Jetpack 3.9.2 is now available for download. We’ve added two security updates as well as several bug fixes and enhancements. We recommend that you update your sites to the latest version as soon as possible.

Security updates

• Beautiful Math: there was a potential XSS vulnerability when parsing LaTeX markup within HTML elements. The issue was discovered and fixed by our security team.
• Contact Form: private site credentials could be saved in plain text in WordPress’ postmeta table when said credentials were set to be stored in Environment variables. The issue was discovered by Oliver Liu.

Other minor fixes

This release also includes other bug fixes:

• Nova Menus: fixed notices as well as issues when adding menu items in bulk.
• Publicize: Authors can now access their Publicize settings again.
• Publicize: fixed problems for Australian and Canadian English sites using Publicize to send their posts to Facebook.
• Embeds: it is now possible to embed Instagram posts using a www in the URL.
• Widget Visibility: fixed an issue appearing when a page title matched an existing page ID.
• And many more updates, listed in the changelog.

Enhancements

We added 2 new oEmbed providers, Codepen and Sketchfab. Just paste a URL in your post editor, and enjoy! Here’s a Codepen example:

We also added new filters to allow you to customize the Contact Info widget, define custom patterns to be ignored by Jetpack Markdown, or change the heading of the Related Posts.

Finally, we created a

Staging Mode

Do you use a backup / cloning plugin to clone your production site to a staging environment? Starting with Jetpack 3.9.2, you can use a constant or a filter to flag a site as “Staging site”, thus avoid conflicts and synchronization issues with Jetpack.

Thanks to everyone who contributed to 3.9.2:

Alex Kirk, Allen Snook, Andrew Duthie, Barry Abrahamson, Ben Lowery, Bob Ralian, Brandon Kraft, Chris Rosser, Christopher Finke, Claus Colloseus, Crystal Barton, Dan Walmsley, Daryl L. L. Houston, Derek Smart, Elio Rivero, Enej Bajgoric, Eric Binnion, Gregory Cornelius, Igor Zinovyev, James Nylen, Jenia Laszlo, Jeremy Herve, Joey Kudish, Jorge Bernal, Justin Shreve, Kat Hagan, Konstantin Kovshenin, Lance Willett, Mahangu Weerasinghe, Marcus Kazmierczak, Matt Wiebe, Miguel Lezama, Mike Adams, Mo Jangda, Payton Swick, Rocco Tripaldi, Sam Hotchkiss, Sendhil Panchadsaram, Stephen Edgar, Timmy Crawford, and Veselin Nikolov.