What’s New?

Changelog

0.49.1 (13 October 2026)

• Change: The date fields in the drop-down filter and on the Add Sermon page use the browser's own date picker, instead of a bundled script from 2006 and its stylesheet.
• Change: The Add Sermon page no longer loads a bundled Base64 script to show a sermon's embed code.
• Change: New screenshots for the readme.

0.49.0 (13 October 2026)

The search results and sermon page templates no longer run as PHP.

• Change: The search results and sermon page templates are read when a page is shown, instead of being turned into PHP when saved and run with eval(). They print the same as before.
• Change: A template tag where it can't work (outside its loop, after its loop has ended, or in a loop that is never closed) is left out, instead of printing PHP warnings, the loop's last value or stopping the page with an error. Those who can edit the templates see why, with a link to a new section of the Help page, and the Templates page lists them.
• Bug fix: [file], [file_with_download] and [embed] outside their loops show the sermon's first file or embed, as the template tag help has always said; they printed a broken link, or the last one shown.
• Bug fix: The sermon list printed PHP deprecation notices for sermons without a series.
• Bug fix: A backslash in a sermon's title or tags, or in a preacher's, series' or service's name, was removed from sermon lists, sermon pages and the recent sermons widget.
• Bug fix: sb_display_sermons() with url_only printed PHP warnings when no sermon matched.
• Bug fix: Saving the templates turned an attribute in single quotes, such as data-x='y', into data-x="'y'".
• Development: The functions in template-tags.php that print parts of a sermon (sb_print_preacher_link(), sb_formatted_date(), sb_print_preacher_description() and the rest) take a SermonBrowser\Sermon instead of a database row, sb_print_code() takes the embed's HTML instead of base64, and sb_get_sermons(), sb_get_single_sermon(), sb_get_stuff(), sb_get_books(), sb_print_bible_passage(), sb_add_bible_text() and sb_compile_template() are gone (SermonBrowser\Passage::reference() formats a passage). sb_display_sermons() is unchanged.

0.48.0 (13 October 2026)

Sermons are read through one storage layer, the first step towards storing them as WordPress posts.

• Bug fix: The page of a sermon whose passages were saved empty by an old version (stored as null) stopped with a fatal error on PHP 8.
• Bug fix: [sermons id="latest"] printed PHP warnings when no sermon matched its filters.
• Change: Sermon lists sort only by date, title, preacher and passage, the orders the filters offer; links that ask for another column (such as sortby=s.name) sort by date.
• Change: The tag cloud lists tags used equally often in alphabetical order, and the most popular widget lists sermons downloaded equally often newest first, and series and preachers that rank equally by their latest sermon; these followed the database's order before.
• Change: Filtering by date leaves out sermons whose date is unknown, and the one-click filter's dates no longer list them under 1970.
• Development: Sermons are read through a repository (SermonBrowser\Sermon_Repository) that returns SermonBrowser\Sermon objects, instead of queries spread through the plugin, with PHPUnit contract tests that any storage must pass.

0.47.1 (13 October 2026)

Restores sorting by preacher and passage, finishes escaping the admin pages, and moves the plugin's help from sermonbrowser.com into the plugin.

• Bug fix: The drop-down filter can sort by preacher and by passage again, which had sorted by date since 0.45.12. Passages sort in Bible order of each sermon's first passage, with sermons that have none at the end; a preacher's sermons are listed newest first. Old links that sort by p.name or b.id still work.
• Bug fix: After uploading or importing a file on the Files page with import options set, the Add Sermon page opened without the file's details, because the link to it was escaped for HTML inside a script.
• Bug fix: Series, preacher and service names with HTML entities (such as an en dash saved as –) showed the entity in the admin pages' drop-down lists.
• Bug fix: The Options page didn't show its error when the upload folder doesn't exist.
• Bug fix: Some of the dashboard's sermon statistics weren't translated.
• Change: The plugin's home is now on GitHub, until it is back on WordPress.org. The sermonbrowser.com site, its forum and its tutorials are no longer maintained, so the plugin no longer links to them: the "Powered by" link ([creditlink]), the podcast feed's generator and the plugin's home page point to GitHub, and the Help page and help tabs now hold the help themselves, including a description of every template tag. Report problems on GitHub.
• Change: Removed the global constants IS_MU (use WordPress's is_multisite()), SB_PLUGIN_DIR and SB_WP_CONTENT_DIR, and support for installing the plugin in mu-plugins, which didn't work: its URLs were wrong.
• Documentation: The FAQ and installation instructions are brought up to date, and [sermon_description] and [most_popular] are documented. The changelog before 0.46.0 is in CHANGELOG.md on GitHub.
• Hardening: The admin pages escape their output where it is printed, use prepared statements for every query, and sanitise request values where they are read, as the rest of the plugin has since 0.46.1. Plugin Check now reports nothing in the plugin except the templates' eval().

0.47.0 (13 October 2026)

The plugin's code is reorganised, to prepare for moving sermons to a custom post type. Output is unchanged except where noted below.

• Change: The code is split into classes (namespace SermonBrowser, in sb-includes/classes) and files by purpose: functions.php, sermons.php and template-tags.php (which was frontend.php). podcast.php and style.php are gone. sb_display_sermons() and the functions templates use are unchanged, but themes or plugins calling other internal functions (such as sb_shortcode(), sb_hijack(), sb_add_headers() or the widget functions) need updating.
• Change: Removed functions nothing called: display_sermons() (deprecated since 0.41), sb_first_mp3(), sb_get_bible_books(), sb_display_front_end() and sb_default_excerpt_template().
• Change: The drop-down filter no longer offers sorting by preacher or passage. Neither has worked since 0.45.12; both sorted by date.
• Bug fix: The default stylesheet's podcast box background pointed to the wrong folder. Saved stylesheets are unchanged; resetting to the default fixes it.
• Documentation: The FAQ on ESV text describes the API key on the Options page.

0.46.1 (13 October 2026)

Preparation for reopening on WordPress.org, from the results of its Plugin Check.

• Security: With SAVEQUERIES on, every page printed every database query (with its values) in an HTML comment that visitors could see. That output is gone.
• Bug fix: NET Bible text ([nettext]) showed only the heading, because bible.org's old endpoint stopped working. It uses the current one.
• Bug fix: Searching the sermon list for a title with an apostrophe (Paul's) found nothing.
• Bug fix: Editing a page with the [sermons] shortcode in the block editor caused a fatal error.
• Bug fix: The bundled translations weren't loaded on multisite networks.
• Change: The KJV, ASV, YLT, WEB, AKJV, HNV, Reina Valera, Cornilescu and Synodal texts came from a service that no longer exists, so they already showed nothing. Their template tags now print nothing without trying, and [esvtext] without an API key shows nothing instead of falling back to the KJV.
• Change: New installations no longer put a "Powered by Sermon Browser" link in the templates. Existing templates are unchanged.
• Change: Removed an admin page that loaded remote content, and the notices shown at random after saving a sermon.
• Change: The plugin no longer changes PHP settings (memory limit, time limit and upload sizes) on every request.
• Change: Updates from WordPress.org are allowed again (the Update URI header is gone), ready for the plugin to be reopened there.
• Hardening: Output on the front end, in the feed and in AJAX responses is escaped where it is printed, every query uses prepared statements, request values are sanitised where they are read, and uploads, deleting and renaming files use WordPress's functions. The readme lists the external services the plugin uses.

0.46.0 (12 October 2026)

Security release. The plugin was closed on WordPress.org in February 2022 for CVE-2022-0499; this version fixes that and the other problems found in a full review. Update from WordPress.org is disabled (Update URI), so install it by uploading a zip.

• Security: AJAX requests from the admin pages had no authentication, so anyone could add, rename or delete preachers, series and services, and rename or delete uploaded files. They now need a logged-in user, a nonce and the right capability.
• Security (CVE-2022-0499): Uploads (Files page, URL import, Add Sermon, preacher images) had no nonce and no file type check, so a forged request could upload and run PHP. Uploads now need a nonce and only accept file types WordPress allows. The upload folder gets an .htaccess that refuses scripts, and must be inside the WordPress folder.
• Security: ?download&url= and ?show&url= worked as an open proxy and open redirect for any URL. They now only serve URLs attached to a sermon.
• Hardening: Queries that built SQL from request data or MP3 ID3 tags now use prepared statements. These weren't exploitable in 0.45.22, because the values were slashed, cast to integers or HTML-encoded first, but they relied on that.
• Security: Output is escaped throughout (front end, widgets, podcast feed, admin), templates can no longer contain PHP, embed code can no longer use iframe srcdoc, and Bible text from remote APIs is filtered.
• Bug fix: Works on PHP 8: the sermon list was always empty, and saving a sermon without a Bible passage or showing the popular sermons widget caused fatal errors.
• Bug fix: No PHP errors, warnings, notices or deprecations on PHP 7.4 to 8.5 (tested on each), including for sermons without a Bible passage, missing files and new widgets. Translations are no longer loaded before init, which WordPress 6.7 and later warn about.
• Bug fix: The popular sermons widget showed an empty entry in each list when a file wasn't attached to a sermon.

Earlier versions

The changes in 0.45.22 and earlier are in CHANGELOG.md on GitHub.