== Changelog == = Master Elementor Addons 3.1.3 (14-06-2026) = * Added: Timeline widget Title and Content typography and color controls (Cards section), applied to both Post and Custom timeline items. * Security: Hardened popup list sorting so it only accepts known sort options. * Security: Tightened permissions on the Mega Menu content editor so only menu managers can use it. * Improved: Custom CSS and JS in the Widget Builder are now a Pro feature; HTML stays available for everyone. * Improved: Template previews now open in a new browser tab instead of loading inside the dashboard. * Improved: Used unique name prefixes across the plugin for better compatibility with other plugins. * Improved: Updated the Select2 library to the latest stable version. * Improved: The setup wizard theme image now loads from within the plugin instead of an external site. * Improved: Review links now open the full reviews page. * Fixed: Template Live Preview link is now easy to read in Elementor's dark mode. = Master Elementor Addons 3.1.2 (08-06-2026) = * Added: Custom Attributes support for the link/button controls in Creative Button, Creative Links, Dual Heading, Info Box, Business Hours, Flipbox, Advanced Image, Image Hover Effects, Call to Action, Pricing Table and Featured Product (Pro) widgets. * Added: Countdown Timer style presets (Card, Flip, Circle, Gradient, Neon, Glassmorphism, Minimal, Outline, Neumorphic) with the Layout and Style Preset options separated; the new presets are gated to Pro. * Added: Counter Up responsive column support and a Content Position control for placing the title around the number. * Added: Changelog widget Style tab controls (Heading, Title, Content) so the Style tab now appears before Advanced. * Added: Pricing Table individual Currency, Fractional and Period color controls. * Fixed: Dual Heading link showed "[object Object]" as the href in the editor and ignored Open in new window / Add nofollow / Custom Attributes; Style 1 markup, heading structure and extra-span spacing corrected. * Fixed: Tooltip Width, Background, Color, Padding, Border and Typography style controls now apply (scoped to the per-widget Tippy theme); Tooltip Text now updates live in the Elementor editor. * Fixed: Gradient Headline hover gradient colors now apply on hover only when set. * Fixed: Pricing Table price typography now targets the price amount only, and extra spacing around the price/currency is removed. * Fixed: Image Hover Effects border radius now rounds the image, border and hover overlays. * Fixed: Progress Bar percentage number typography/DOM controller styling. * Fixed: Contact Form 7 label margin now applies to the form labels. * Fixed: "Unregistered dependency" PHP notice (jltma-prism) for the Source Code widget when the Pro license is inactive. * Fixed: Nonce issue fixed. * Added: Widget Builder now lets you add conditions and loops in your widget code, so you can show or hide parts of a widget and repeat items based on your settings. * Added: Documentation links inside the Widget Builder — a quick link in the code panel and a help icon on every control. * Improved: A roomier Widget Builder code editor — a wider editing area, a draggable panel you can size yourself, and cleaner, thinner scrollbars. * Improved: Premium controls are now clearly locked on the free version and can no longer be added by mistake. * Fixed: Background, typography and text shadow styling now applies exactly where you choose instead of to the whole widget. * Fixed: Importing a widget now opens it correctly, and the Widget Builder menu appears in the right place. * Improved: Widgets you build are now shown in a safer, more reliable way. = Master Elementor Addons 3.1.1 (23-05-2026) = * Security: Widget Builder no longer accepts or executes arbitrary PHP. PHP tags are stripped from all widget HTML/CSS/JS on save and during generation, so generated widget files contain only plugin-authored code. Dynamic values use {{placeholders}} that are escaped on output. * Security: Removed the Widget Builder preview path that wrote user code to a temporary PHP file and included it. Previews now render statically with escaped mock values — no user PHP or JavaScript is executed. * Security: Fixed an authenticated (author+) Stored XSS via the 'jtlma_custom_js' page setting / 'custom_js' element setting of the Custom JS extension (reported in versions up to 3.1.0). The extension is removed from the free plugin entirely (no render path remains); in Master Addons Pro the unfiltered_html capability is now enforced on save (the value is stripped for unprivileged users via the elementor/document/save filter) and at render (output gated by the post author's capability), not only during control registration. * Security: Hardened the Custom CSS extension against tag-breakout XSS. The 'custom_css' element setting is now sanitized on save (via the elementor/document/save filter) and again on render before it is added to the stylesheet, stripping HTML/PHP tags (e.g. a "