In `@inc/apis/class-settings-endpoint.php`:
- Around line 258-270: The loop that calls wu_save_setting() with raw $value
should sanitize/validate via the Field API first: implement a helper (e.g.
sanitize_setting_value(string $key, $value)) that iterates
Settings::get_instance()->get_sections(), finds the field definition for $key,
constructs a \WP_Ultimo\UI\Field($key, $field_def), calls
$field->set_value($value) and returns $field->get_value(); then replace the
direct calls to wu_save_setting($key, $value) in the foreach over
$filtered_settings (and the similar persistence block later) to call $sanitized
= sanitize_setting_value($key, $value) and either pass $sanitized to
wu_save_setting or skip/reject unknown keys (returning null) as appropriate.
- Around line 426-436: The maybe_log_api_call method currently logs raw request
bodies via $request->get_body() which can leak sensitive data; before building
the $payload (or before calling wp_json_encode) sanitize the body by removing or
replacing sensitive keys (e.g., "password", "token", "authorization", "api_key",
"credit_card", "ssn") or omit the body entirely, e.g., call a helper like
redact_request_body($request->get_body()) and use that redacted result for the
'body_params' value so wp_json_encode(wu_log_add(...)) never receives plaintext
secrets; update maybe_log_api_call to perform this redaction and ensure
get_body()/body_params references the sanitized output.

In `@inc/class-settings.php`:
- Around line 711-720: The privacy-policy link in the description passed to
add_field for 'enable_error_reporting' lacks rel="noopener noreferrer" and the
URL isn't escaped; update the sprintf call building the description so the <a
href="%s" ...> uses esc_url( 'https://ultimatemultisite.com/privacy-policy/' )
and add rel="noopener noreferrer" to the anchor (i.e., modify the description
string for add_field('general','enable_error_reporting', ...) to include
rel="noopener noreferrer" and wrap the URL with esc_url()).

In `@readme.txt`:
- Around line 243-249: The changelog contains duplicate "Version [2.4.10]"
entries (the headers "Version [2.4.10]" and the block dated "2026-XX-XX"); merge
the two blocks into a single 2.4.10 entry combining both bullet points, and
replace the placeholder date "2026-XX-XX" with a concrete release date (e.g.,
"2026-01-25") or label the entry "Unreleased" if it isn't finalized; update the
single "Version [2.4.10]" header and remove the redundant header/block so only
one consolidated 2.4.10 section remains.

In `@inc/admin-pages/class-discount-code-edit-admin-page.php`:
- Around line 532-588: get_available_billing_periods currently skips products
based solely on $product->is_recurring(), which misses PWYW products with
pwyw_recurring_mode == 'force_recurring'; update the recurrence check in
get_available_billing_periods to treat a product as recurring if
$product->is_recurring() OR ($product->get_pwyw_recurring_mode() ===
'force_recurring') (or the equivalent accessor/name used on the Product class),
then continue using $product->get_duration(), $product->get_duration_unit(),
get_price_variations(), and
Discount_Code::get_billing_period_key/parse_billing_period_key as before so PWYW
forced-recurring products are included in the $periods list and sorting.

In `@inc/admin-pages/class-membership-list-admin-page.php`:
- Around line 233-237: The billing_period parsing accepts untrusted input:
ensure $duration is clamped to >=1 and $duration_unit is validated against a
whitelist before using it to build the cart; specifically, after parsing
$billing_period (the code that sets $billing_parts, $duration and
$duration_unit) replace the loose values with a sanitized $duration = max(1,
absint($billing_parts[0] ?? 1)) and $duration_unit only set if in an allowed
array (e.g. ['day','week','month','year']) otherwise default to 'month' so
invalid units or zero durations cannot create bad variations in the cart.

In `@inc/checkout/class-checkout.php`:
- Around line 1621-1633: process_order() builds the cart params without
including the PWYW fields so submitted custom amounts are lost; update the cart
construction inside process_order() to read the same keys as create_order()—use
$this->request_or_session('custom_amounts', []) and
$this->request_or_session('pwyw_recurring', []) (and propagate them into the
'custom_amounts' and 'pwyw_recurring' keys of the cart array) so the cart passed
to order creation retains the PWYW values.

In `@inc/sso/class-magic-link.php`:
- Around line 167-190: Before generating a token in
generate_cross_network_magic_link, validate that the user actually has access to
the target site and that the redirect URL is safe: call
verify_user_site_access($user_id, $site_id) (or equivalent membership check) and
return false if it fails, then if $redirect_to is provided validate it with
filter_var($redirect_to, FILTER_VALIDATE_URL) and ensure its host matches the
parsed host of $site_url (using parse_url) to prevent mismatched/remote
redirects; only after these checks succeed proceed to generate_token() and
persist $token_data so you do not consume tokens for invalid requests.

In `@views/legacy/signup/steps/step-domain-url-preview.php`:
- Around line 38-40: The subdirectory branch uses a hardcoded 'yoursite'
fallback in the sprintf for the element with id "wu-your-site" (v-html="site_url
? site_url : 'yoursite'"); replace that literal with the translatable
$dynamic_part so both branches use the same localized fallback: update the
sprintf format and the v-html fallback to reference $dynamic_part (escaped via
esc_html) rather than the hardcoded string, keeping the same element ids
"wu-your-site" and "wu-site-domain" and preserving proper escaping and quoting.

In `@inc/admin-pages/class-product-edit-admin-page.php`:
- Around line 384-411: The duration and duration_unit inputs inside
pwyw_duration_group are being suppressed from form submission by setting
'v-bind:name' => '""'; remove that attribute for both the 'duration' and
'duration_unit' entries so they behave like the same fields in amount_group
(i.e., allow them to retain their normal name binding and submit their values
when PWYW mode hides amount_group); locate the array keys 'duration' and
'duration_unit' in the pwyw_duration_group definition and delete the
'v-bind:name' => '""' lines (leave other html_attr entries like 'v-model'
intact).

In @.wp-env.json:
- Around line 26-27: The .wp-env.json test environment includes a non-existent
addon path "../addons/ultimate-multisite-woocommerce" (the array entries "." and
"../addons/ultimate-multisite-woocommerce"); remove the
"../addons/ultimate-multisite-woocommerce" entry from the list if the addon is
not required for tests, or add/restore the missing directory at that relative
path (ensuring the plugin contains valid plugin files) so wp-env can bootstrap
successfully; update the array in .wp-env.json accordingly and rerun the test
environment to confirm resolution.

In `@DEVELOPER-DOCUMENTATION.md`:
- Around line 1-3: The DEVELOPER-DOCUMENTATION.md was removed and replaced with
only an external link, which reduces offline availability and versioned context;
restore essential in-repo developer guidance by either (a) re-adding core
sections back into DEVELOPER-DOCUMENTATION.md (setup, architecture overview,
contribution guidelines, key workflows) and keep the external link as
“canonical” reference, or (b) consolidate those essential sections into
README.md under a “Developer Documentation” header and include the external link
and a note that it is the full canonical source; ensure the file(s) reference
the same headings and examples as the external site so reviewers have immediate,
versioned docs in-repo.

In `@inc/berlindb-dynamic-hooks.php`:
- Around line 1-17: Delete the stale duplicate generated file
berlindb-dynamic-hooks.php (the shorter 1674-line version) and leave only the
canonical generator output produced by generate-berlindb-hooks.php in the
documentation output location; remove any references to the removed file from
the repo so the generator’s documentation file is the single source of truth.

In `@lang/ultimate-multisite.pot`:
- Around line 8917-8927: The telemetry disclosure string (msgid "Allow Ultimate
Multisite to collect anonymous usage data..." used in inc/class-settings.php and
views/settings/widget-settings-body.php) is incomplete; either update that
message to enumerate all actually collected fields (MySQL version, server
software, timezone, locale, SSL status, active add-ons,
customer/product/payment/domain counts, memory limits, error file paths and
sanitized stack traces, etc.) and clarify what "error logs" contains, or change
the collection logic in the code paths that assemble telemetry to remove any
fields not currently disclosed; adjust the text in the class-settings.php/views
strings to precisely match the chosen scope and ensure the error-reporting
wording explicitly states inclusion of file paths and sanitized stack traces.