Upvimeo — Direct Uploads for Vimeo

The Professional Uploader for Vimeo on WordPress. Upvimeo is a powerful 3rd-party video publishing command center designed specifically for Vimeo. Say goodbye to upload_max_filesize errors, server timeouts, and FTP headaches. Whether you are a Course Creator, Agency, or Video Professional, Upvimeo provides the enterprise-grade infrastructure you need to manage Vimeo content seamlessly. 🌟 Why Professionals Choose Upvimeo? Most plugins rely on your server's limited PHP process to upload files, causing crashes with large videos. Upvimeo is different. We utilize the advanced TUS Resumable Upload Protocol—the same technology powering Vimeo itself—to stream data directly from your browser to the cloud.

• 🚀 Upload Unlimited Sizes: Push 5GB, 20GB, or 50GB files seamlessly, bypassing all server limits (2MB/50MB).
• ⚡ Zero Server Load: Your hosting bandwidth is untouched. Video data flies directly to Vimeo at maximum speed.
• 🛡️ Unbreakable Uploads: Network drop? No problem. Upvimeo automatically pauses and resumes uploads exactly where they left off.

🎬 Free: The Essential Video Suite

• Direct-to-Vimeo Engine: Upload from the Media Library, Gutenberg, or Classic Editor.
• Seamless Privacy: Set "Who can watch?" (Anyone, Only Me, Hide from Vimeo) instantly.
• Smart Library: Create folders and organize projects without leaving WordPress.
• Perfect Embeds: Standardized, responsive 4K embedding via the Upvimeo Block.
• Connection Health: Built-in diagnostics for your API connection.

🚀 Pro Features Need to integrate with form builders and LMS systems? Consider upgrading to unlock advanced field integrations: * LearnDash & TutorLMS: Upload lesson videos directly inside the course builders. * Gravity Forms & WPForms: Frontend drag-and-drop upload fields with real-time progress bars. * ACF Integration: Add robust video fields to any Post Type. ⚖️ Legal Disclaimer Upvimeo is a 3rd-party independent integration tool. It is not affiliated with, endorsed by, or maintained by Vimeo, Inc. "Vimeo" is a registered trademark of Vimeo, Inc.

1.6.32

• Update: Changed Text Domain to upvimeo-direct-uploads for WP.org compliance.

1.6.31

• Refactor: Removed local asset overrides to natively rely on the Freemius API for product branding.

1.6.29

• Fix: Hardened native WordPress update logo injection to guarantee trailing slashes via plugin_dir_url().

1.6.28

• Enhancement: Bypassed API cache to enforce local logo rendering for native WordPress update screens.

1.6.27

• Enhancement: Bypassed API cache to enforce local logo rendering for Freemius pricing page and WordPress sidebar.

1.6.26

• Security: Added strict path traversal validation to chunked video uploads. Fix: Purged unpermitted vendor shell scripts from the distribution archive.

1.6.25

• Fix: Adopted official WP.org recommended display name ('Upvimeo — Direct Uploads for Vimeo') and slug structure to comply with directory trademark guidelines, while verifying full compatibility with WordPress 7.0.

1.6.23

• Maintenance: Updated Freemius SDK to version 2.13.4 for improved stability and security.

1.6.22 Fix: Physically extracted the final residual trialware string from the settings helper to ensure 100% compliance with WP.org automated repository scanners. 1.6.21 Fix: Synchronized and updated 'Tested up to' (7.0) and 'Requires PHP' (7.4) headers across main plugin file and readme for full WP.org directory compliance. 1.6.20 Fix: Finalized strict CSS/DOM namespace isolation and completely extracted residual premium option strings from Free core logic to comply with WP.org automated scanners. 1.6.19

• Maintenance: Normalized file line endings for strict PHPCS compliance and optimized internal file segregation.

1.6.18

• Fix: Migrated all premium integrations to a hard file-segregation architecture to guarantee 100% physical codebase compliance with WP.org guidelines.

1.6.17

• Fix: Restructured internal Freemius compiler tags to guarantee 100% physical extraction of premium code from the Free distribution.

1.6.16

• Fix: Physically stripped remaining premium-only frontend configuration settings and UI elements from the free distribution to strictly comply with WP.org Trialware guidelines.

1.6.15

• Maintenance: Updated Freemius SDK to version 2.13.3 for improved compatibility and security.

1.6.14

• Fix: Unified AJAX capability routing to resolve Guest/Subscriber permission conflicts and enforced unconditional database cleanup upon uninstallation.

1.6.13

• Fix: Implemented context-aware AJAX capability routing for frontend/backend uploads and finalized trialware data isolation.

1.6.12

• Security hardening of chunk-upload routing endpoints and complete extraction of unused frontend option configurations from the core dashboard.

1.6.11

• Fix: Removed non-functional frontend upload UI settings from the free dashboard to comply with WP.org Trialware guidelines.

1.6.10

• Fix: Excluded development testing scripts (install-wp-tests.sh) from the distribution package to comply with WP.org repository guidelines.

1.6.9

• Security: Added late escaping for view helpers.
• Fix: Enforced strict JavaScript and DOM prefixing for WP.org compliance.
• Fix: Corrected Freemius logic stripping integration.

1.6.8

• Fix: Aligned plugin header names to resolve WP.org Plugin Check (PCP) mismatch warning.

1.6.7

• Security hardening and refactored naming architecture.

1.6.6

• Feature: Added a new setting "Force Vimeo Only" for Tutor LMS. When enabled, it locks the lesson video source to Vimeo and displays a "This platform uploads to Vimeo only" message, streamlining the instructor upload experience.

1.6.5

• Fix: Resolved Composer autoloader fatal error by restoring required production polyfills (symfony/polyfill-mbstring and related packages) that were incorrectly stripped by over-broad .distignore rules.

1.6.4

• Security: Wrapped shortcode output in wp_kses() with explicit iframe allow-list (XSS hardening).
• Security: Updated SweetAlert2 from v11.1.4 to v11.26.25.
• Fix: Changed admin menu position from 5 to 85 to avoid conflicts with core WordPress menu items.
• Refactor: Added upvimeo_video as canonical shortcode tag; old tags (upv_vimeo_video, vimeo_video, UPVIMEO_vimeo_video) kept as deprecated backward-compat aliases.
• Build: Hardened .distignore and .gitattributes to strip all dev-only Composer packages from distribution builds.
• Build: Added upload-modal.source.js documentation to == Source Code == section.

1.6.3

• Compatibility: Tested and verified compatible with WordPress 7.0 "Armstrong".
• Maintenance: Updated Tested up to header to 7.0 to reflect verified compatibility.

1.6.2

• Build: Hardened .distignore to exclude shell scripts (*.sh) and vendor package test/dev artifacts (tests, .github, docs, phpunit configuration, composer files) from the WordPress.org distribution build. Resolves wp.org rejection caused by .sh fixtures inside third-party Composer dependencies (squizlabs/php_codesniffer, symfony/mime).

1.6.1

• Security: OWASP Top 10 audit — fixed SSRF vulnerability in Vimeo thumbnail fetching by enforcing HTTPS and validating CDN hostnames before any outbound request.
• Security: Patched path traversal risk in chunk-upload file removal; realpath() bounds check now confirms the target file stays inside the tmp directory.
• Security: Fixed authentication-check order in all chunk-upload AJAX handlers — current_user_can() now runs before nonce verification and input parsing.
• Security: Temporary upload directory now creates an index.html guard on first access to prevent directory listing.
• Security: Added esc_url() and absint() escaping to Vimeo link and attachment IDs in the media library helper (XSS hardening).
• Security: Removed <script> tag from wp_kses allowed HTML list in admin class.
• Fix: Removed ob_start() / ob_get_clean() bootstrap wrapper that silently swallowed PHP errors and warnings during plugin load.
• Fix: Implemented full upvimeo_fs_uninstall_cleanup() — plugin now correctly deletes all options, upvimeo-upload posts, and transients on uninstall.
• Fix: UPVIMEO_MIN_PHP_VERSION constant corrected from 7.3.0 to 7.4.0 to match the Requires PHP header declaration.
• Fix: wp_die() message on missing vendor dependencies is now escaped with esc_html__() and translatable.
• Fix: Replaced current_user_can('administrator') (role name) with current_user_can('manage_options') (capability) per WordPress coding standards.
• Fix: Removed double json_encode() wrapping inside wp_send_json_success() in the attachment-delete AJAX handler.
• Fix: Added public visibility modifier to plugin_action_links() method in the admin class.
• Build: Removed Update URI plugin header to eliminate WP.org Plugin Check (PCP) plugin_updater_detected error; Freemius SDK handles Pro updates independently.
• Build: Updated .distignore and .gitattributes with a comprehensive exclusion list to strip all development artifacts from distribution builds.

1.6.0

• Fix: Addressed persistent 403 "Sorry, you are not allowed to access this page" error by restoring native Freemius capability routing.
• Refactor: Replaced destructive menu unsetting techniques with non-intrusive CSS/JS UI manipulation to safely hide duplicate pricing tabs.

1.5.9

• Fix: Resolved fatal error (TypeError: urlencode()) by removing invalid custom redirect logic for the Freemius trial banner.
• Fix: Natively corrected the Freemius trial banner 403 error by enabling proper pricing menu registration in the SDK configuration.

1.5.8

• Fix: Resolved WordPress.org Plugin Check (PCP) deployment failure by excluding hidden files from build.
• Fix: Suppressed broken Freemius trial UI banner preventing 403 errors.

1.5.7

• Security: Comprehensive security audit, fortified AJAX endpoints with strict capability checks and nonces.
• Security: Enhanced SQL injection protection by strictly enforcing $wpdb->prepare for database interactions.
• Security: Implemented strict late-escaping guidelines via wp_kses_post and native HTML esc_ functions for all outputs.
• Enhancement: Optimized deployment configuration by refining .distignore and Freemius Update URI logic for repository compliance.

1.5.6

• Fix: Resolved a fatal Server Error (TypeError: ftp_pwd()) during WP-Cron or CLI headless executions by safely refactoring directory verification logic.

1.5.5

• Fix: Corrected the SDK inclusion path to utilize the updated Composer package instead of a legacy directory.

1.5.3

• Fix: Resolved a minor bug.

1.5.2

• Feature: Added 14-day free trial configuration without upfront payment requirement.

1.5.1

• Enhancement: Minor deployment configuration updates to exclude composer.lock from the final build.

1.5.0

• Security: Added comprehensive CSRF protection with strict Nonce verification across all AJAX and form handlers.
• Security: Fortified data processing with strict unslashing and sanitization for all global inputs ($_POST, $_GET, $_FILES) to prevent Stored XSS vulnerabilities.
• Security: Enhanced output escaping for frontend views, HTML attributes, and Exception messages to prevent Reflected XSS.
• Bug Fix: Resolved an issue where uploaded videos incorrectly defaulted to "Embed Anywhere" instead of accurately inheriting the user's specific Vimeo privacy presets (e.g., "Specific domains").
• Refactor: Prefixed global variables (e.g., $upvimeo_option, $upvimeo_content) to prevent namespace collisions with WordPress core and third-party plugins/themes.
• Refactor: Migrated native PHP rename() operations to the standard WP_Filesystem::move() API for improved cross-server compatibility.
• Cleanup: Removed deprecated Freemius Update URI headers to ensure WordPress.org repository compliance.
• Cleanup: Standardized line endings to LF across all files and removed residual debugging code (print_r(), error_log()).

1.4.12

• Fix: Resolved "No PHP code was found" PHPCS warning by adding standard Silence is golden string to empty PHP file.
• Security: Comprehensive security and compliance audit resolving remaining WordPress.org Plugin Check (PCP) violations.
• Security: Fortified file inclusion with ABSPATH checks and replaced native filesystem functions with WP_Filesystem API.
• Security: Enhanced Freemius Pro build separation using explicit premium file exclusion tags.
• Security: Resolved late escaping, CSRF nonce verification, and missing input sanitization warnings across AJAX handlers and integrations.

1.4.11

• Refactor: Eliminated un-prefixed global variables in template partials for compliance with WordPress coding standards.
• Refactor: Refactored data passing to use the load_template() $args parameter natively.
• Refactor: Prefixed all local variables across admin and public partials with $upvimeo_ to prevent namespace conflicts.

1.4.10

• Fix: Repaired the custom Upvimeo promotional banner on the 'Add Plugins' screen by correcting the broken image source and updating the "Read Setup Guide" target URL.
• Fix: Fixed broken Upvimeo logo paths on the Settings and Library Upload admin pages by dynamically generating properly escaped URLs.
• Fix: Prevented WP Rocket and other caching plugins from lazy-loading Upvimeo logos on admin pages which caused them to appear broken.

1.4.9

• Enhancement: Upgraded Freemius SDK to version 2.13.1.
• Fix: Addressed an issue where the Upvimeo admin menu icon disappeared by directly embedding a base64 encoded SVG asset.

1.4.8

• Enhancement: Optimized build process for WordPress.org repository compliance.
• Enhancement: Updated Freemius SDK configuration for standard Free/Pro distributions.
• Refactor: Moved SweetAlert2 library to the shared assets directory matching WP best practices.
• Fix: Updated .distignore to properly exclude development artifacts from distribution builds.

1.4.7

• Fix: Resolved undefined method error for is_account_tier_free check.
• Refactor: Updated Vimeo API checks to comply with WP.org guidelines.
• Refactor: Improved prefixing guidelines implementation.
• Fix: Resolved Upload Icon Bug (SyntaxError: Identifier 'fields' has already been declared).
• Fix: Fixed HTML Comment Issue behind the "upload new" button.
• Refactor: Enhanced WordPress late-escaping guidelines compliance.
• Refactor: Optimized $_FILES iteration to prevent unintended processing.
• Refactor: Upgraded sanitization and escaping for superglobals ($_SERVER, $_REQUEST, $_POST, $_FILES).
• Fix: Handled Video Upload Errors (403 Forbidden on AJAX request).

1.4.6

• Fix: Addressed an orphaned admin_footer hook causing a fatal error in the admin dashboard.
• Fix: Resolved an issue where the Freemius Account page displayed "Free version" despite having an active Pro plan by dynamically checking the UPVIMEO_IS_PRO constant.

1.4.5

• Fix: Resolved the black screen issue and missing titles in the video editor.
• Fix: Fixed WPCS Regressions resulting in "Visible Code" bugs and missing UI elements.
• Fix: Addressed an "Undefined variable $dir" error in helpers.php.
• Fix: Fixed a fatal error in the pricing page by removing invalid Freemius SDK calls.
• Security: Ensured proper Freemius Pro feature validation and implemented fallback UI for expired licenses.
• Refactor: Global clean-up removing development artifacts and prefixing variables.
• Refactor: Modernized Welcome Screen with a new Hero Banner layout and conditional Free/Pro CTAs.
• Maintenance: Fixed automated plugin scan issues including load_plugin_textdomain and readme metadata.

1.4.4

• Fix: Resolved UI alignment issues and corrected CSS flex layouts for the admin Welcome / Setup instructions card.

1.4.3

• Security: Comprehensive WordPress Coding Standards (WPCS) audit and fixes across the entire codebase.
• Prefixing: Ensured all global variables, functions, and hooks are properly prefixed with upvimeo_.
• I18n: Added missing text domains and translator comments for improved localization.
• System: Replaced native unlink() with WordPress-standard wp_delete_file() for better file system handling.
• Integrations: Hardened security checks (Nonce verification) and data sanitization for ACF, Gravity Forms, WPForms, and Custom Forms.

1.4.2

• Fix: Removed Update URI to comply with WordPress.org guidelines.
• Fix: Resolved Author URI mismatch issue for directory submission.
• Refactor: Separated Pro features (including Freemius SDK) into a dedicated folder strictly for the Premium version.
• Optimization: Cleaned up unnecessary development artifacts from the main plugin distribution.

1.4.1

• Enhancement: Updated Gravity Forms upload field with modern UI (Drag & Drop, Progress Bar).
• Security: Hardened input sanitization for form integrations.

1.4.0

• Security: Comprehensive audit; hardened sanitization and SQL query preparation.
• Performance: Implemented database query caching.

1.3.9

• New: Completely redesigned WPForms upload field with a modern, card-style UI.
• Improvement: Added real-time upload percentage display.
• Improvement: Enhanced progress bar visualization and spacing.
• Fix: Resolved issue with progress bar visibility on some themes.
• Fix: Refined Gravity Forms upload field styling (Modern UI, clean container).
• Fix: Fixed LearnDash upload modal progress bar percentage visibility.

1.3.8

• FIX: Refined Gravity Forms upload field styling (Modern UI, white card, blue button).
• FIX: Refined WPForms upload field styling (Modern UI, white card, blue button).
• FIX: Removed green checkmark circle from success state in both Gravity Forms and WPForms.
• FIX: Improved success UI (progress bar turns green on complete).
• FIX: Fixed LearnDash upload modal progress bar percentage visibility/positioning.

1.3.7

• Fix: LearnDash Integration: Resolved issue where video URL was saved as a player.vimeo.com link instead of the standard vimeo.com format, ensuring correct embed rendering.

1.3.6

• Fix: Elementor Compatibility: Resolved "Infinite Loading" loop in Elementor Editor by implementing comprehensive safety guards across all integrations (TutorLMS, LearnDash, Gravity Forms, WPForms, ACF).
• Fix: Performance: Prevented heavy upload scripts from loading in Elementor Editor to improve performance and stability.

1.3.5

• Enhancement: Gravity Forms UI Modernization: Completely refreshed the upload field with a clean container, smooth gradient progress bar, and animated success checkmark.
• Fix: TUS Upload Reliability: Implemented synchronous upload fallback for Gravity Forms to resolve background process failures on certain hosts (localhost/staging).
• Fix: License Validation: relaxed strict Pro license checks to allow smoother uploads on local development environments.
• Maintenance: Removed legacy debug logging for better performance and security.

1.3.4

• Enhancement: LearnDash Integration: Automatically inserts video URL into "Video URL" field after upload.
• Fix: Privacy Conflict: Resolved issue where "Hide from Vimeo" videos displayed as empty windows by enabling embed permissions.
• Fix: LMS Compatibility: Updated URL format to player.vimeo.com for better LMS preview compatibility.
• Enhancement: UI/UX: Improved Upload Modal responsiveness and styling for a modern look.
• Security: Verified upload handling and privacy permission logic.

1.3.3

• Security: Fixed potential XSS in admin settings by sanitizing output.
• Security: Enhanced input validation and JSON handling in AJAX actions.

1.3.2

• Fix: Resolved "Infinite Loading" loop in Elementor Editor by adding robust safety guards.
• Fix: Resolved "Access Denied" error on Pricing/Account pages for Pro users.
• Fix: Resolved potential PHP fatal error in admin class regarding db_helper.
• Security: Comprehensive OWASP Top 10 security audit and validation.

1.3.0

• New: Brand New Welcome Experience: Completely redesigned Setup Guide with enhanced visuals and clearer instructions.
• Enhancement: Modernized UI: Major design updates to the "Upgrade to Pro" page, giving it a premium look and feel.
• Fix: Upgrade Page Loading: Resolved an issue where pricing tables would sometimes fail to load on the Free version.
• Enhancement: Logo & Branding: Improved Upvimeo logo visibility and positioning across the admin dashboard.
• Enhancement: Button UX: Refined button sizing and hit areas for a better user experience on high-DPI screens.
• Fix: Minor CSS adjustments for better compatibility with third-party admin themes.

1.2.13

• Enhancement: Improved Admin Dashboard stability and menu performance.
• Enhancement: Optimized admin menu structure for a cleaner, more professional workspace.
• Enhancement: Redesigned the Welcome / Setup banner for better responsiveness on smaller screens.
• Fix: Resolved minor UI inconsistencies in the settings area.

1.2.12

• Fix: Resolved CSS loading consistency on the Account page.
• Fix: Improved layout rendering for Account Details header.

1.2.11

• Fix: TutorLMS integration - fixed progress bar visibility issue.

1.2.10

• Fix: TutorLMS integration - automated field visibility interactions.

1.2.9

• Enhancement: Major UI Overhaul: Modernized User Interface with card-based design and improved typography.
• Security: Comprehensive security audit and hardening (OWASP standards).
• Enhancement: Improved handling of Vimeo domain fetching for various plan types.

1.2.8

• Enhancement: Modernized Gutenberg block UI.
• Fix: Improved TUS protocol stability for large files.

1.2.7

• Security: Admin interface hardening and escaping verification.
• Security: Enhanced API error handling.

1.2.6

• Enhancement: Complete Admin Interface refresh.
• Enhancement: Gravity Forms UI improvements.
• Fix: Admin menu positioning fixes.

1.2.4

• Fix: WPForms success message race condition resolved.
• Stability: Process Manager optimization.

1.2.3

• Enhancement: WPForms styling updates.
• Fix: Builder rendering improvements.

1.2.0

• Enhancement: Unified Account management interface.
• Fix: Menu structure optimization.

1.0.0

• Initial Release.