From 170b9c2fc70501234dd3851648c32a168c44680c Mon Sep 17 00:00:00 2001
From: Yakir Sitbon <kingyes1@gmail.com>
Date: Wed, 19 Aug 2026 19:09:34 +0300
Subject: [PATCH 1/4] Tweak: Added more escaping

---
 .github/workflows/php-coding-standards.yml    |  2 +-
 aryo-activity-log.php                         | 20 +++---
 classes/class-aal-activity-log-list-table.php | 66 +++++++++++--------
 classes/class-aal-admin-ui.php                |  2 +-
 classes/class-aal-maintenance.php             |  2 +-
 classes/class-aal-notifications.php           |  2 +-
 classes/class-aal-settings.php                | 28 ++++----
 .../abstract-class-aal-notification-base.php  |  2 +-
 ruleset.xml                                   |  8 ++-
 9 files changed, 76 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/php-coding-standards.yml b/.github/workflows/php-coding-standards.yml
index 3eae26c..d6bf8e0 100644
--- a/.github/workflows/php-coding-standards.yml
+++ b/.github/workflows/php-coding-standards.yml
@@ -47,5 +47,5 @@ jobs:
         run: |
           export PATH=$HOME/.composer/vendor/bin:$PATH
           composer run lint -- --report=checkstyle
-          # Also show warnings as PR annotations (non-blocking)
+          # Errors (including EscapeOutput) fail the job; remaining Security sniffs stay warnings
           vendor/bin/phpcs --standard=./ruleset.xml --extensions=php --error-severity=0 . --report=checkstyle || true
diff --git a/aryo-activity-log.php b/aryo-activity-log.php
index e5b7660..6b98b92 100644
--- a/aryo-activity-log.php
+++ b/aryo-activity-log.php
@@ -112,10 +112,12 @@ protected function __construct() {
 	public function __clone() {
 		_doing_it_wrong(
 			__FUNCTION__,
-			sprintf(
-				/* translators: %s: Class name. */
-				__( 'Cloning instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
-				get_class( $this )
+			esc_html(
+				sprintf(
+					/* translators: %s: Class name. */
+					__( 'Cloning instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
+					get_class( $this )
+				)
 			),
 			'2.0.7'
 		);
@@ -130,10 +132,12 @@ public function __clone() {
 	public function __wakeup() {
 		_doing_it_wrong(
 			__FUNCTION__,
-			sprintf(
-				/* translators: %s: Class name. */
-				__( 'Unserializing instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
-				get_class( $this )
+			esc_html(
+				sprintf(
+					/* translators: %s: Class name. */
+					__( 'Unserializing instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
+					get_class( $this )
+				)
 			),
 			'2.0.7'
 		);
diff --git a/classes/class-aal-activity-log-list-table.php b/classes/class-aal-activity-log-list-table.php
index 86d94c8..b42a524 100644
--- a/classes/class-aal-activity-log-list-table.php
+++ b/classes/class-aal-activity-log-list-table.php
@@ -222,9 +222,9 @@ private function maybe_promotion_row( $object_type ) {
 		printf(
 			'<tr class="aal-table-promotion-row" data-promotion-id="%s" data-nonce="%s"><td colspan="' . count( $this->get_columns() ) . '"><div class="aal-table-promotion-inner">%s%s</div></td></tr>',
 			esc_attr( $object_type ),
-			wp_create_nonce( 'aal_promotion' ),
-			$promotion_html,
-			$dismiss_button
+			esc_attr( wp_create_nonce( 'aal_promotion' ) ),
+			$promotion_html, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped in get_promotion_html_by_object_type().
+			$dismiss_button // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- label escaped with esc_html__().
 		);
 	}
 
@@ -558,9 +558,21 @@ public function extra_tablenav_footer() {
 				<?php
 				// Is result filtering enabled?
 				if ( array_key_exists( 'aal-filter', $_GET ) ) {
-					echo sprintf( esc_html__( 'Export filtered records as %s', 'aryo-activity-log' ), $action_title );
+					echo esc_html(
+						sprintf(
+							/* translators: %s: export format title. */
+							__( 'Export filtered records as %s', 'aryo-activity-log' ),
+							$action_title
+						)
+					);
 				} else {
-					echo sprintf( esc_html__( 'Export as %s', 'aryo-activity-log' ), $action_title );
+					echo esc_html(
+						sprintf(
+							/* translators: %s: export format title. */
+							__( 'Export as %s', 'aryo-activity-log' ),
+							$action_title
+						)
+					);
 				}
 				?>
 			</button>
@@ -614,7 +626,7 @@ public function extra_tablenav( $which ) {
 			);
 			echo '<select name="dateshow" id="hs-filter-date">';
 			foreach ( $date_options as $key => $value )
-				printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['dateshow'], $key, false ), $value );
+				printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['dateshow'], $key, false ), esc_html( $value ) );
 			echo '</select>';
 
 			submit_button( __( 'Filter', 'aryo-activity-log' ), 'button', 'aal-filter', false, array( 'id' => 'activity-query-submit' ) );
@@ -631,9 +643,9 @@ public function extra_tablenav( $which ) {
 
 			if ( ! empty( $output ) ) {
 				echo '<select name="capshow" id="hs-filter-capshow">';
-				printf( '<option value="">%s</option>', __( 'All Roles', 'aryo-activity-log' ) );
+				printf( '<option value="">%s</option>', esc_html__( 'All Roles', 'aryo-activity-log' ) );
 				foreach ( $output as $key => $value ) {
-					printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['capshow'], $key, false ), $value );
+					printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['capshow'], $key, false ), esc_html( $value ) );
 				}
 				echo '</select>';
 			}
@@ -655,9 +667,9 @@ public function extra_tablenav( $which ) {
 
 			if ( ! empty( $output ) ) {
 				echo '<select name="usershow" id="hs-filter-usershow">';
-				printf( '<option value="">%s</option>', __( 'All Users', 'aryo-activity-log' ) );
+				printf( '<option value="">%s</option>', esc_html__( 'All Users', 'aryo-activity-log' ) );
 				foreach ( $output as $key => $value ) {
-					printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['usershow'], $key, false ), $value );
+					printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['usershow'], $key, false ), esc_html( $value ) );
 				}
 				echo '</select>';
 			}
@@ -668,19 +680,16 @@ public function extra_tablenav( $which ) {
 				$_REQUEST['typeshow'] = '';
 			}
 
-			$output = array();
+			echo '<select name="typeshow" id="hs-filter-typeshow">';
+			printf( '<option value="">%s</option>', esc_html__( 'All Topics', 'aryo-activity-log' ) );
 			foreach ( $this->data_types as $object_type ) {
-				$output[] = sprintf(
+				printf(
 					'<option value="%s"%s>%s</option>',
-					$object_type,
+					esc_attr( $object_type ),
 					selected( $_REQUEST['typeshow'], $object_type, false ),
-					__( $object_type, 'aryo-activity-log' )
+					esc_html( $object_type )
 				);
 			}
-
-			echo '<select name="typeshow" id="hs-filter-typeshow">';
-			printf( '<option value="">%s</option>', __( 'All Topics', 'aryo-activity-log' ) );
-			echo implode( '', $output );
 			echo '</select>';
 		}
 
@@ -697,13 +706,16 @@ public function extra_tablenav( $which ) {
 			if ( ! isset( $_REQUEST['showaction'] ) )
 				$_REQUEST['showaction'] = '';
 
-			$output = array();
-			foreach ( $actions as $action )
-				$output[] = sprintf( '<option value="%s"%s>%s</option>', $action->action, selected( $_REQUEST['showaction'], $action->action, false ), $this->get_action_label( $action->action ) );
-
 			echo '<select name="showaction" id="hs-filter-showaction">';
-			printf( '<option value="">%s</option>', __( 'All Actions', 'aryo-activity-log' ) );
-			echo implode( '', $output );
+			printf( '<option value="">%s</option>', esc_html__( 'All Actions', 'aryo-activity-log' ) );
+			foreach ( $actions as $action ) {
+				printf(
+					'<option value="%s"%s>%s</option>',
+					esc_attr( $action->action ),
+					selected( $_REQUEST['showaction'], $action->action, false ),
+					esc_html( $this->get_action_label( $action->action ) )
+				);
+			}
 			echo '</select>';
 		}
 
@@ -740,7 +752,7 @@ public function extra_tablenav( $which ) {
 
 		foreach ( $filters as $filter ) {
 			if ( ! empty( $_REQUEST[ $filter ] ) ) {
-				echo '<a href="' . $this->get_filtered_link() . '" id="aal-reset-filter"><span class="dashicons dashicons-dismiss"></span>' . __( 'Reset Filters', 'aryo-activity-log' ) . '</a>';
+				echo '<a href="' . esc_url( $this->get_filtered_link() ) . '" id="aal-reset-filter"><span class="dashicons dashicons-dismiss"></span>' . esc_html__( 'Reset Filters', 'aryo-activity-log' ) . '</a>';
 				break;
 			}
 		}
@@ -881,8 +893,8 @@ public function search_box( $text, $input_id ) {
 		$input_id = $input_id . '-search-input';
 		?>
 		<p class="search-box">
-			<label class="screen-reader-text" for="<?php echo $input_id ?>"><?php echo $text; ?>:</label>
-			<input type="search" id="<?php echo $input_id ?>" name="s" value="<?php echo esc_attr( $search_data ); ?>" />
+			<label class="screen-reader-text" for="<?php echo esc_attr( $input_id ); ?>"><?php echo esc_html( $text ); ?>:</label>
+			<input type="search" id="<?php echo esc_attr( $input_id ); ?>" name="s" value="<?php echo esc_attr( $search_data ); ?>" />
 			<?php submit_button( $text, 'button', false, false, array('id' => 'search-submit') ); ?>
 		</p>
 	<?php
diff --git a/classes/class-aal-admin-ui.php b/classes/class-aal-admin-ui.php
index 42549bc..2b71127 100644
--- a/classes/class-aal-admin-ui.php
+++ b/classes/class-aal-admin-ui.php
@@ -23,7 +23,7 @@ public function activity_log_page_func() {
 		$this->get_list_table()->prepare_items();
 		?>
 		<div class="wrap">
-			<h1 class="aal-page-title"><?php _ex( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>
+			<h1 class="aal-page-title"><?php echo esc_html_x( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>
 
 			<form id="activity-filter" method="get">
 				<input type="hidden" name="page" value="<?php echo esc_attr( $_REQUEST['page'] ); ?>" />
diff --git a/classes/class-aal-maintenance.php b/classes/class-aal-maintenance.php
index 372c2d7..71bb51c 100644
--- a/classes/class-aal-maintenance.php
+++ b/classes/class-aal-maintenance.php
@@ -242,7 +242,7 @@ public static function upgrade_notice() {
 
 	public static function handle_manual_upgrade() {
 		if ( ! current_user_can( 'manage_options' ) ) {
-			wp_die( __( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
+			wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
 		}
 
 		check_admin_referer( 'aal_run_db_upgrade' );
diff --git a/classes/class-aal-notifications.php b/classes/class-aal-notifications.php
index 893be4f..0e98bed 100644
--- a/classes/class-aal-notifications.php
+++ b/classes/class-aal-notifications.php
@@ -296,7 +296,7 @@ public function load_handlers() {
 	 */
 	public function register_handler( $classname ) {
 		if ( ! class_exists( $classname ) ) {
-			trigger_error( __( 'The AAL notification handler you are trying to register does not exist.', 'aryo-activity-log' ) );
+			trigger_error( esc_html__( 'The AAL notification handler you are trying to register does not exist.', 'aryo-activity-log' ) );
 			return false;
 		}
 
diff --git a/classes/class-aal-settings.php b/classes/class-aal-settings.php
index 1e8bc7e..1b58e8d 100644
--- a/classes/class-aal-settings.php
+++ b/classes/class-aal-settings.php
@@ -276,7 +276,7 @@ private function menu_print_tabs() {
 		foreach ( $sections as $section_key => $section_caption ) {
 			$active = $current_section === $section_key ? 'nav-tab-active' : '';
 			$url = add_query_arg( 'aal_section', $section_key );
-			echo '<a class="nav-tab ' . $active . '" href="' . esc_url( $url ) . '">' . esc_html( $section_caption ) . '</a>';
+			echo '<a class="nav-tab ' . esc_attr( $active ) . '" href="' . esc_url( $url ) . '">' . esc_html( $section_caption ) . '</a>';
 		}
 	}
 
@@ -297,7 +297,7 @@ public function display_settings_page() {
 		<!-- Create a header in the default WordPress 'wrap' container -->
 		<div class="wrap">
 
-			<h1 class="aal-page-title"><?php _e( 'Activity Log Settings', 'aryo-activity-log' ); ?></h1>
+			<h1 class="aal-page-title"><?php esc_html_e( 'Activity Log Settings', 'aryo-activity-log' ); ?></h1>
 			<?php settings_errors(); ?>
 			<h2 class="nav-tab-wrapper"><?php $this->menu_print_tabs(); ?></h2>
 
@@ -316,7 +316,7 @@ public function display_settings_page() {
 	public function admin_notices() {
 		switch ( filter_input( INPUT_GET, 'message' ) ) {
 			case 'data_erased':
-				printf( '<div class="updated"><p>%s</p></div>', __( 'All activities have been successfully deleted.', 'aryo-activity-log' ) );
+				printf( '<div class="updated"><p>%s</p></div>', esc_html__( 'All activities have been successfully deleted.', 'aryo-activity-log' ) );
 				break;
 		}
 	}
@@ -327,7 +327,7 @@ public function admin_footer() {
 		<script type="text/javascript">
 			jQuery( document ).ready( function( $ ) {
 				$( '#aal-delete-log-activities' ).on( 'click', function( e ) {
-					if ( ! confirm( '<?php echo __( 'Attention: We are going to DELETE ALL ACTIVITIES from the database. Are you sure you want to do that?', 'aryo-activity-log' ); ?>' ) ) {
+					if ( ! confirm( '<?php echo esc_js( __( 'Attention: We are going to DELETE ALL ACTIVITIES from the database. Are you sure you want to do that?', 'aryo-activity-log' ) ); ?>' ) ) {
 						e.preventDefault();
 					}
 				} );
@@ -338,7 +338,7 @@ public function admin_footer() {
 
 	public function ajax_aal_reset_items() {
 		if ( ! check_ajax_referer( 'aal_reset_items', '_nonce', false ) || ! current_user_can( 'manage_options' ) ) {
-			wp_die( __( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
+			wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
 		}
 
 		AAL_Main::instance()->api->erase_all_items();
@@ -395,13 +395,13 @@ final class AAL_Settings_Fields {
 
 	public static function general_settings_section_header() {
 		?>
-		<p><?php _e( 'These are some basic settings for Activity Log.', 'aryo-activity-log' ); ?></p>
+		<p><?php esc_html_e( 'These are some basic settings for Activity Log.', 'aryo-activity-log' ); ?></p>
 		<?php
 	}
 
 	public static function email_notifications_section_header() {
 		?>
-		<p><?php _e( 'Serve yourself with custom-tailored notifications. First, define your conditions. Then, choose how the notifications will be sent.', 'aryo-activity-log' ); ?></p>
+		<p><?php esc_html_e( 'Serve yourself with custom-tailored notifications. First, define your conditions. Then, choose how the notifications will be sent.', 'aryo-activity-log' ); ?></p>
 		<?php
 	}
 
@@ -426,7 +426,7 @@ public static function text_field( $args ) {
 			return;
 
 		?>
-		<input type="text" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo implode( ' ', $args['classes'] ); ?>" />
+		<input type="text" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo esc_attr( implode( ' ', $args['classes'] ) ); ?>" />
 		<?php if ( ! empty( $desc ) ) : ?>
 		<p class="description"><?php echo wp_kses_post( $desc ); ?></p>
 		<?php endif;
@@ -446,7 +446,7 @@ public static function textarea_field( $args ) {
 			return;
 
 		?>
-		<textarea id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" class="<?php echo implode( ' ', $args['classes'] ); ?>" rows="<?php echo absint( $args['rows'] ); ?>" cols="<?php echo absint( $args['cols'] ); ?>"><?php echo esc_textarea( $value ); ?></textarea>
+		<textarea id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" class="<?php echo esc_attr( implode( ' ', $args['classes'] ) ); ?>" rows="<?php echo absint( $args['rows'] ); ?>" cols="<?php echo absint( $args['cols'] ); ?>"><?php echo esc_textarea( $value ); ?></textarea>
 
 		<?php if ( ! empty( $desc ) ) : ?>
 			<p class="description"><?php echo wp_kses_post( $desc ); ?></p>
@@ -467,7 +467,7 @@ public static function number_field( $args ) {
 			return;
 
 		?>
-		<input type="number" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo implode( ' ', $args['classes'] ); ?>" min="<?php echo esc_attr( $args['min'] ); ?>" step="<?php echo esc_attr( $args['step'] ); ?>" />
+		<input type="number" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo esc_attr( implode( ' ', $args['classes'] ) ); ?>" min="<?php echo esc_attr( $args['min'] ); ?>" step="<?php echo esc_attr( $args['step'] ); ?>" />
 		<?php if ( ! empty( $args['sub_desc'] ) ) echo wp_kses_post( $args['sub_desc'] ); ?>
 		<?php if ( ! empty( $args['desc'] ) ) : ?>
 			<p class="description"><?php echo wp_kses_post( $args['desc'] ); ?></p>
@@ -500,8 +500,8 @@ public static function yesno_field( $args ) {
 		extract( $args, EXTR_SKIP );
 
 		?>
-		<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="1" <?php checked( $value, true ); ?>> <?php _e( 'Yes', 'aryo-activity-log' ); ?></label>
-		<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="0" <?php checked( $value, false ); ?>> <?php _e( 'No', 'aryo-activity-log' ); ?></label>
+		<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="1" <?php checked( $value, true ); ?>> <?php esc_html_e( 'Yes', 'aryo-activity-log' ); ?></label>
+		<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="0" <?php checked( $value, false ); ?>> <?php esc_html_e( 'No', 'aryo-activity-log' ); ?></label>
 
 		<?php if ( isset( $args['description'] ) ) : ?>
 		<p class="description"><?php echo wp_kses_post( $args['description'] ); ?></p>
@@ -535,7 +535,7 @@ public static function email_notification_buffer_field( $args ) {
 		// if empty, reset to one element with the key of 1
 		$rows = empty( $rows ) ? array( array( 'key' => 1 ) ) : $rows;
 		?>
-		<p class="description"><?php _e( 'A notification will be sent upon a successful match with the following conditions:', 'aryo-activity-log' ); ?></p>
+		<p class="description"><?php esc_html_e( 'A notification will be sent upon a successful match with the following conditions:', 'aryo-activity-log' ); ?></p>
 		<div class="aal-notifier-settings">
 			<ul>
 			<?php foreach ( $rows as $rid => $row ) :
@@ -560,7 +560,7 @@ public static function email_notification_buffer_field( $args ) {
 						<option value="<?php echo esc_attr( $option_key ); ?>" <?php selected( $option_key, $row_value ); ?>><?php echo esc_html( $option_value ); ?></option>
 						<?php endforeach; ?>
 					</select>
-					<a href="#" class="aal-new-rule button"><small>+</small> <?php _e( 'and', 'aryo-activity-log' ); ?></a>
+					<a href="#" class="aal-new-rule button"><small>+</small> <?php esc_html_e( 'and', 'aryo-activity-log' ); ?></a>
 					<a href="#" class="aal-delete-rule button">&times;</a>
 				</li>
 			<?php endforeach; ?>
diff --git a/notifications/abstract-class-aal-notification-base.php b/notifications/abstract-class-aal-notification-base.php
index dfb81d3..d3e8b04 100644
--- a/notifications/abstract-class-aal-notification-base.php
+++ b/notifications/abstract-class-aal-notification-base.php
@@ -40,7 +40,7 @@ public function settings_fields() {}
 	public function trigger( $args ) {}
 	
 	public function _settings_section_callback() {
-		echo '<p>' . $this->description . '</p>';
+		echo '<p>' . esc_html( $this->description ) . '</p>';
 	}
 	
 	public function _settings_enabled_field_callback( $args = array() ) {
diff --git a/ruleset.xml b/ruleset.xml
index 2c5c05a..9bc241f 100644
--- a/ruleset.xml
+++ b/ruleset.xml
@@ -14,14 +14,18 @@
 	<exclude-pattern>build/</exclude-pattern>
 	<exclude-pattern>node_modules/</exclude-pattern>
 	<exclude-pattern>tests/</exclude-pattern>
+	<exclude-pattern>aryo-activity-log/</exclude-pattern>
 
 	<!--
-		Security rules downgraded to warnings until legacy violations are resolved.
-		TODO: Promote back to errors once the codebase is cleaned up.
+		Remaining Security sniffs are warnings until nonce/sanitization debt is resolved.
+		EscapeOutput is an error so unescaped output (including __()) fails CI.
 	-->
 	<rule ref="WordPress.Security">
 		<type>warning</type>
 	</rule>
+	<rule ref="WordPress.Security.EscapeOutput">
+		<type>error</type>
+	</rule>
 
 	<rule ref="WordPress.WP.DeprecatedFunctions" />
 

From 144398dbf992faae37912126ca65a40f2944cdc8 Mon Sep 17 00:00:00 2001
From: Yakir Sitbon <kingyes1@gmail.com>
Date: Wed, 19 Aug 2026 19:25:23 +0300
Subject: [PATCH 2/4] more escaping

---
 assets/js/settings.js          |  3 ++-
 classes/class-aal-admin-ui.php |  3 ++-
 classes/class-aal-api.php      |  2 +-
 classes/class-aal-settings.php | 13 +++++++++++--
 4 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/assets/js/settings.js b/assets/js/settings.js
index 21d797f..ca69014 100644
--- a/assets/js/settings.js
+++ b/assets/js/settings.js
@@ -92,7 +92,8 @@ jQuery( function( $ ) {
 		getData: function ( type, cb ) {
 			var payload = {
 				action: 'aal_get_properties',
-				action_category: type
+				action_category: type,
+				_nonce: window.aalSettings && window.aalSettings.nonce ? window.aalSettings.nonce : ''
 			};
 			$.getJSON( window.ajaxurl, payload, cb );
 		}
diff --git a/classes/class-aal-admin-ui.php b/classes/class-aal-admin-ui.php
index 2b71127..40845f5 100644
--- a/classes/class-aal-admin-ui.php
+++ b/classes/class-aal-admin-ui.php
@@ -21,12 +21,13 @@ public function create_admin_menu() {
 
 	public function activity_log_page_func() {
 		$this->get_list_table()->prepare_items();
+		$page_slug = isset( $_REQUEST['page'] ) ? sanitize_key( wp_unslash( $_REQUEST['page'] ) ) : 'activity-log-page';
 		?>
 		<div class="wrap">
 			<h1 class="aal-page-title"><?php echo esc_html_x( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>
 
 			<form id="activity-filter" method="get">
-				<input type="hidden" name="page" value="<?php echo esc_attr( $_REQUEST['page'] ); ?>" />
+				<input type="hidden" name="page" value="<?php echo esc_attr( $page_slug ); ?>" />
 				<?php $this->get_list_table()->display(); ?>
 			</form>
 		</div>
diff --git a/classes/class-aal-api.php b/classes/class-aal-api.php
index 7996200..3ce6d2b 100644
--- a/classes/class-aal-api.php
+++ b/classes/class-aal-api.php
@@ -75,7 +75,7 @@ protected function _get_ip_address() {
 		
 		$visitor_ip_address = '';
 		if ( ! empty( $_SERVER[ $header_key ] ) ) {
-			$visitor_ip_address = $_SERVER[ $header_key ];
+			$visitor_ip_address = sanitize_text_field( wp_unslash( $_SERVER[ $header_key ] ) );
 		}
 
 		$remote_address = apply_filters( 'aal_get_ip_address', $visitor_ip_address );
diff --git a/classes/class-aal-settings.php b/classes/class-aal-settings.php
index 1b58e8d..96dba44 100644
--- a/classes/class-aal-settings.php
+++ b/classes/class-aal-settings.php
@@ -60,6 +60,13 @@ public function action_admin_menu() {
 	 */
 	public function scripts_n_styles() {
 		wp_enqueue_script( 'aal-settings', plugins_url( 'assets/js/settings.js', ACTIVITY_LOG__FILE__ ), array( 'jquery' ) );
+		wp_localize_script(
+			'aal-settings',
+			'aalSettings',
+			array(
+				'nonce' => wp_create_nonce( 'aal_get_properties' ),
+			)
+		);
 		wp_enqueue_style( 'aal-settings', plugins_url( 'assets/css/settings.css', ACTIVITY_LOG__FILE__ ) );
 	}
 
@@ -351,11 +358,13 @@ public function ajax_aal_reset_items() {
 	}
 
 	public function ajax_aal_get_properties() {
-		if ( ! current_user_can( 'manage_options' ) ) {
+		if ( ! check_ajax_referer( 'aal_get_properties', '_nonce', false ) || ! current_user_can( 'manage_options' ) ) {
 			wp_send_json_error();
 		}
 
-		$action_category = isset( $_REQUEST['action_category'] ) ? $_REQUEST['action_category'] : false;
+		$action_category = isset( $_REQUEST['action_category'] )
+			? sanitize_key( wp_unslash( $_REQUEST['action_category'] ) )
+			: '';
 
 		$options = AAL_Main::instance()->notifications->get_settings_dropdown_values( $action_category );
 

From 15974c221312bf7e9c517afc2d87bb8d501c0eb4 Mon Sep 17 00:00:00 2001
From: Yakir Sitbon <kingyes1@gmail.com>
Date: Mon, 24 Aug 2026 16:26:38 +0300
Subject: [PATCH 3/4] fixing ci 429 error

---
 .github/workflows/phpunit.yml |  9 +++++++--
 bin/install-wp-tests.sh       | 17 ++++++++++++-----
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index cf8cbc8..9b5f40f 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -68,10 +68,15 @@ jobs:
             cp -r /tmp/wordpress-develop/tests/phpunit/* /tmp/wordpress-tests-lib/
 
             if [ "${{ matrix.wp-version }}" = "latest" ]; then
-              wget -O /tmp/wordpress.tar.gz https://wordpress.org/latest.tar.gz
+              WP_URL="https://wordpress.org/latest.tar.gz"
             else
-              wget -O /tmp/wordpress.tar.gz https://wordpress.org/wordpress-${{ matrix.wp-version }}.tar.gz
+              WP_URL="https://wordpress.org/wordpress-${{ matrix.wp-version }}.tar.gz"
             fi
+            for i in 1 2 3 4 5; do
+              wget -nv -O /tmp/wordpress.tar.gz "$WP_URL" && break
+              echo "Download attempt $i failed, retrying in $((i * 15))s..."
+              sleep $((i * 15))
+            done
             tar -xzf /tmp/wordpress.tar.gz -C /tmp/
           }
 
diff --git a/bin/install-wp-tests.sh b/bin/install-wp-tests.sh
index 8a7192d..24f42f1 100644
--- a/bin/install-wp-tests.sh
+++ b/bin/install-wp-tests.sh
@@ -18,11 +18,18 @@ WP_TESTS_DIR=${WP_TESTS_DIR-$TMPDIR/wordpress-tests-lib}
 WP_CORE_DIR=${WP_CORE_DIR-$TMPDIR/wordpress}
 
 download() {
-    if [ `which curl` ]; then
-        curl -s "$1" > "$2";
-    elif [ `which wget` ]; then
-        wget -nv -O "$2" "$1"
-    fi
+    local max_retries=5
+    for i in $(seq 1 $max_retries); do
+        if [ `which curl` ]; then
+            curl -sSf --retry 3 --retry-delay 10 "$1" > "$2" && return 0
+        elif [ `which wget` ]; then
+            wget -nv --tries=3 --waitretry=10 -O "$2" "$1" && return 0
+        fi
+        echo "Download attempt $i/$max_retries failed for $1, retrying in $((i * 15))s..."
+        sleep $((i * 15))
+    done
+    echo "All download attempts failed for $1"
+    return 1
 }
 
 if [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+\-(beta|RC)[0-9]+$ ]]; then

From 08be34e89de5219d2d079116057e82c596b8f2a4 Mon Sep 17 00:00:00 2001
From: Yakir Sitbon <kingyes1@gmail.com>
Date: Mon, 24 Aug 2026 18:03:45 +0300
Subject: [PATCH 4/4] Tweak: Remove notifications legacy code (#232)

---
 aryo-activity-log.php                         |   7 -
 assets/js/settings.js                         | 124 -------
 classes/class-aal-notifications.php           | 306 ------------------
 classes/class-aal-settings.php                | 154 ---------
 .../abstract-class-aal-notification-base.php  | 134 --------
 .../class-aal-notification-email.php          |  91 ------
 readme.txt                                    |   3 +
 7 files changed, 3 insertions(+), 816 deletions(-)
 delete mode 100644 assets/js/settings.js
 delete mode 100644 classes/class-aal-notifications.php
 delete mode 100644 notifications/abstract-class-aal-notification-base.php
 delete mode 100644 notifications/class-aal-notification-email.php

diff --git a/aryo-activity-log.php b/aryo-activity-log.php
index 9da6018..6dab52a 100644
--- a/aryo-activity-log.php
+++ b/aryo-activity-log.php
@@ -35,7 +35,6 @@
 include( 'classes/class-aal-settings.php' );
 include( 'classes/class-aal-api.php' );
 include( 'classes/class-aal-hooks.php' );
-include( 'classes/class-aal-notifications.php' );
 include( 'classes/class-aal-export.php' );
 include( 'classes/class-aal-privacy.php' );
 include( 'classes/abstract-class-aal-exporter.php' );
@@ -76,11 +75,6 @@ final class AAL_Main {
 	 */
 	public $api;
 
-	/**
-	 * @var \AAL_Notifications
-	 */
-	public $notifications;
-
 	/**
 	 * Construct
 	 */
@@ -91,7 +85,6 @@ protected function __construct() {
 		$this->hooks         = new AAL_Hooks();
 		$this->settings      = new AAL_Settings();
 		$this->api           = new AAL_API();
-		$this->notifications = new AAL_Notifications();
 
 		new AAL_Export();
 		new AAL_Privacy();
diff --git a/assets/js/settings.js b/assets/js/settings.js
deleted file mode 100644
index ca69014..0000000
--- a/assets/js/settings.js
+++ /dev/null
@@ -1,124 +0,0 @@
-'use strict';
-
-jQuery( function( $ ) {
-	var AAL = {
-		$wrapper: {},
-		$container: {},
-		conter: 0,
-
-		init: function () {
-			var _this = this;
-
-			AAL.$wrapper = $( ".aal-notifier-settings" );
-            AAL.$container = $( "ul", AAL.$wrapper );
-
-			AAL.counter = AAL.$container.children().length;
-
-            // check if there's only one option
-            if ( 1 === AAL.counter ) {
-                var $temp_el = AAL.$container.children().first();
-                // check if the "value" select box has no options
-                if ( 0 === $temp_el.find( ".aal-value option" ).length ) {
-                    // click the button with a timeout. Note that this is a hack that will need
-                    // to be solved server-side
-                    setTimeout( function () {
-                        $temp_el.find( ".aal-category" ).change();
-                    }, 300 );
-                }
-            }
-
-			// when the "add" button is clicked
-            AAL.$container.on( 'click', '.aal-new-rule', function ( e ) {
-				e.preventDefault();
-				_this.addRule( $( this ).closest( 'li' ) );
-			});
-
-            AAL.$container.on( 'click', '.aal-delete-rule', function ( e ) {
-				e.preventDefault();
-
-                // do not delete item if it's the only one left in the list
-                if ( 1 === AAL.$container.children().length ) {
-                    return;
-                }
-
-				_this.deleteRule( $( this ).closest( 'li' ) );
-			});
-
-			// handle change on action category selectbox
-            AAL.$container.on( 'change', '.aal-category', function ( e ) {
-				e.preventDefault();
-
-				var $select = $( this ),
-					$siblings = $select.siblings( "select" );
-
-				// disable all selectboxes to prevent multiple calls
-				$siblings.filter( "select" ).prop( 'disabled', true );
-
-				// grab live data via AJAX
-				var data = _this.getData( $select.val(), function ( d ) {
-					var $target = $siblings.filter( '.aal-value' );
-					$target.empty(); // clear so we can insert fresh data
-
-					$.each( d.data, function ( k, v ) {
-						$target.append( $( "<option/>", {
-							text: v,
-							value: k
-						} ) );
-					});
-
-					// restore disabled selectboxes
-					$siblings.filter( "select" ).prop( 'disabled', false );
-				});
-			});
-
-		},
-		addRule: function ( $el ) {
-			this.counter++;
-			var $copy = $el.clone(),
-				curID = parseInt( $el.data( 'id' ), null ),
-				newID = this.counter;
-
-			$copy.find( '[name]' ).each( function() {
-				$( this ).attr( 'name', $( this ).attr( 'name' ).replace( curID, newID ) );
-				// $( this ).attr( 'id', $( this ).attr( 'id' ).replace( curID, newID ) );
-			});
-
-			$copy.attr( 'data-id', newID );
-			$el.after( $copy );
-		},
-		deleteRule: function ( $el ) {
-			$el.remove();
-		},
-		getData: function ( type, cb ) {
-			var payload = {
-				action: 'aal_get_properties',
-				action_category: type,
-				_nonce: window.aalSettings && window.aalSettings.nonce ? window.aalSettings.nonce : ''
-			};
-			$.getJSON( window.ajaxurl, payload, cb );
-		}
-	};
-
-	AAL.init();
-
-	window.AAL = AAL;
-
-	/**
-	 * Form serialization helper
-	 */
-	$.fn.AALSerializeObject = function() {
-		var o = {};
-		var a = this.serializeArray();
-		$.each( a, function() {
-			if ( o[this.name] !== undefined ) {
-				if ( !o[this.name].push ) {
-					o[this.name] = [o[this.name]];
-				}
-				o[this.name].push( this.value || '' );
-			} else {
-				o[this.name] = this.value || '';
-			}
-		} );
-		return o;
-	};
-});
diff --git a/classes/class-aal-notifications.php b/classes/class-aal-notifications.php
deleted file mode 100644
index 0e98bed..0000000
--- a/classes/class-aal-notifications.php
+++ /dev/null
@@ -1,306 +0,0 @@
-<?php
-if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
-
-/**
- * Notifications API main class
- * 
- * @since 2.0.6
- */
-class AAL_Notifications {
-	/* @todo public for debugging now, change to private/protected l8r */
-	public $handlers = array();
-	public $handlers_loaded = array();
-	
-	public function __construct() {
-		// Load abstract class.
-		include( plugin_dir_path( ACTIVITY_LOG__FILE__ ) . '/notifications/abstract-class-aal-notification-base.php' );
-		
-		// Run handlers loader
-		add_action( 'init', array( &$this, 'load_handlers' ), 20 );
-		add_action( 'aal_load_notification_handlers', array( &$this, 'load_default_handlers' ) );
-		add_action( 'aal_insert_log', array( &$this, 'process_notifications' ), 20 );
-	}
-	
-	public function process_notifications( $args ) {
-		$enabled_handlers = $this->get_enabled_handlers();
-		
-		// if we can't find any enabled event handlers, bail.
-		if ( empty( $enabled_handlers ) )
-			return;
-		
-		// calculate if this type event is set in the rules
-		$options = AAL_Main::instance()->settings->get_options();
-		
-		// if there are no rules set, bail.
-		if ( empty( $options['notification_rules'] ) || ! is_array( $options['notification_rules'] ) )
-			return;
-		
-		$notification_matched_rules = array();
-		
-		// loop through the set of rules, and figure out if this current action meets a set rule
-		foreach ( $options['notification_rules'] as $notification_rule ) {
-			list( $n_key, $n_condition, $n_value ) = array_values( $notification_rule );
-			
-			switch ( $n_key ) {
-				case 'action-type':
-					if ( $n_value == $args['object_type'] )
-						$notification_matched_rules[] = $notification_rule;
-					break;
-			}
-		}
-		
-		// did we find any matches? if not, let's pretend as if nothing has happened here ;)
-		if ( ! empty( $notification_matched_rules ) ) {
-			// cycle through enabled handlers and trigger them
-			foreach ( $enabled_handlers as $enabled_handler ) {
-				$enabled_handler->trigger( $args );
-			}
-		}
-	}
-
-	public function get_object_types() {
-		// TODO: It's need to be integration from the plugin
-		$opts = apply_filters(
-			'aal_notification_get_object_types',
-			array(
-				'Core',
-				'Export',
-				'Posts',
-				'Taxonomies',
-				'Users',
-				'Options',
-				'Attachments',
-				'Plugins',
-				'Widgets',
-				'Themes',
-				'Menus',
-				'Comments',
-
-				// BC
-				'Post',
-				'Taxonomy',
-				'User',
-				'Plugin',
-				'Widget',
-				'Theme',
-				'Menu',
-			)
-		);
-		
-		return array_combine( $opts, $opts );
-	}
-
-	public function get_actions() {
-		// TODO: It's need to be integration from the plugin
-		$opts = apply_filters(
-			'aal_notification_get_actions',
-			array(
-				'created',
-				'deleted',
-				'updated',
-				'trashed',
-				'untrashed',
-				'spammed',
-				'unspammed',
-				'downloaded',
-				'installed',
-				'uploaded',
-				'activated',
-				'deactivated',
-				'accessed',
-				'file_updated',
-				'logged_in',
-				'logged_out',
-				'failed_login',
-			)
-		);
-		$ready = array();
-
-		// make key => value pairs (where slug in key)
-		foreach ( $opts as $opt ) {
-			$ready[ $opt ] = ucwords( str_replace( '_', ' ', __( $opt, 'aryo-activity-log' ) ) );
-		}
-
-		return $ready;
-	}
-	
-	/**
-	 * Returns values for the dropdown in the settings page (the last dropdown in each conditions row)
-	 * 
-	 * @param string $row_key type
-	 * @return array
-	 */
-	public function get_settings_dropdown_values( $row_key ) {
-		$results = array();
-		
-		/**
-		 * @todo allow this switch to be extensible by other plugins (see example)
-		 */
-		switch ( $row_key ) {
-			case 'user':
-				// cache all data in case we need the same data twice on the same/upcoming pageloads
-				if ( false === ( $results = wp_cache_get( $cache_key = 'notifications-users', 'aal' ) ) ) {
-					// get all users
-					$all_users = get_users();
-					$preped_users = array();
-					
-					// prepare users
-					foreach ( $all_users as $user ) {
-						$user_role = $user->roles;
-							
-						// if user has no role (shouldn't happen, but just in case)
-						if ( empty( $user_role ) )
-							continue;
-						
-						$user_role_obj = get_role( $user_role[0] );
-						$user_role_name = isset( $user_role_obj->name ) ? $user_role_obj->name : $user_role[0];
-							
-						$preped_users[ $user->ID ] = apply_filters( 'aal_notifications_user_format', sprintf( '%s - %s (ID #%d)', $user->display_name, $user_role_name, $user->ID ), $user );
-					}
-					
-					wp_cache_set( $cache_key, $results = $preped_users, 'aal' ); // no need for expiration time
-				}
-				break;
-				
-			case 'action-type':
-				$results = $this->get_object_types();
-				break;
-				
-			case 'action-value':
-				$results = $this->get_actions();
-				break;
-				
-			default:
-				// @todo allow plugins to extend and handle custom field types 
-				$results = apply_filters( 'aal_settings_dropdown_values', $results, $row_key );
-				break;
-		}
-		
-		return $results;
-	}
-	
-	/**
-	 * Returns a list of handlers, in a key-value format.
-	 * Key holds the classname, value holds the name of the transport.
-	 */
-	public function get_handlers() {
-		if ( empty( $this->handlers ) || ! did_action( 'aal_load_notification_handlers' ) )
-			return array();
-		
-		$handlers = array();
-		
-		foreach ( $this->handlers as $handler ) {
-			$handler_obj = $this->handlers_loaded[ $handler ];
-			
-			// if we got the name of the handler, use it. otherwise, use the classname.
-			$handler_name = isset( $handler_obj->name ) ? $handler_obj->name : $handler;
-			
-			$handlers[ $handler_obj->id ] = $handler_name; 
-		}
-		
-		return $handlers;
-	}
-	
-	/**
-	 * Returns a handler object
-	 * 
-	 * @param string $id
-	 * @return AAL_Notification_Base|bool
-	 */
-	public function get_handler_object( $id ) {
-		return isset( $this->handlers_loaded[ $id ] ) ? $this->handlers_loaded[ $id ] : false;
-	}
-	
-	/**
-	 * Returns all available handlers
-	 * @return array
-	 */
-	public function get_available_handlers() {
-		$handlers = array();
-		
-		foreach ( $this->handlers_loaded as $handler_classname => $handler_obj ) {
-			$handlers[ $handler_obj->id ] = $handler_obj;
-		}
-		
-		return apply_filters( 'aal_available_handlers', $handlers );
-	}
-	
-	/**
-	 * Returns the active handlers that were activated through the settings page
-	 * 
-	 * @return array
-	 */
-	public function get_enabled_handlers() {
-		$enabled = array();
-		$options = AAL_Main::instance()->settings->get_options();
-		
-		foreach ( $this->get_available_handlers() as $id => $handler_obj ) {
-			// make sure handler is active
-			if ( isset( $options['notification_handlers'][ $id ] ) && 1 == $options['notification_handlers'][ $id ] ) {
-				$enabled[ $id ] = $handler_obj;
-			}
-		}
-		
-		return $enabled;
-	}
-
-	/**
-	 * Runs during aal_load_notification_handlers, 
-	 * includes the necessary files to register default notification handlers.
-	 */
-	public function load_default_handlers() {
-		$default_handlers = apply_filters( 'aal_default_addons', array(
-			'email' 			=> $this->get_default_handler_path( 'class-aal-notification-email.php' ),
-		) );
-
-		foreach ( $default_handlers as $filename )
-			include_once $filename;
-	}
-
-	/**
-	 * Returns path to notification handler file
-	 * 
-	 * @param string $filename
-	 * @return string
-	 */
-	public function get_default_handler_path( $filename ) {
-		return plugin_dir_path( ACTIVITY_LOG__FILE__ ) . "notifications/$filename";
-	}
-
-	/**
-	 * Fired before $this->init()
-	 *
-	 * @todo maybe check $classname's inheritance tree and signal if it's not a AAL_Notification_Base
-	 */
-	public function load_handlers() {
-		do_action( 'aal_load_notification_handlers' );
-
-		foreach ( $this->handlers as $handler_classname ) {
-			if ( class_exists( $handler_classname ) ) {
-				$obj = new $handler_classname;
-				
-				// is this handler extending AAL_Notification_Base?
-				if ( ! is_a( $obj, 'AAL_Notification_Base' ) )
-					continue;
-				
-				$this->handlers_loaded[ $handler_classname ] = $obj;
-			}
-		}
-	}
-
-	/**
-	 * Registers a handler class, which is then loaded in $this->load_handlers
-	 * 
-	 * @param string $classname The name of the class to create an instance for
-	 * @return bool
-	 */
-	public function register_handler( $classname ) {
-		if ( ! class_exists( $classname ) ) {
-			trigger_error( esc_html__( 'The AAL notification handler you are trying to register does not exist.', 'aryo-activity-log' ) );
-			return false;
-		}
-
-		$this->handlers[] = $classname;
-		return true;
-	}
-}
diff --git a/classes/class-aal-settings.php b/classes/class-aal-settings.php
index 96dba44..ed72167 100644
--- a/classes/class-aal-settings.php
+++ b/classes/class-aal-settings.php
@@ -15,7 +15,6 @@ public function __construct() {
 		add_filter( 'plugin_action_links_' . ACTIVITY_LOG_BASE, array( &$this, 'plugin_action_links' ) );
 
 		add_action( 'wp_ajax_aal_reset_items', array( &$this, 'ajax_aal_reset_items' ) );
-		add_action( 'wp_ajax_aal_get_properties', array( &$this, 'ajax_aal_get_properties' ) );
 	}
 
 	public function init() {
@@ -59,14 +58,6 @@ public function action_admin_menu() {
 	 * @since 1.0
 	 */
 	public function scripts_n_styles() {
-		wp_enqueue_script( 'aal-settings', plugins_url( 'assets/js/settings.js', ACTIVITY_LOG__FILE__ ), array( 'jquery' ) );
-		wp_localize_script(
-			'aal-settings',
-			'aalSettings',
-			array(
-				'nonce' => wp_create_nonce( 'aal_get_properties' ),
-			)
-		);
 		wp_enqueue_style( 'aal-settings', plugins_url( 'assets/css/settings.css', ACTIVITY_LOG__FILE__ ) );
 	}
 
@@ -189,60 +180,6 @@ public function register_settings() {
 				}
 				break;
 
-			case 'notifications':
-				// Email Notifications Settings
-				add_settings_section(
-					'email_notifications', // ID used to identify this section and with which to register options
-					__( 'Notifications', 'aryo-activity-log' ),	// Title to be displayed on the administration page
-					array( 'AAL_Settings_Fields', 'email_notifications_section_header' ),	// Callback used to render the description of the section
-					$this->slug		// Page on which to add this section of options
-				);
-
-				add_settings_field(
-					'notification_rules',
-					__( 'Notification Events', 'aryo-activity-log' ),
-					array( 'AAL_Settings_Fields', 'email_notification_buffer_field' ),
-					$this->slug,
-					'email_notifications',
-					array(
-						'id'      => 'notification_rules',
-						'page'    => $this->slug,
-						'desc'    => __( 'Maximum number of days to keep activity log. Leave blank to keep activity log forever (not recommended).', 'aryo-activity-log' ),
-					)
-				);
-
-				$notification_handlers = AAL_Main::instance()->notifications->get_available_handlers();
-				$enabled_notification_handlers = AAL_Main::instance()->settings->get_option( 'notification_handlers' );
-
-				// Loop through custom notification handlers
-				foreach ( $notification_handlers as $handler_id => $handler_obj  ) {
-					if ( ! is_object( $handler_obj ) )
-						continue;
-
-					add_settings_section(
-						"notification_$handler_id",
-						$handler_obj->name,
-						array( $handler_obj, '_settings_section_callback' ),
-						$this->slug
-					);
-
-					add_settings_field(
-						"notification_handler_{$handler_id}_enabled",
-						__( 'Enable?', 'aryo-activity-log' ),
-						array( $handler_obj, '_settings_enabled_field_callback' ),
-						$this->slug,
-						"notification_$handler_id",
-						array(
-							'id'      => 'notification_transport',
-							'page'    => $this->slug,
-							'name' => "{$this->slug}[notification_handlers][{$handler_id}]",
-							'value' => isset( $enabled_notification_handlers[ $handler_id ] ) && ( 1 == $enabled_notification_handlers[ $handler_id ] ),
-						)
-					);
-
-					$handler_obj->settings_fields();
-				}
-				break;
 		}
 	}
 
@@ -267,13 +204,6 @@ private function menu_print_tabs() {
 			'general'       => __( 'General', 'aryo-activity-log' ),
 		);
 
-		$enabled_notification_handlers = AAL_Main::instance()->settings->get_option( 'notification_handlers' );
-
-		// Hide notifications tab if not used before..
-		if ( ! empty( $enabled_notification_handlers ) ) {
-			$sections['notifications'] = __( 'Notifications', 'aryo-activity-log' );
-		}
-
 		$sections = apply_filters( 'aal_setup_sections', $sections );
 
 		if ( 1 >= count( $sections ) ) {
@@ -357,24 +287,6 @@ public function ajax_aal_reset_items() {
 		die();
 	}
 
-	public function ajax_aal_get_properties() {
-		if ( ! check_ajax_referer( 'aal_get_properties', '_nonce', false ) || ! current_user_can( 'manage_options' ) ) {
-			wp_send_json_error();
-		}
-
-		$action_category = isset( $_REQUEST['action_category'] )
-			? sanitize_key( wp_unslash( $_REQUEST['action_category'] ) )
-			: '';
-
-		$options = AAL_Main::instance()->notifications->get_settings_dropdown_values( $action_category );
-
-		if ( ! empty( $options ) ) {
-			wp_send_json_success( $options );
-		}
-
-		wp_send_json_error();
-	}
-
 	public function get_option( $key = '' ) {
 		$settings = $this->get_options();
 		return ! empty( $settings[ $key ] ) ? $settings[ $key ] : false;
@@ -408,12 +320,6 @@ public static function general_settings_section_header() {
 		<?php
 	}
 
-	public static function email_notifications_section_header() {
-		?>
-		<p><?php esc_html_e( 'Serve yourself with custom-tailored notifications. First, define your conditions. Then, choose how the notifications will be sent.', 'aryo-activity-log' ); ?></p>
-		<?php
-	}
-
 	public static function raw_html( $args ) {
 		if ( empty( $args['html'] ) )
 			return;
@@ -518,66 +424,6 @@ public static function yesno_field( $args ) {
 		<?php
 	}
 
-	public static function email_notification_buffer_field( $args ) {
-		$args = wp_parse_args( $args, array(
-			'classes' => array(),
-		) );
-		if ( empty( $args['id'] ) || empty( $args['page'] ) )
-			return;
-
-		// available action categories
-		$keys = array(
-			'user' 			=> __( 'User', 'aryo-activity-log' ),
-			'action-type' 	=> __( 'Action Type', 'aryo-activity-log' ),
-			'action-value'  => __( 'Action Performed', 'aryo-activity-log' ),
-		);
-		// available condition types
-		$conditions = array(
-			'equals' => __( 'equals to', 'aryo-activity-log' ),
-			'not_equals' => __( 'not equals to', 'aryo-activity-log' ),
-		);
-
-		$common_name = sprintf( '%s[%s]', esc_attr( $args['page'] ), esc_attr( $args['id'] ) );
-
-		// get all rows
-		$rows = AAL_Main::instance()->settings->get_option( $args['id'] );
-		// if empty, reset to one element with the key of 1
-		$rows = empty( $rows ) ? array( array( 'key' => 1 ) ) : $rows;
-		?>
-		<p class="description"><?php esc_html_e( 'A notification will be sent upon a successful match with the following conditions:', 'aryo-activity-log' ); ?></p>
-		<div class="aal-notifier-settings">
-			<ul>
-			<?php foreach ( $rows as $rid => $row ) :
-				$row_key 		= $row['key'];
-				$row_condition 	= isset( $row['condition'] ) ? $row['condition'] : '';
-				$row_value 		= isset( $row['value'] ) ? $row['value'] : '';
-				?>
-				<li data-id="<?php echo esc_attr( $rid ); ?>">
-					<select name="<?php echo esc_attr( $common_name ); ?>[<?php echo esc_attr( $rid ); ?>][key]" class="aal-category">
-						<?php foreach ( $keys as $k => $v ) : ?>
-						<option value="<?php echo esc_attr( $k ); ?>" <?php selected( $row_key, $k ); ?>><?php echo esc_attr( $v ); ?></option>
-						<?php endforeach; ?>
-					</select>
-					<select name="<?php echo esc_attr( $common_name ); ?>[<?php echo esc_attr( $rid ); ?>][condition]" class="aal-condition">
-						<?php foreach ( $conditions as $k => $v ) : ?>
-						<option value="<?php echo esc_attr( $k ); ?>" <?php selected( $row_condition, $k ); ?>><?php echo esc_html( $v ); ?></option>
-						<?php endforeach; ?>
-					</select>
-					<?php $value_options = AAL_Main::instance()->notifications->get_settings_dropdown_values( $row_key ); ?>
-					<select name="<?php echo esc_attr( $common_name ); ?>[<?php echo esc_attr( $rid ); ?>][value]" class="aal-value">
-						<?php foreach ( $value_options as $option_key => $option_value ) : ?>
-						<option value="<?php echo esc_attr( $option_key ); ?>" <?php selected( $option_key, $row_value ); ?>><?php echo esc_html( $option_value ); ?></option>
-						<?php endforeach; ?>
-					</select>
-					<a href="#" class="aal-new-rule button"><small>+</small> <?php esc_html_e( 'and', 'aryo-activity-log' ); ?></a>
-					<a href="#" class="aal-delete-rule button">&times;</a>
-				</li>
-			<?php endforeach; ?>
-			</ul>
-		</div>
-		<?php
-	}
-
 	private static function _set_name_and_value( &$args ) {
 		if ( ! isset( $args['name'] ) ) {
 			$args['name'] = sprintf( '%s[%s]', esc_attr( $args['page'] ), esc_attr( $args['id'] ) );
diff --git a/notifications/abstract-class-aal-notification-base.php b/notifications/abstract-class-aal-notification-base.php
deleted file mode 100644
index d3e8b04..0000000
--- a/notifications/abstract-class-aal-notification-base.php
+++ /dev/null
@@ -1,134 +0,0 @@
-<?php
-if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
-
-/**
- * Base class, handles notifications
- * 
- * Class AAL_Notification_Base
- */
-abstract class AAL_Notification_Base {
-	/**
-	 * The following variables have to be defined for each payment method.
-	 */
-	public $id = '';
-	public $name = '';
-	public $description = '';
-	
-	public $aal_options;
-	
-	public function __construct() {
-		$this->aal_options = AAL_Main::instance()->settings->get_options();
-		
-		add_action( 'init', array( &$this, 'init' ), 30 );
-		add_action( 'aal_validate_options', array( &$this, '_validate_options' ), 10, 2 );
-	}
-
-	private function settings_field_name_attr( $name ) {
-		return esc_attr( "notification_handler_options_{$this->id}[{$name}]" );
-	}
-	
-	public function init() {}
-	
-	/**
-	 * Registers the settings for this individual extension
-	 */
-	public function settings_fields() {}
-	
-	/**
-	 * Exectutes when notification is due
-	 */
-	public function trigger( $args ) {}
-	
-	public function _settings_section_callback() {
-		echo '<p>' . esc_html( $this->description ) . '</p>';
-	}
-	
-	public function _settings_enabled_field_callback( $args = array() ) {
-		AAL_Settings_Fields::yesno_field( $args );
-	}
-	
-	public function add_settings_field_helper( $option_name, $title, $callback, $description = '', $default_value = '' ) {
-		$settings_page_slug = AAL_Main::instance()->settings->slug();
-		$handler_options = isset( $this->aal_options["handler_options_{$this->id}"] )
-			? $this->aal_options["handler_options_{$this->id}"] : array();
-		
-		add_settings_field( 
-			"notification_handler_{$this->id}_{$option_name}", 
-			$title, 
-			$callback, 
-			$settings_page_slug, 
-			"notification_{$this->id}",
-			array(
-				'name' 		=> $this->settings_field_name_attr( $option_name ),
-				'value' 	=> isset( $handler_options[ $option_name ] ) ? $handler_options[ $option_name ] : $default_value,
-				'desc' 		=> $description,
-				'id'      	=> $option_name,
-				'page'    	=> $settings_page_slug,
-			) 
-		);
-	}
-	
-	public function _validate_options( $form_data, $aal_options ) {
-		$post_key 	= "notification_handler_options_{$this->id}";
-		$option_key = "handler_options_{$this->id}";
-	
-		if ( ! isset( $_POST[ $post_key ] ) )
-			return $form_data;
-	
-		$input = $_POST[ $post_key ];
-		$output = ( method_exists( $this, 'validate_options' ) ) ? $this->validate_options( $input ) : array();
-		$form_data[ $option_key ] = $output;
-	
-		return $form_data;
-	}
-	
-	public function get_handler_options() {
-		$handler_options = array();
-		$option_key = "handler_options_{$this->id}";
-		
-		if ( isset( $this->aal_options[ $option_key ] ) ) {
-			$handler_options = (array) $this->aal_options[ $option_key ];
-		}
-		
-		return $handler_options;
-	}
-
-	public function prep_notification_body( $args ) {
-		$details_to_provide = array(
-			'user_id'     => __( 'User', 'aryo-activity-log' ),
-			'object_type' => __( 'Object Type', 'aryo-activity-log' ),
-			'object_name' => __( 'Object Name', 'aryo-activity-log' ),
-			'action'      => __( 'Action Type', 'aryo-activity-log' ),
-			'hist_ip'     => __( 'IP Address', 'aryo-activity-log' ),
-		);
-		$message = '';
-
-		foreach ( $details_to_provide as $detail_key => $detail_title ) {
-			$detail_val = '';
-
-			switch ( $detail_key ) {
-				case 'user_id':
-					if ( is_numeric( $args[ $detail_key ] ) ) {
-						// this is a user ID
-						$user = new WP_User( $args[ $detail_key ] );
-
-						if ( ! is_wp_error( $user ) ) {
-							$detail_val = sprintf( '<a href="%s">%s</a>', esc_url( get_edit_user_link( $user->ID ) ), esc_html( $user->display_name ) );
-						}
-					}
-					break;
-				default:
-					$detail_val = isset( $args[ $detail_key ] ) ? $args[ $detail_key ] : __( 'N/A', 'aryo-activity-log' );
-					break;
-			}
-
-			$message .= sprintf( "<strong>%s</strong> - %s\n", $detail_title, $detail_val );
-		}
-
-		return $message;
-	}
-}
-
-function aal_register_notification_handler( $classname = '' ) {
-	return AAL_Main::instance()->notifications->register_handler( $classname );
-}
\ No newline at end of file
diff --git a/notifications/class-aal-notification-email.php b/notifications/class-aal-notification-email.php
deleted file mode 100644
index a902cb1..0000000
--- a/notifications/class-aal-notification-email.php
+++ /dev/null
@@ -1,91 +0,0 @@
-<?php
-if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
-
-class AAL_Notification_Email extends AAL_Notification_Base {
-	
-	/**
-	 * Store options in a class locally
-	 */
-	protected $options = array();
-	
-	public function __construct() {
-		parent::__construct();
-		
-		$this->id = 'email';
-		$this->name = __( 'Email', 'aryo-activity-log' );
-		$this->description = __( 'Get notified by Email.', 'aryo-activity-log' );
-	}
-	
-	public function init() {
-		$this->options = array_merge( array(
-			'from_email'   => get_option( 'admin_email' ),
-//			'message_format' => __( "Hi there!\n\nA notification condition on [sitename] was matched. Here are the details:\n\n[action-details]\n\nSent by ARYO Activity Log", 'aryo-activity-log' )
-		), $this->get_handler_options() );
-	}
-	
-	public function trigger( $args ) {
-		$from_email = isset( $this->options['from_email'] ) && is_email( $this->options['from_email'] ) ? $this->options['from_email'] : '';
-		$to_email   = isset( $this->options['to_email'] ) && is_email( $this->options['to_email'] ) ? $this->options['to_email'] : '';
-
-		// if no from email or to email provided, quit.
-		if ( ! ( $from_email || $to_email ) )
-			return;
-
-		$format = isset( $this->options['message_format'] ) ? $this->options['message_format'] : '';
-		$body = $this->prep_notification_body( $args );
-		$site_name = get_bloginfo( 'name' );
-		$site_name_link = sprintf( '<a href="%s">%s</a>', home_url(), $site_name );
-
-		$email_contents = strtr( $format, array(
-			'[sitename]' => $site_name_link,
-			'[action-details]' => $body,
-		) );
-
-		// set the content type
-		add_filter( 'wp_mail_content_type', array( &$this, 'email_content_type' ) );
-
-		wp_mail(
-			$to_email,
-			__( 'New notification from Activity Log', 'aryo-activity-log' ),
-			nl2br( $email_contents ),
-			array(
-				"From: Activity Log @ $site_name <$from_email>"
-			)
-		);
-
-		// reset back to how it was before
-		remove_filter( 'wp_mail_content_type', array( &$this, 'email_content_type' ) );
-	}
-
-	public function email_content_type() {
-		return apply_filters( 'aal_notification_email_content_type', 'text/html' );
-	}
-	
-	public function settings_fields() {
-		$default_email_message = __( "Hi there!\n\nA notification condition on [sitename] was matched. Here are the details:\n\n[action-details]\n\nSent by ARYO Activity Log", 'aryo-activity-log' );
-
-		$this->add_settings_field_helper( 'from_email', __( 'From Email', 'aryo-activity-log' ), array( 'AAL_Settings_Fields', 'text_field' ), __( 'The source Email address', 'aryo-activity-log' ) );
-		$this->add_settings_field_helper( 'to_email', __( 'To Email', 'aryo-activity-log' ), array( 'AAL_Settings_Fields', 'text_field' ), __( 'The Email address notifications will be sent to', 'aryo-activity-log' ) );
-		$this->add_settings_field_helper( 'message_format', __( 'Message', 'aryo-activity-log' ), array( 'AAL_Settings_Fields', 'textarea_field' ), sprintf( __( 'Customize the message using the following placeholders: %s', 'aryo-activity-log' ), '[sitename], [action-details]' ), $default_email_message );
-	}
-	
-	public function validate_options( $input ) {
-		$output = array();
-		$email_fields = array( 'to_email', 'from_email' );
-
-		foreach ( $email_fields as $email_field ) {
-			if ( isset( $input[ $email_field ] ) && is_email( $input[ $email_field ] ) )
-				$output[ $email_field ] = $input[ $email_field ];
-		}
-
-		// email template message
-		if ( ! empty( $input['message_format'] ) ) {
-			$output['message_format'] = $input['message_format'];
-		}
-
-		return $output;
-	}
-}
-
-// Register this handler, creates an instance of this class when necessary.
-aal_register_notification_handler( 'AAL_Notification_Email' );
\ No newline at end of file
diff --git a/readme.txt b/readme.txt
index 350fd8f..888b8ca 100644
--- a/readme.txt
+++ b/readme.txt
@@ -143,6 +143,9 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
 
 == Changelog ==
 
+= 2.13.0 =
+* Removed: Email notifications feature (hidden since 2.5 for sites that never enabled it) has been fully removed
+
 = 2.12.1 - 2026-08-20 =
 * Tweak: Removed text domain loading method in favor of WordPress standard loading
 * Fix: Re-release for WordPress.org after a failed deploy