons or by creating your own add-on.
 
 == Changelog ==
+= 4.16.3: July 6th, 2026 =
+* Security: Added additional validation to ensure donation gateway selection respects the enabled payment gateway settings.
+* Security: Improved escaping of donation form template output.
+* Security: Improved the security of the recurring donation REST API.
+
 = 4.16.2: July 1st, 2026 =
 * Security: Added additional escaping and sanitization to the Sequoia (Multi-Step Form) template settings and donation form markup (CVE-2026-13704).
 
diff --git a/src/API/REST/V3/Routes/Subscriptions/SubscriptionController.php b/src/API/REST/V3/Routes/Subscriptions/SubscriptionController.php
@@ -236,7 +236,7 @@ public function get_items($request)
     /**
      * Get a subscription.
      *
-     * @since TBD Return 404 for anonymous donors unless explicitly included.
+     * @since 4.16.3 Return 404 for anonymous donors unless explicitly included.
      * @since 4.8.0
      *
      * @param WP_REST_Request $request Full data about the request.
diff --git a/src/PaymentGateways/Gateways/Stripe/Traits/CheckoutModal.php b/src/PaymentGateways/Gateways/Stripe/Traits/CheckoutModal.php
@@ -14,7 +14,7 @@ trait CheckoutModal
      * @param int   $formId Donation Form ID.
      * @param array $args   Donation Form Arguments.
      *
-     * @since TBD Escaped the submit button label in the Stripe checkout modal.
+     * @since 4.16.3 Escaped the submit button label in the Stripe checkout modal.
      * @since 2.19.0 Migrated from the legacy Give_Stripe_Checkout::showCheckoutModal implementation of the Stripe Checkout Gateway.
      *
      * @return string
diff --git a/src/Views/Form/Templates/Sequoia/Actions.php b/src/Views/Form/Templates/Sequoia/Actions.php
@@ -223,7 +223,7 @@ public function getFooterSection()
     /**
      * Add checkout button
      *
-     * @since TBD Escaped the checkout button label in the Sequoia template.
+     * @since 4.16.3 Escaped the checkout button label in the Sequoia template.
      * @since 2.7.0
      */
     public function getCheckoutButton()
diff --git a/src/Views/Form/Templates/Sequoia/sections/progress-bar.php b/src/Views/Form/Templates/Sequoia/sections/progress-bar.php
@@ -1,7 +1,7 @@
 <?php
 
 /**
- * @since TBD Escaped the goal color when rendering the progress bar.
+ * @since 4.16.3 Escaped the goal color when rendering the progress bar.
  *
  * @var int $formId
  */
diff --git a/templates/shortcode-goal.php b/templates/shortcode-goal.php
@@ -6,7 +6,7 @@
 /**
  * This template is used to display the goal with [give_goal]
  *
- * @since TBD Escaped the goal color when rendering the progress bar.
+ * @since 4.16.3 Escaped the goal color when rendering the progress bar.
  */
 
 /**
diff --git a/tests/Unit/API/REST/V3/Routes/Subscriptions/SubscriptionRouteGetItemTest.php b/tests/Unit/API/REST/V3/Routes/Subscriptions/SubscriptionRouteGetItemTest.php
@@ -305,7 +305,7 @@ public function testGetSubscriptionShouldRedactAnonymousDonor()
      * matching the collection endpoint and DonorController::get_item(). Regression for the
      * unauthenticated recurring-donor disclosure (Sanjorn Keeratirungsan).
      *
-     * @since TBD
+     * @since 4.16.3
      *
      * @throws Exception
      */
@@ -325,7 +325,7 @@ public function testGetSubscriptionShouldReturn404ForAnonymousDonorWhenExcluded(
      * An administrator explicitly requesting anonymous donors (anonymousDonors=include) must still
      * receive the subscription — the 404 guard applies only to the excluded (default) mode.
      *
-     * @since TBD
+     * @since 4.16.3
      *
      * @throws Exception
      */
diff --git a/tests/includes/legacy/tests-gateways.php b/tests/includes/legacy/tests-gateways.php
@@ -72,7 +72,7 @@ public function test_is_gateway_active()
     /**
      * A request-supplied gateways array must never enable a gateway the admin disabled.
      *
-     * @since TBD
+     * @since 4.16.3
      */
     public function test_enabled_gateways_ignore_post_request_override()
     {
@@ -92,7 +92,7 @@ public function test_enabled_gateways_ignore_post_request_override()
     /**
      * The v3 gateway settings must ignore a request-supplied gateways_v3 array.
      *
-     * @since TBD
+     * @since 4.16.3
      */
     public function test_enabled_gateways_ignore_post_request_override_v3()
     {
@@ -111,7 +111,7 @@ public function test_enabled_gateways_ignore_post_request_override_v3()
     /**
      * give_is_gateway_active() must not be fooled by a request-supplied gateways array.
      *
-     * @since TBD
+     * @since 4.16.3
      */
     public function test_is_gateway_active_ignores_post_request_override()
     {
@@ -127,7 +127,7 @@ public function test_is_gateway_active_ignores_post_request_override()
     /**
      * give_is_gateway_active() must ignore a request-supplied gateways_v3 array for v3 forms.
      *
-     * @since TBD
+     * @since 4.16.3
      */
     public function test_is_gateway_active_ignores_post_request_override_v3()
     {
@@ -143,7 +143,7 @@ public function test_is_gateway_active_ignores_post_request_override_v3()
     /**
      * Gateway display order must come from saved settings, not a request-supplied array.
      *
-     * @since TBD
+     * @since 4.16.3
      */
     public function test_ordered_gateways_ignore_post_request_override()
     {
@@ -175,7 +175,7 @@ public function test_ordered_gateways_ignore_post_request_override()
     /**
      * v3 gateway display order must come from saved settings, not a request-supplied array.
      *
-     * @since TBD
+     * @since 4.16.3
      */
     public function test_ordered_gateways_ignore_post_request_override_v3()
     {

Original file line number	Diff line number	Diff line change
`@@ -236,7 +236,7 @@ public function get_items($request)`
`236`	`236`	`/**`
`237`	`237`	`* Get a subscription.`
`238`	`238`	`*`
`239`		`- * @since TBD Return 404 for anonymous donors unless explicitly included.`
	`239`	`+ * @since 4.16.3 Return 404 for anonymous donors unless explicitly included.`
`240`	`240`	`* @since 4.8.0`
`241`	`241`	`*`
`242`	`242`	`* @param WP_REST_Request $request Full data about the request.`
Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ trait CheckoutModal`
`14`	`14`	`* @param int $formId Donation Form ID.`
`15`	`15`	`* @param array $args Donation Form Arguments.`
`16`	`16`	`*`
`17`		`- * @since TBD Escaped the submit button label in the Stripe checkout modal.`
	`17`	`+ * @since 4.16.3 Escaped the submit button label in the Stripe checkout modal.`
`18`	`18`	`* @since 2.19.0 Migrated from the legacy Give_Stripe_Checkout::showCheckoutModal implementation of the Stripe Checkout Gateway.`
`19`	`19`	`*`
`20`	`20`	`* @return string`
Original file line number	Diff line number	Diff line change
`@@ -223,7 +223,7 @@ public function getFooterSection()`
`223`	`223`	`/**`
`224`	`224`	`* Add checkout button`
`225`	`225`	`*`
`226`		`- * @since TBD Escaped the checkout button label in the Sequoia template.`
	`226`	`+ * @since 4.16.3 Escaped the checkout button label in the Sequoia template.`
`227`	`227`	`* @since 2.7.0`
`228`	`228`	`*/`
`229`	`229`	`public function getCheckoutButton()`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`<?php`
`2`	`2`
`3`	`3`	`/**`
`4`		`- * @since TBD Escaped the goal color when rendering the progress bar.`
	`4`	`+ * @since 4.16.3 Escaped the goal color when rendering the progress bar.`
`5`	`5`	`*`
`6`	`6`	`* @var int $formId`
`7`	`7`	`*/`