Releases

Changelog.

Vakanssi 0.37.15. Last updated October 16, 2026.

The short version

Vakanssi ships small and often: 233 releases so far, and every one of them written in plain language, so you can tell what changed without reading a commit log. Fixes go out as soon as they are ready. Nothing that was free has ever moved behind Pro, and nothing will.

15 October 2026 3 releases

v0.37.15

  • Fixed A job title with an apostrophe, a quote or an ampersand, such as "Director's Assistant", shows as typed in interview calendar invites, the applications CSV export, the Applications board, the application drawer, the job filter and the job details search engines read. Before, those showed HTML code in place of that character.
  • Fixed Interview titles, locations and notes that contain "<", and team members' names that contain "&", show as typed in the interview panel and in calendar invites. Saving an interview without changing its text keeps that text exactly as it was.
  • Changed The team's "New application" email names where the application came from ("Careers page") instead of the stored value ("native"), in the site's language, also when someone using WordPress in another language resends it.
  • Changed For developers, job titles and interview text in the REST API, and the job title and company name in the job's structured data, are plain text instead of HTML entities. Escape them before printing them as HTML.
  • Fixed Webhooks, Slack and Teams messages, the Hiring HQ CSV export, the candidate profile, the talent pool and the self-booking page's calendar links show job titles, stage names, interview details and team members' names as typed. In webhooks, everything your team wrote is now plain text; the applicant's own name is still sent as stored.

v0.37.14

  • Fixed Email subjects are sent as plain text. A job title with an apostrophe, a quote or an ampersand, such as "Director's Assistant", reached candidates with HTML code in place of that character.
  • Fixed The application drawer and the printed application sheet show the source's name ("Careers page", "Added manually", "Imported from WP Job Manager") instead of the stored value, such as "native". A source someone typed in is shown as typed. The applications list in the REST API carries the name as `source_label` beside `source`.
  • Fixed The Getting started steps on Hiring HQ stay open while the only jobs and applications on the site are sample data. Before, adding the sample data folded the steps away although none of them was done.
  • Fixed Assignment and mention emails to teammates name the job, so two applications from one person no longer produce identical emails.
  • Fixed An automation email whose subject names a job with an apostrophe or an ampersand keeps its Resend button.
  • Changed Hiring HQ's source table uses the same names as the drawer, with one row per name. Spellings that differ only in case or accents are no longer merged under whichever spelling the database picked, and stored values that mean the same channel (such as "native" and "careers_page") are one row.

v0.37.13

  • Changed An interview can last at most 480 minutes (8 hours), the limit the Interviews settings already used for the default length. Creating or editing an interview with a longer length is now refused with a message instead of being saved. An interview saved with a longer length before this update keeps it when you edit something else.
  • Changed Further code-standards hardening: the email link in the applications people list is built with WordPress's URL escaping, and the job editor reads its security token the way the WordPress handbook asks.
  • Changed Proposing interview times also refuses a length above 480 minutes.
  • Fixed The email link in the talent pool is built with WordPress's URL escaping.

14 October 2026 1 release

v0.37.12

  • Fixed When the application form uses a CAPTCHA and an applicant submits without completing it, or the CAPTCHA service cannot be reached, the form now comes back with everything they typed and asks them to complete the check, instead of clearing the form. An answer the CAPTCHA service rejects still clears it.
  • Changed The External services section of this readme now says that your Turnstile secret key is sent to Cloudflare along with the token and the IP address, also when you use "Test these keys".
  • Fixed Switching from the free version to Pro at the same version now creates the tables for scorecards, candidate tags, live presence and webhook delivery on the next page load. Before, those features failed until the next update. Self-booking links work right away after the switch, also when the licence is activated afterwards.
  • Fixed A scorecard or tag that could not be saved showed as saved. The drawer now says "Could not save the changes", and a tag that could not be removed is reported the same way.
  • Fixed The message for an unanswered required screening question no longer ends in "?.".
  • Changed The "Powered by Vakanssi" credit on the self-booking page is now off by default. Return true from the `vakanssi/booking/powered_by` filter to show it.
  • Changed The Pro features now meet the same security and coding standard as the free version. The self-booking page escapes what it prints and loads its styles and scripts through WordPress, every database query is prepared, and this readme lists each external service the Pro features use and what they send.
  • Changed Clauses from the `vakanssi/authz/application_scope` and `vakanssi/authz/candidate_scope` filters are now bound on their own. A clause whose placeholder carries a modifier (such as %1$s, %5s, %+d or %.1f) or follows a literal percent sign is refused, and that list reads as empty; the hook reference shows the supported forms.

10 October 2026 1 release

v0.37.11

  • Changed Vakanssi now requires WordPress 6.6 or later (was 6.4).
  • Changed An import's continue link and the setup wizard's link to check the careers page again now carry a security token from the admin screen that shows them. An old or shared link no longer starts the next import batch or the check by itself; the screen offers its own Continue import button or Check it now link instead.
  • Changed Email addresses are read more strictly on the application form, Add Application and the Tools test email. An address that WordPress's cleaning would change, such as one containing a percent code like %2B, is refused with a message instead of being saved as a different address.
  • Changed Add Application error messages now come from a fixed list, so a link can no longer put its own words in the notice. The confirmation after the one-click job URL fix now names the URL base your settings hold, not one taken from the link.
  • Changed Activation no longer makes any web request. The check that candidate files cannot be downloaded directly now runs afterwards, for example the first time a site manager opens a Vakanssi screen or Site Health, and the plugin's screens warn if the folder is reachable.
  • Fixed Editing an interview now cleans the title and location the same way scheduling one does.
  • Fixed On Windows servers, CV uploads (the application form and Add Application) and CSV imports could be refused, because the plugin altered the server's temporary file path.
  • Fixed Paging or sorting the applications list no longer drops characters from a search that contains a plus sign or a letter outside the English alphabet.
  • Changed The privacy feature is now called Privacy & Data Retention, and its descriptions no longer name specific privacy laws.
  • Changed With "Permanently delete all applications, candidates, and stored CV files when the plugin is deleted" turned on, deleting the plugin now also moves the careers page the setup wizard created to the Trash. Pages you made yourself stay.
  • Changed Further security and code-standards hardening for the WordPress.org plugin directory (database queries, output escaping, file handling). Side effects you may notice: the CSV import template uses plain line endings, a bulk-action form on the applications list left open from before the update asks you to reload once, and the job page's structured data is printed through WordPress's own script functions, so a security plugin can add its nonce to it.

8 October 2026 1 release

v0.37.10

  • Changed Candidate CVs are now stored in a protected `vakanssi` folder in your uploads directory (random file names, Apache deny rule, index guards, a generated Nginx rule, and an HTTP check that warns if the folder is reachable). They used to be stored one level above the WordPress folder whenever that was writable, which WordPress.org does not allow.
  • Changed The check that candidate files cannot be downloaded directly now also fetches a test PDF, and reports the folder protected only when a public plugin file loads over the same connection, so a host that serves PDFs itself, or blocks the site's request to itself, is no longer reported safe. A custom storage folder (VAKANSSI_STORAGE_DIR) that answers "not found" now shows a warning instead of passing; the generated server rule answers "forbidden" and clears it.
  • Changed The job-page setting that hides the published date or author now blanks those blocks with WordPress's own empty-output filter. Site Health text and personal-data eraser messages are escaped.

5 October 2026 1 release

v0.37.9

  • Fixed Activating the plugin on WordPress Playground, or on any site using WordPress's SQLite database integration, printed a database error. Applying for a job, adding a note and erasing personal data printed database errors there too, and the limit on repeated applications did not count.
  • Fixed On a host that limits PHP to the site's own folder (open_basedir), activation printed PHP warnings. CVs are stored in the uploads folder there, protected as before.
  • Fixed When WordPress is installed directly below the server's root folder, CVs are no longer placed in that root folder, where they could not be saved.
  • Fixed Deleting an application whose CV could not be located because the server blocked a folder the plugin checks is now recorded with the file's location, instead of being treated as already gone.
  • Fixed The setup wizard's import step no longer stops with an error on a server without PHP's mbstring extension.
  • Fixed Moving a candidate twice from the open drawer on the pipeline board no longer says a teammate moved them, and the drawer now shows the stage and status the server reports.
  • Fixed Choosing whether to email the candidate when moving them to a hired or rejected stage no longer closes the candidate drawer.
  • Fixed Tools → Data → Reset refused to run on the free version and deleted nothing. Deleting a site on a network that moved from Pro to the free version now also removes that site's Pro tables.
  • Fixed Clicking Hiring in the admin menu opens Hiring HQ again, not the jobs list.
  • Fixed The first save of a Settings tab could turn off the LinkedIn field and hide salary, employment type and closing date on job pages, and the first Interviews save stored the interview types as "Array".
  • Fixed The Print / PDF button in the candidate drawer opened a "link expired" error.
  • Changed Everything printed by the plugin's shortcodes, the job page, the Jobs block, the Elementor and Divi widgets and the careers archive now passes through WordPress's HTML filter. The plugin's own markup is unchanged. Markup added through the plugin's filters, the consent label included, can no longer print scripts, styles, frames or event handlers; the developer hooks reference lists exactly what is kept.

2 October 2026 1 release

v0.37.8

  • Fixed A null byte in a name crashed the confirmation email. It is removed before the name is stored or mailed.
  • Fixed A password-protected job rejects a public application, and the refusal shows on the home page.
  • Changed On this plugin's own admin screens, other plugins' notices are recognised by asking WordPress where plugins and themes live rather than by comparing file paths, so a plugin or theme whose folder is a symbolic link is now recognised correctly. A single-file plugin that is itself a symbolic link is left alone, because WordPress does not record where it really lives. WordPress's own notices and this plugin's are kept, as before.
  • Changed A notice printed by a drop-in such as object-cache.php, or by a file in the WordPress root directory, is now left in place on those screens rather than hidden.

26 September 2026 1 release

v0.37.7

  • Fixed The setup wizard no longer reads a negative step number as if it were positive.
  • Fixed Two sites sharing one MySQL server and table prefix could block each other's stage-history backfill, email resends and interview scheduling; each site's locks are now its own.

14 September 2026 2 releases

v0.37.6

  • Fixed Returning false from the `vakanssi/intake/spam_check` filter now rejects the submission, as documented, unless a later callback on the filter returns true. It was let through.
  • Fixed A custom anti-spam provider with methods that are missing, not public, throw an error or return the wrong type no longer crashes the anti-spam settings screen, the key test or the application form. When the provider's own check fails while someone applies, the "Let applications through if the challenge cannot be checked (fail open)" setting now decides instead of an error page. The Test these keys button is no longer shown for a provider with no challenge widget to load.
  • Fixed A new job location typed with a backslash lost it from the location's name.
  • Changed The application form handler reads a fixed list of named fields instead of every submitted field. An extension that adds its own field to the form names it with the new `vakanssi/intake/posted_fields` filter, or that field is not passed to spam checks and is not kept when the form is shown again after an error. A custom anti-spam provider names its token field with a public `request_field()` method or the same filter.

v0.37.5

  • Fixed A backslash typed into a job's display label, street, region or postal code was removed on save.
  • Fixed An email address that WordPress's sanitising would have changed (for example one containing a percent code) is now refused on the setup wizard and the job's notification field, instead of being saved as a different address.
  • Changed The Elementor Apply widget, the anti-spam challenge and each careers listing row now pass through WordPress's HTML filter before they are printed. The markup is unchanged; code added through the listing row filter can no longer print scripts or event handlers.
  • Changed The setup wizard, the job editor and three admin redirects read each submitted field by name instead of copying the whole request, and every remaining database column name in a query is bound safely instead of written into the query text. No change to how the plugin behaves day to day.

11 September 2026 1 release

v0.37.4

  • Fixed The setup wizard removed an extra level of backslash escaping from what you typed, so a company name containing a backslash was saved without it.
  • Fixed One scheduled internal maintenance query ran a database update with no safety binding on its table name, found while hardening the plugin for the WordPress.org review.
  • Changed Further hardening for the WordPress.org plugin directory listing: tighter escaping of admin and candidate-facing output, narrower reading of submitted form data, and every database query now binds its table name safely instead of building it into the query text. No change to how the plugin behaves day to day.

24 August 2026 1 release

v0.37.3

  • Changed Further hardening for the WordPress.org plugin directory listing. The bundled translation template, a booking diagnostic on the compatibility test, demo scaffolding for paid features, and some unused paid styling have been removed from the free build. Day-to-day use is unchanged, including on a site moved down from Pro.
  • Changed The status and Site Health panels no longer list a webhook delivery count, which belonged to a feature this build does not include. The section that held it is now called "Cron & maintenance".
  • Fixed The compatibility test no longer ends with a "How to fix these issues" link when every check passed.
  • Changed Cover letters are capped at 20,000 characters. Longer ones are refused by name, the way an over-long name or phone number already was, instead of being stored in full.

23 August 2026 3 releases

v0.37.2

  • Fixed On a brand-new install the Interviews feature could not save an interview, because its database table was not being created. Scheduling works on a fresh install again.

v0.37.1

  • Changed Further hardening for the WordPress.org plugin directory listing. The free download no longer creates database tables for features it does not include, and no longer carries an inventory or scaffolding for the separate Vakanssi Pro plugin. Existing data, including on a site moved down from Pro, is still fully exported and erased for privacy requests, and is removed on uninstall when you choose to delete all data. Nothing changes in day-to-day use.

v0.37.0

  • Fixed Hiring Managers can now set a candidate's star rating from the pipeline. Rating a candidate is an evaluation, the same as a scorecard, so the role that can evaluate can now rate; before, the stars showed for that role but would not respond.
  • Changed Hardening for the WordPress.org plugin directory listing. Candidate CV uploads now pass through WordPress's own file handler while still being stored privately outside the web root, and a few remaining admin scripts and styles moved onto the standard asset loader. Nothing changes in how the plugin works day to day.

22 August 2026 3 releases

v0.36.4

  • Added Site Health now checks your anti-spam challenge, so a challenge set up for the wrong web address, or never tested, shows up on the screen you check first instead of silently refusing every applicant.
  • Fixed Site Health said "emails are being delivered" when all it could see was that your site handed them to its mail server. It now says they are being sent, and says plainly that whether they reached an inbox is something it cannot see.
  • Fixed A site that had sent no emails at all was reported as one whose email was working. It now says there is nothing to judge yet and points at the email test.

v0.36.3

  • Added The compatibility test now reports your anti-spam challenge as its own line. If the challenge has never been tested, if its keys changed since the last test, or if the last test failed, it says so and points you at the button that checks it.
  • Changed The compatibility test no longer reports the application form as simply "working" when a challenge is switched on. It says the form is reachable and that the challenge was not part of the test, because a challenge set up for the wrong web address refuses every applicant while the form itself is fine.

v0.36.2

  • Fixed A very long name or phone number on the application form was refused with "We could not save your details", which named no field and could not be cleared by trying again. The form now says which field is too long, and a name written in Hebrew or another multi-byte script is measured the way the database measures it.
  • Fixed A long name with no spaces in it stretched the Applications board off the side of the screen. Long names and job titles now wrap inside their card.
  • Fixed Scheduling or rescheduling an interview over the REST API with a start time that was not a timestamp created the interview at the start of 1970 and emailed the candidate that date. A start time that cannot be a real one is now refused.

21 August 2026 3 releases

v0.36.1

  • Fixed On a fresh install the Applications screen could show a red banner saying a security plugin was blocking the REST API, when nothing was. One status endpoint was asking for information this build does not include, and failed instead of answering.
  • Fixed The compatibility test reported the REST API as working even when that endpoint was failing for logged-in staff. It now checks the endpoint the way your browser does, so it can actually report a problem.

v0.36.0

  • Changed Features are listed on one screen instead of being split into free and paid groups, and the settings tabs, dashboard bands and candidate drawer no longer show dimmed previews of features this plugin does not include.
  • Removed The Custom CSS box. Use Appearance, Customize, Additional CSS instead. It has syntax checking and revision history, and your existing rules keep working because the class names are unchanged.
  • Fixed Storing your Candidates view and grouping choice is now signed, so a crafted link cannot change how your screen opens.
  • Fixed An assignment-scoping warning could report the wall was up when it was down, and could point at a switch that was already on or was not there at all.
  • Changed The importer's batch continue, its notice dismissal, the printable application sheet and the admin menu icon all load through the standard WordPress asset loader.
  • Changed The anti-spam settings only reference the challenge provider this build includes.

v0.35.4

  • Fixed With assignment-based candidate visibility on, Hiring HQ showed a recruiter interviews for people they are walled off from. "Upcoming interviews" listed every interview in the company, named the candidate, and linked into a record the next click refused to open. "Interviews next 7 days" counted them too.
  • Fixed The Applications column on the Jobs list showed that same recruiter a company-wide count, while the list it links to was correctly filtered. The gap between the two numbers told them how much was being kept from them.
  • Fixed "See roles" on Hiring HQ sent a Hiring Manager to a screen their role cannot open. The count stays, the dead link goes.
  • Fixed Switching Interviews off offered to sell you Pro for it. Interviews is free, and that card now points at the switch that turns it back on.
  • Fixed Switching Applications off left Hiring HQ as a heading with nothing underneath it.
  • Fixed Hiring HQ could be made to announce that a feature was switched off while it was running.
  • Fixed Hire rate reported "0.0%" before anyone had been hired or rejected. It now says nobody has reached a decision yet, like the tiles beside it.
  • Fixed The Pipeline card told a board full of candidates that it had no applications, when what was missing was the stages.
  • Fixed "Applications by job" merged two roles that share a title, and split one role's history in two when you renamed it.
  • Fixed The count of roles with no applicants could read zero on a site with more than fifty roles, which is exactly where it mattered.
  • Fixed "Time in stage" said there was nothing to average on databases too old to calculate it. It now says what it needs, MySQL 8.0 or MariaDB 10.2.
  • Changed Hiring HQ opens quicker. It runs about a third fewer database queries and loads half the stylesheet weight it used to.

20 August 2026 8 releases

v0.35.3

  • Fixed A job you protect with a password is now genuinely private. It was still listed on the careers page with its salary and location, counted among your open roles, and its page offered a working application form under the password box, so a visitor could apply to a role they were not allowed to read. Its details were also readable through the site's REST API.
  • Fixed On themes that open their own main content area in the header, Twenty Twenty-One among them, the careers page and job pages no longer add a second one. Screen readers were announcing two "main" landmarks on a page that has one.
  • Fixed A theme that ships a header file but no footer file no longer gets WordPress's legacy fallback footer, "proudly powered by WordPress" and all, printed below the job.

v0.35.2

  • Fixed "Resend" now appears on a delivery that actually failed. Every failed webhook or Slack delivery showed a dash instead of the button, because what it needed to send was thrown away the moment it failed. That is now kept for a day, long enough to fix the receiving end and send it again, then cleared.
  • Fixed Moving a lot of candidates at once no longer loses their webhooks. One bulk move could queue hundreds of sends into a single page load, and everything past the server's time limit was dropped without a trace. Anything over the limit is now queued and delivered by the retry job within a few minutes.
  • Fixed Saving an integration endpoint without changing anything said "That endpoint couldn't be saved" and dropped you on a blank Add endpoint form, although it was already saved and correct. A save that really does fail now returns you to the endpoint you were editing.
  • Fixed A webhook still waiting to be sent when you erase a candidate is no longer sent empty. It went out anyway with nothing in it, posting "New application: A candidate" into your Slack channel.
  • Fixed A delivery still waiting long after its retry window closed, because the scheduler is broken or Integrations was switched off, no longer keeps the candidate's name and email in the delivery log. It is given up on after a week.
  • Fixed A test send to a blocked address said the receiver had rejected the request, when the plugin had refused to contact it. A timed-out delivery no longer names a five-second limit that is not the limit on every server.

v0.35.1

  • Fixed Switching a feature off no longer leaves links pointing nowhere. A bookmark or an emailed link to a screen whose feature is switched off now lands on Hiring HQ and says which feature to turn back on, instead of "you are not allowed to access this page".
  • Fixed Tools, Import no longer shows upload forms when the importers are switched off. Submitting one silently did nothing.
  • Fixed A settings tab whose feature is switched off no longer swaps itself for a different tab without saying so.
  • Fixed Assignment-based candidate visibility now warns you when it stops being enforced because a feature was switched off, not only when Collaboration itself becomes unavailable. Turning off Notes disables Collaboration, and with it that wall, which previously happened in silence.
  • Fixed Recruiter notification emails no longer include a "Review application" button when Applications is switched off.
  • Changed Privacy and Compliance is always on. It owns GDPR export, erasure and data-retention purging, and switching it off stopped all three with no warning.
  • Changed The Features screen now says what rides on each feature before you switch it off, and names what is holding a feature back when a dependency is off.

v0.35.0

  • Added Independent scoring. Turn it on under Hiring, then Settings, then Scorecards, and a reviewer no longer sees the team's scores until they have saved their own. Reading four colleagues' verdicts before writing yours reliably shifts what you write, which is the opposite of what averaging four scores is meant to give you. Nothing is hidden silently: the panel says how many people have scored and how to see them, and saving any scorecard unlocks the candidate. People who cannot score are never affected. Off unless you turn it on.

v0.34.10

  • Fixed The "Add to job" picker on a candidate's profile offered jobs the candidate was already on. Those now show as "(already added)" and cannot be picked.
  • Fixed Adding a candidate to a job gave no visible confirmation, and told screen readers "Candidate added to the job." even when the person was already on it and nothing had changed. It now names the job and says which of the two happened.
  • Fixed The picker's empty state said "No open jobs", although the list includes drafts.

v0.34.9

  • Fixed The Scorecard tab said "Unsaved changes." the moment you clicked a score, which looked like something had gone wrong when nothing had. A scorecard you are filling in for the first time now says nothing, and one you had already saved keeps its date and adds "Not saved yet." only once you change it. You are still asked before leaving with a scorecard you have not saved.

v0.34.8

  • Added The applications CSV export now carries each candidate's scorecard average and how many people scored them, so a shortlist can be sorted and compared in a spreadsheet instead of opening one candidate at a time. A candidate nobody has scored exports blank rather than zero, which would sort as a very low score.

v0.34.7

  • Changed The screening question editor is usable at the width it actually has. Question text wraps instead of being cut off mid-word, an option list is shown in full instead of scrolled, and on a narrow screen each row stacks under its column names.
  • Changed "Add question" replaces the two spare rows, so you can add as many questions as you like before saving instead of two at a time, and up and down arrows replace typing order numbers. Both still work with JavaScript turned off.
  • Changed On a Short text or Paragraph question the Options and Disqualifying answers boxes are now greyed out and read-only, because nothing typed in them survives a save. They used to look exactly like the boxes that work.

Older releases

This page lists the 30 most recent releases of 233. The full history, back to 0.1.0, ships inside the plugin as changelog.txt.