What's New with Astra

Hey everyone 👋

This one’s a focused fixes round. A couple of accessibility fixes make submenus behave the way screen readers, touch users and mouse users expect. The mobile header stops showing up at the wrong breakpoint, WooCommerce order details stop sticking together, and Customizer settings save cleanly over the REST API again.

Let’s get into it.

🐛 Squashed

• Submenu arrows actually open the submenu now. Clicking the arrow next to a parent menu item was following the parent link instead of opening the submenu. It now opens the submenu as intended — the same behavior for screen reader, touch and mouse users.
• Second-level submenus no longer swallow their parent. Opening a second-level submenu from its arrow was collapsing the parent submenu and hiding the whole dropdown. Both levels stay open now.
• Mobile header and content switch at the same breakpoint. At a browser width of exactly 922px, the mobile header was showing up while the titles and content kept their desktop styles. The header and tablet styles now switch at the same point, so there’s no mismatched layout at that width.
• Pay, Cancel and Actions line up on the My Account order page. On the WooCommerce My Account order details page, the Pay and Cancel buttons were touching each other and the Actions label was misaligned. They now sit with proper spacing and alignment.
• Customizer settings save cleanly over REST. Plugins that push Customizer settings through the REST API — like Additional CSS from AI connectors — were hitting a server error. Those requests go through now.
• Imports that skip WooCommerce page creation leave no debris. Imports that opt out of creating the default WooCommerce pages — Starter Templates being the common case — were leaving two blank, untitled pages behind. No more untitled orphans.

That’s the release. Update whenever you can and ping us if you catch anything odd.

— Team Astra

Hey everyone 👋

Two security fixes lead this release — one closing a shortcode-injection path through search terms in Site Builder and header sections, another preventing stored scripts from running inside Auto Load Previous Post. On the WooCommerce side, we cleaned up Modern Checkout email validation, a Germanized integration glitch, Sticky Add To Cart duplication, and the My Account orders grid.

Let’s get into it.

🔒 Secured

• Shortcodes in search terms can no longer execute. Site Builder Custom Layouts, Page Headers and the Above and Below Header sections have been hardened so a shortcode placed inside a page’s search term can no longer be run. Search output stays as plain text.
• Blog Pro — Auto Load Previous Post renders the comments heading as plain text. Content added to a post can no longer run scripts for visitors reaching it through Auto Load Previous Post. The comments heading is now escaped. Props to Ayukiab via Patchstack for the responsible disclosure.

🐛 Squashed

• No more duplicate Site Builder layouts in the Sticky Add To Cart bar. A Site Builder layout placed on an Add To Cart hook was showing up a second time inside the Sticky Add To Cart bar. It renders once now, where it should.
• My Account orders grid shows order status with its label. The orders grid view on My Account was running the status label and its value together. They now show as a proper label and value.
• Two Step Modern Checkout rejects malformed email domains. The email step now shows an inline error under the field and stops accepting addresses with empty domain parts — things like example..fr — before letting shoppers move on.
• Germanized + Modern Checkout: PayPal buttons work again. With Germanized active, Modern Checkout was printing a hidden duplicate payment list that broke PayPal buttons. The duplicate is gone, so PayPal behaves normally.

Update promptly for the security fixes — the Patchstack one in particular is worth prioritizing. Let us know if anything looks off.

— Team Astra

Hey everyone 👋

This release is about speed, Modern Checkout, and tightening a Site Builder privacy gap. We’ve trimmed scripts and styles so your admin and checkout screens load lighter, chased down a long list of Modern Checkout rough edges — mobile and desktop — and locked down layout data that was quietly reachable through REST, search and feeds. A handful of theme-builder, Page Header and theme-switching bugs are gone too.

Let’s get into it.

🚀 Improved

• Site Builder scripts only load where they’re needed. The Site Builder admin assets used to load across every WordPress admin screen. Now they only load on the Site Builder page itself, so every other admin page feels lighter.
• One fewer script on Two Step Checkout. The Two Step Checkout page was pulling in an unused slider script on every load. We’ve dropped it, so your checkout page makes fewer requests.
• No more waiting on a loopback that never comes. The addon used to fire off a blocking WP-Cron loopback request on every admin and frontend page load. On sites that can’t reach their own URL — local setups, strict firewalls, hosts with reverse-proxy quirks — that meant a quiet delay on every page. The blocking call is gone.
• jQuery Migrate is no longer a front-end dependency. Astra Pro doesn’t rely on jQuery Migrate on the front end anymore, so you can safely remove it for faster page loads and better Lighthouse scores.

🐛 Squashed

• Elementor Pro theme-builder templates keep their styling. Elementor Pro Theme Builder templates — like a Single Post template — were losing their Atomic Widgets styles on posts that also used a Site Builder layout. Both now coexist cleanly.
• Variation gallery images refresh with slider layouts (WooCommerce 10.8+). Variation gallery images and thumbnails now update correctly when you’re using the Horizontal or Vertical Slider product gallery layouts on WooCommerce 10.8 and later.
• Modern Checkout mobile order summary behaves itself. The mobile order summary had a handful of nasty quirks: content was getting cut off, the page refreshed repeatedly when the shipping method changed, and the button label was wrong after clicking the login link. All three are fixed.
• Modern Checkout shipping methods are selectable on desktop. Shipping method names weren’t clickable on desktop. They are now.
• Modern Checkout fields stay responsive in Dokan and friends. On some multi-vendor marketplace setups like Dokan, checkout fields could stop responding on mobile. They stay interactive now.
• No more PHP warnings when a checkout field has no label. If a plugin or custom code added a checkout field without a label, the Modern Checkout page would log a PHP warning. It no longer does.
• Two Step Modern Checkout accepts real email addresses. Valid addresses with a plus sign, an apostrophe, or a longer TLD like .info were being rejected at step one. Shoppers can now get through to step two.
• Quick View respects password-protected products. Quick View was leaking the short description of password-protected products to visitors who hadn’t entered the password. The password form shows instead now, as it should.
• Page Headers pass accessibility audits again. A Page Header with a background image was producing invalid ARIA markup that tripped Lighthouse and axe. The markup is now valid.
• LearnDash + Header Builder: no more phantom option. The Display Student’s Gravatar in Primary Header option no longer shows up in the Customizer when the Header Builder is active (where it couldn’t do anything anyway).
• LifterLMS + Header Builder: same treatment. The Enable Header Profile Link option no longer appears in the Customizer when the Header Builder is active.
• App-aware theme switchers no longer crash the site. If a plugin like AppPresser swapped the active theme for app requests, Astra Pro could throw a fatal on those pages. They load normally now.

🔒 Secured

• Site Builder layouts stay private. Visitors and non-admin users could previously reach Site Builder layouts and their display rules through the REST API, site search, RSS feeds and archive URLs. All of those paths are now locked down to the right roles only.

Update when you can — the security fix is worth doing promptly, and the performance wins are a bonus on top. Let us know if anything looks off.

— Team Astra

Hey everyone 👋

Short, focused release this time. We shaved a quiet delay off every admin and frontend page load, cleaned up a few Customizer and accessibility rough edges, and closed a draft-privacy gap that could expose private post titles.

Let’s get into it.

🚀 Improved

• No more waiting on a loopback that never comes. The theme used to fire off a blocking WP-Cron loopback request on every admin and frontend page load. On sites that can’t reach their own URL — local setups, strict firewalls, hosts with reverse-proxy quirks — that meant a quiet delay on every page. We’ve dropped the blocking call, so pages load clean.

🐛 Squashed

• Resetting a header or footer border color actually resets it now. Hitting reset on a border or separator color in the Customizer used to save it as empty — which meant the border quietly vanished after publishing. It now resets to the intended default so the border stays visible.
• Screen reader cart counts read like English again. The header cart link now reads “1 item” instead of “1 items” when there’s a single product in the cart. The label is also properly translatable now, so it works correctly in every locale.
• Live preview edit icons line up on RTL sites. Customizer live preview edit icons and section outlines were slightly misaligned on right-to-left layouts. Fixed.

🔒 Secured

• Contributors can no longer peek at other people’s drafts. The post meta abilities system had a gap where a Contributor could read the titles and Astra layout settings of drafts and private posts belonging to other users. Tightened up — those stay private now.

That’s it. Update, enjoy slightly snappier page loads, and ping us if anything feels off.

— Team Astra

Hey everyone 👋

This release leans into security. We tightened up Modern Checkout, Site Builder, and Page Headers, and refreshed the bundled sanitizer library. On top of that, custom layouts got a lot more flexible, the Mega Menu is friendlier for screen readers, and a handful of WooCommerce and Customizer annoyances are gone.

Let’s get into it.

✨ What’s new

• One layout, placed on many hooks. Custom layouts built with the Hooks layout can now sit on several predefined and custom hooks at once.
• What that means for you:
  • No more duplicating the same layout just to show it in two places.
  • Build your content once, then point it wherever it needs to appear.
  • Fewer layouts to manage as your site grows.
• Learn how it works (https://wpastra.com/docs/custom-layout-hooks/)

🔧 Better than before

• Sticky Logo Width now works with the Shrink effect. You can set exactly how small your logo gets when the header shrinks on scroll.
• The Mega Menu is easier to navigate. Submenu toggle arrows now announce their menu item to screen readers, and Disable Link mega menus open on click.
• Modern Checkout fields look cleaner. Fields are a touch taller, and the Country and State dropdowns line up and show their labels like every other field.
• Rollback is clearer when there’s nothing to roll back to. The dropdown stays visible but inactive, with a tooltip explaining why.
• Better YITH Pre-Order compatibility. Out-of-stock products offered as pre-orders now add to the cart with Slide In Cart, Redirect to Cart/Checkout, and Quick View.

🐛 Squashed

• Slide In Cart no longer freezes the page. Adding a product with the Single Product Slide In Cart action used to lock scrolling when the header Cart Click Action was set to Cart Page. Fixed.
• Grouped products with large IDs add to cart again. They were silently failing with AJAX actions like Slide In Cart. Gone.
• The sticky logo resizes smoothly. With the Shrink effect on, the logo now scales in step with the rest of the header instead of snapping.
• Live preview keeps up with font changes. Blog and archive post titles now update in the Customizer preview the moment you switch the Body or Headings font.
• Complex image URLs load fully. Page Header background images with more than one query parameter, like CDN or signed URLs, now keep all their parameters.

🔒 Security

• Comments and previous posts are locked down. Comments shown through Custom Layouts no longer run shortcodes, and Auto Load Previous Post only pulls pages from your own site. (Props to savphill / Patchstack.)
• Modern Checkout logins stay secure on HTTPS. Session cookies set when logging in from the Modern Checkout page are now marked secure.
• The checkout email check gives nothing away. It no longer hints at whether an account exists when Modern Checkout isn’t in use, or when checkout login and account creation are turned off.
• Custom layout shortcodes respect permissions. The shortcode only renders layouts a visitor is allowed to see, and code editor snippets can no longer be changed through custom fields.
• Page Headers are admin-only now. Only administrators can manage them, and their color, size, and image settings are validated before use. Your existing Page Headers keep working.
• Updated the bundled sanitizer library. DOMPurify moved to 3.4.17, picking up upstream fixes for several HTML sanitization bypasses (CVE-2026-0540).

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one’s all about polish. We tracked down a mix of annoyances across WooCommerce, menus, the Customizer, and accessibility, including one that could cut a page off mid-load. Nothing you have to relearn. Just things working the way they should.

Let’s get into it.

🐛 Squashed

• Slide In Cart now opens when your header cart points to the Cart page. Adding a product from the shop, an archive, or any product list wasn’t triggering the Slide In Cart if the header Cart Click Action was set to “Cart Page.” It opens every time now.
• A bad menu add-on can no longer take your whole page down. If a plugin or custom walker passed the wrong kind of value to the menu link filter, it threw a fatal error that cut the page off halfway through loading. That path is guarded now, so the page keeps rendering.
• Submenu toggles finally make sense to screen readers. Expandable menu items now announce which item they control and whether they’re open or closed. As a bonus, anything added after a menu link (like Mega Menu content) is left untouched instead of getting rewritten.
• Archive banner text is translatable again in WPML. Custom titles and descriptions for your Blog and post-type archives, WooCommerce catalog, EDD, and SureCart pages now show up in WPML String Translation.
• Live Search results look right on phones and tablets. On right-to-left sites, the results dropdown was rendering as a squeezed, broken list on archive pages with pagination. Fixed.
• The Posts page editor only shows settings that actually apply. Container, Sidebar, and Advanced Settings no longer appear when you’re editing your blog’s Posts page, since they don’t affect the listing anyway.
• Setting Body font back to Default shows the real default font. The live preview was falling back to a serif font instead of your system default. Now the preview matches what visitors see.
• Closing the Slide In Cart with Esc behaves properly. Pressing Esc used to throw a console error. Now it closes the cart cleanly and sends focus back to the cart icon, exactly where keyboard users expect it.

We think you’ll like this one. Update when you’re ready.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

Astra’s Global Palette has always given you nine colors to work with. Now you can add your own on top of those, give them real names, and use them everywhere you already pick colors. We also closed three security issues and smoothed out a few things for WooCommerce and Easy Digital Downloads stores.

Let’s get into it.

✨ What’s new

• Your own named colors in the Global Palette
  • There’s a new + button under Global > Colors. Click it and add a color that’s yours, on top of the nine Astra ships.

• What that means for you:
  • Name your colors something you’ll actually recognise, like “Brand Teal” or “Footer Grey”, instead of hunting for a hex code every time
  • They show up in the block editor, in Elementor, and in every Astra color picker, so there’s one list of colors everywhere
  • Change a color once and everything using it updates across the site
  • Add up to nine of your own. Remove one and its value is kept, so adding it back later restores exactly what you had

→ Learn how it works

🔧 Better than before

• WooCommerce shops do less work on every page load. Astra was sending the same cart refresh request twice, once on page load and again after add to cart. The duplicates are gone, so there’s less load on your server, especially on busy stores.

🐛 Squashed

• Live Search no longer trusts what’s in a post title. A carefully crafted title could run script in a visitor’s browser when it appeared in search results. Squashed.
• Background settings can’t leak into your stylesheet. Page and content background values saved by someone with limited editing access could inject their own rules into the front-end CSS. They’re sanitized properly now.
• Author avatars handle odd post titles safely. On blog and archive pages, markup inside a post title could break out of the avatar’s alt text. Gone.
• No more blank gap on Easy Digital Downloads pages. On a fresh install, single download pages rendered an empty sidebar-width space until you opened the download and saved its Sidebar Layout once. Fixed.
• Anchor links stay shareable when Smooth Scroll is on. With “Smooth Scroll to ID” enabled, clicking a section link scrolled you to the right place but left the URL alone, so the link you copied went nowhere. The #hash now updates after the scroll, and reloading lands you back in the same spot.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is almost entirely for store owners. Your cart drawer opens the moment you add a product, your checkout stops forgetting things customers already typed, and product galleries no longer show a thumbnail that was never meant to be there. Two fixes outside WooCommerce round it out.

Let’s get into it.

🔧 Better than before

• The Slide In Cart opens the instant you add a product. Astra was sending the same cart refresh request twice on every add-to-cart. One of them is gone, so the drawer slides open right away instead of waiting on a duplicate round trip.

🐛 Squashed

• Product galleries no longer show a stray thumbnail. When a product used the same image for its main photo and its gallery, the Vertical Slider and Horizontal Slider layouts rendered a misplaced thumbnail strip beside it. Those products now show a single image, matching how WooCommerce 11.1 handles it.
• Saved checkout details come back the way customers left them. A third-party checkout field with no name could quietly stop the whole restore, and the State field was dropped whenever a customer switched country. Both fixed.
• Checkout data no longer lingers in the browser. With persistent checkout form data switched on, saved details sat in browser storage indefinitely. They are now cleared once the order completes.
• Keyboard navigation through the Mega Menu is quiet again. Focusing a menu link with a keyboard or screen reader threw a console error when the regular Menu component was placed in a mobile header row. Gone.
• The Events Calendar archive lays out correctly. Event items were squeezed into the wrong width on the archive page.

Update when you get a chance.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is pure repair work. Two security holes are closed, scheduled Customizer changes actually go live again, and a run of layout and styling bugs are gone. Nothing new to learn here. Just things behaving the way they always should have.

Let’s get into it.

🔐 Security

• Stored cross-site scripting in the Header Builder account element. The link’s rel value was written into the page as an unquoted HTML attribute, which left room for injected markup to break out and run. Closed.
• Live search could surface post types you never enabled. The search request pulled from post types beyond the ones switched on in the Customizer, so content you had deliberately kept out of search could still come back in results. It now queries only what you’ve enabled.

🐛 Squashed

• Scheduled Customizer changes now actually publish. Scheduling a design change used to fail with a fatal error when WordPress went to apply it in the background. Worse, on setups where it didn’t error outright, the scheduled Astra settings were quietly dropped, and the site just carried on with the old design. Both halves are fixed. Your scheduled change publishes, and it takes effect.
• Dropdown arrows sit back on the same line in Firefox. On some older sites, the top-level arrow dropped onto its own row underneath the menu item. That was a regression from the bigger tap targets added in 4.13.11. Fixed.
• Buttons with no link no longer pretend to be clickable. A Header or Footer Builder button with an empty URL still rendered as a link, hand cursor and all, so visitors clicked something that did nothing. It’s now plain text until you give it a URL.
• Breadcrumb line height works with every breadcrumb source. The setting was being ignored in favour of a fixed default, including when Yoast or Rank Math supplied the breadcrumbs. Your value now applies on the front end.
• The typography dropdown stops collapsing on imported templates. If a template you imported left the line height unit blank, the panel folded up and took Line Height and Letter Spacing with it. Both are reachable again.
• RTL styling is back on Dokan, WooCommerce Cart and Checkout blocks, and LifterLMS. Three right-to-left compatibility stylesheets were returning a 404, so those pages silently lost Astra’s layout fixes. The missing files now ship.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra