Homey - Booking and Rental WordPress Theme v2.4.8

Decryption key:

To view the content, you need to Sign In or Register.

Homey - Booking and Rental WordPress Theme v2.4.8
= v2.4.8 =
Note: Clear cache and update all required plugins: Homey Core 2.4.5, Homey Login Register 2.4.5, Homey Membership 1.1.2 and Homey WooCommerce Add-on 1.2.2. This release contains important security fixes; we strongly recommend updating every Homey site.
New

1. The listing calendar's Reserve a Period window now has two options. Block dates (the default) marks every day from the start date to the end date as unavailable, the same as clicking single days in the calendar, and creates no reservation or invoice. Reserve for a guest keeps the previous behaviour and creates a reservation in the host's name for a booking taken outside the site, for example by phone.

Security
This release fixes a large number of security issues found in a full review of the theme and its plugins, including several that could be used without logging in. Thanks to the customers whose reports started this review.

1. Removed or restricted to administrators all maintenance and debug URL parameters that ran for any visitor, including ones that could change listing prices, booked dates or reservation data, or delete records.
2. Fixed SQL injection in the messages dashboard and in the calendar's delete-reservation link.
3. Dashboard pages now stop completely for visitors and users without access. Before, some pages still rendered their content behind the redirect, including the admin user list.
4. Hosts are no longer given the WordPress Editor role. Existing host accounts that received it have it removed automatically after the update.
5. Fixed account takeover through Google login, and removed the discontinued Yahoo (OpenID) login, which could also be abused. New social login accounts get a random password.
6. Extra service prices are now always taken from the listing or experience. Before, the price sent by the browser was trusted, so the booking total could be lowered.
7. Added ownership and permission checks to reservation actions (mark as paid, discounts and expenses, guest payment confirmation), listing and experience editing, approval and hold, seasonal pricing, invoices, messages, reviews and media deletion.
8. Reservation detail pages are now only visible to the guest, the host and administrators.
9. Added CSRF protection (security tokens) to dashboard actions.
10. Guest reservation links for bookings made without logging in now use an unguessable signed code. Booking without login can no longer be used to book or change details in the name of a registered user.
11. Stripe and PayPal webhooks are now verified. Without a Stripe webhook signing secret, events are confirmed directly with Stripe instead of being trusted as sent.
12. Homey Membership: paid packages can no longer be activated through the free package path, and the Stripe checkout price and trial now always come from the package.
13. Homey WooCommerce Add-on: memberships, featured upgrades and instant bookings are only activated once the WooCommerce order is paid. Orders on hold (bank transfer, cheque) wait for the admin to confirm the payment.
14. The contact host forms can only send messages to the listing's host, and are sent from the site's address with the visitor as Reply-To.
15. Uploaded ID documents are now private, stored under random file names, and hidden from the media API and attachment pages.
16. Fixed stored and reflected cross-site scripting (XSS) in listing and experience rules and in the reviews list.
17. Closed the URL that let any visitor delete unverified user accounts, and email verification links can no longer be guessed.
18. Homey Core: removed old, unused Envato API credentials from the plugin.

Changes you may notice

1. Guest reservation links emailed before this update no longer open the reservation. New bookings get new links.
2. Hosts no longer have access to the WordPress admin editor screens. Hosts manage listings from the front-end dashboard as before.
3. Bank transfer instant bookings now show Payment Verification until the WooCommerce order is completed, and featured upgrades paid by bank transfer are applied once the order is completed.
4. Messages sent through the contact host forms now come from the site's email address, with the visitor's address as Reply-To.

Fixes

1. Fixed new accounts being deleted right after registration. The user saw "Your account was created and you can login now!", but login then failed and Forgot password said no user was registered with that email. The spam user check ran even with Check Spam User On Register turned off, and it flagged genuine users when the spam keywords field ended with a comma, when the new user email subject was empty, or when a keyword appeared anywhere in the email, such as the email footer or social links. The check now runs only when the option is enabled, ignores empty keywords and only looks at the new account's username, email and display name. Existing users and administrators are never removed by it.
2. Fixed Delete Spam / Unverified Users deleting users who had only just registered. It now removes only accounts that have not verified their email for more than 24 hours, never deletes administrators, and removes the deleted users' data as well. The daily cleanup now actually runs, and it is unscheduled when the option is turned off.
3. With Login as normal form enabled, users who have not activated their account are now asked to activate it when they log in with their email address, the same as when they log in with their username.
4. The email activation link now works even when no page uses the Dashboard User Profile template. Before, the link in the welcome email was broken on new sites.
5. Users who register as a host now receive the New Registered User Notification Host email instead of the renter one.
6. Registration and forgot password errors now show a readable message instead of [object Object].
7. Fixed the From header of the forgot password email.
8. Guests can now choose the first day of dates the host has blocked as their check-out day on the listing page calendar, the same as with the first day of an existing booking. Before, for example, if a host blocked Saturday 17 to 24 October, guests could not pick Saturday 17 October as the check-out day for a 10 to 17 October stay on the listing page, although the home page search allowed it. That day now also shows as a half-coloured day in the availability calendar.
9. Homey WooCommerce Add-on: fixed reservations paid by bank transfer (BACS) staying on Payment Verification after the WooCommerce order was marked Completed or Processing, while the invoice already showed as Paid. The reservation is now confirmed as booked, and the guest and host receive the booking confirmation email.
10. Reservations made with Reserve a Period no longer record user #1 as the guest. On sites where that account was removed the guest showed as "Deleted", and otherwise the site administrator appeared as the guest. The host who made the reservation is now recorded.
11. Reserve a Period now respects the Want to create invoice if you reserve a period manually setting. Before, it always created an invoice marked as paid with payment method "Self", even when the setting was No.
12. Fixed a fatal error on PHP 8 when reserving a period on a listing with no pending bookings.
13. Fixed listing and experience pages crashing when the Yelp "What's nearby" request failed or timed out.

Decryption key:

To view the content, you need to Sign In or Register.

Homey - Booking and Rental WordPress Theme v2.4.7
v2.4.7 – Released on 10 December 2025
Note: Clear cache and update all required plugins

[New] Limit country option enabled for OSMap
[New] Time will be shown 24 hours if it is set in General settings of the homey options.
[New] Trial base is added in stripe membership package.
[New] Added advanced filter button.
[New] Users can be filtered by ID in the Users list for frontend dashboard page.
[New] New column for Users list page on frontend dashoard that is registered date of user.
[Update] Ical file .ics content creation according to standard.
[Fixed] Full size problem for OSMap in editing mode of the listing.
[Fixed] Type casting of undefined variable in dashboard invoices page.
[Fixed] Email verify icon problem on profile page.
[Fixed] While having a active membership plan, featured listing link fixed.
[Fixed] Review can be added only when user is logged in.
[Fixed] On add/Edit listing validation error classes update.
[Fixed] On search result page listing item link was not proper.
========== Homey membership plugin =============
[Fixed] String added for translation
[New] Trial base membership option

Decryption key:

To view the content, you need to Sign In or Register.

Download Homey v2.4.6 - Booking and Rentals WordPress Theme Nulled Free
Homey v2.4.6 – Released on 8 June 2025
Note: Clear cache and update all required plugins
[New] Emails enable/disable of listings.
[New] Review reply option is added.
[New] [homey_login_form] Shortcode for login form in any page.
[New] List of reservations for new users who don't want to login
[New] The trash option is added for the listings.
[New] On registration user verification is required or not?
[New] Guest user can visit the Reservation detail page with valid link.
[Fixed] Extra services prices
[Fixed] Extra h1 is removed in template-parts/header/header-2.php
6:16
[Fixed] SQL vulnerability is fixed about $sort on messages listing page.

Decryption key:

To view the content, you need to Sign In or Register.

Download Homey v2.4.5 - Booking and Rentals WordPress Theme Nulled Free

https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog

Decryption key:

To view the content, you need to Sign In or Register.

Download Homey v2.4.4 - Booking and Rentals WordPress Theme Nulled Free
5 March 2025

Decryption key:

To view the content, you need to Sign In or Register.

Download Homey v2.4.3 - Booking and Rentals WordPress Theme Nulled Free
Homey v2.4.3 – Released on 28 January 2025
Note: Clear cache and update all required plugins
[Fixed] The vulnerable function: homey_save_profile
[Fixed] The vulnerable function: homey_register
[Updated] Homey-login-register plugin to v2.4.3

Decryption key:

To view the content, you need to Sign In or Register.

Download Homey v2.4.2 - Booking and Rentals WordPress Theme Nulled Free
Homey v2.4.2 – Released on 16 January 2025
Note: Clear cache and update all required plugins
[NEW] New option for search results page to show unit or dates price.
[New] Show all or per page number pins on google map
[New] 2 More options for city fee 1) Per Guest and 2) Daily * Per guest
[Improved] Overall theme security
[FIXED] _load_textdomain_just_in_time new requirement for wordpress 6.7.* for text domain homey
[FIXED] too few parameters provided for stripe.
[FIXED] Syntax correction in the ical export file.
[FIXED] Pagination number in the dashboard messages page
[FIXED] Status not representing about the email approved is fixed.
[FIXED] By default Taiwan number to US number.
[FIXED] Re-captcha issue for no ajax login form
[FIXED] Review not showing on renter profile page
[FIXED] Email parameters options for email content management.
[FIXED] Expired status for the listings in the admin panel.

Decryption key:

To view the content, you need to Sign In or Register.

Note: Clear cache and update all required plugins
[New] New option for search results page to show unit or dates price.
[Fixed] Stripe fatal error when updrage package
[Fixed] _load_textdomain_just_in_time new requirement for wordpress 6.7.* for text domain homey

Decryption Key:

To view the content, you need to Sign In or Register.

Note: Clear cache and update all required plugins
[New] Make possible for admin to create a booking (Reservation) of Listing from Wordpress admin panel.
[New] Phone Number in register form, this can be disable from Homey Options Login & Register.
[New] Different Welcome Mails after register HOST/RENTER
[New] Delete Users which are not verified within 24 hours, this can be disable from homey options.
[New] Protect Spam Users and deleting their record from database using keyword that contains in spam email registration. You can disable this from Homey Options.
[New] The new labels in homey.pot language file.
[New] Header slider turn Auto play on or off.
[Fixed] Membership expiration date issue in wordpress admin panel.
[Fixed] Listing type selected none.
[Fixed] Splash page not opening in Page Editors.
[Fixed] Fields builder form data is not not visible on the Experience information page.
[Fixed] Experience and Listings reservation conflict.
[Fixed] Translatable strings for Extra fields.
[Fixed] Featured Listing payment from stripe issue fixed
[Fixed] Experience search on mobile not works.
[Fixed] On homepage slider listing sort featured first.
[Fixed] Labels on membership plan detail page.
[Fixed] After login redirection to page is fixed.
[Fixed] Instant Hourly Experience booking does not save start or end hour when it requires login.
[Updated] Experiences can be booked without being logged in just provide email address.
[Updated] Woocommerce template pages are updated with latest files.
[Updated] New profile fields added for social links.
[Updated] In about section on able to show Custom Field Builder.
[Updated] On search criteria, price should update like Airbnb, My Booking.
[Updated] Status filter for reservation list page.
[Updated] Homepage slider now auto plays the slides in every 5 seconds by default.
[Updated] Homey Core plugin
[Updated] Homey Login Register plugin
[Updated] Homey Membership plugin
[Updated] Homey WooCommerce addon plugin
[Updated] Slider Revolution plugin
[Updated] WP Bakery plugin

Decryption key:

To view the content, you need to Sign In or Register.

[New] PHP 8.3 compatibility
[New] User login after profile activation options (Yes or no for login).
[New] Enable/Disable user role selection change for one time in the profile page, that is especially for registered users via social platforms.
[New] No ajax form for login issue when you want to use cache plugins that conflicts with the ajax functionality.
[New] Click to approve for the experiences for pending experiences.
[New] Weekend price new option is added Thursday, Friday and Saturday
[New] Start of week day option for the calendar added in homey option general
[Improved] Show the button for Add New Experiences if membership is also related for experience.
[Improved] H2 converted to h1 for SEO purpose.
[Fixed] Fields builder was not working on admin panel
[Fixed] Email host for the Approval of experiences from Admin.
[Fixed] User Role text was not translatable in the user profile.
[Fixed] Membership purchased successfully translation text
[Fixed] Icons was not showing for experience detail page of about section
[Fixed] Amenities and Features when adding new experience was not working
[Fixed] On membership host page the subscription details was not good.
[Fixed] Custom field builder fields missing after theme update
[Fixed] Google map autocomplete error
[Fixed] 503 error on some listings fixed
[Fixed] Experience host contact field for short code
[Fixed] Same listings render on load more button click
[Fixed] Same experiences render on load more button click
[Fixed] Restore the deleted experience reservation function not found
[Fixed] Review rating shows but with 0 reviews
[Fixed] Additional guest price issue when additional guest are more then one.
[Fixed] Service fee for experience was not working with percentage type
[Fixed] Duplicated images on new listing
[Fixed] Price not showing on compare page
[Fixed] Verification id buttons not displayed
[Fixed] Main search form check-in and check-out date can be selected invalid.
[Fixed] in the demo while add/edit experience / separator not shown
[Fixed] Reserve a period was not taking care of Booking mode
[Fixed] If listing is featured show "It is featured" link in My listing page Action menu.
[Fixed] Listing detail page video support for custom link with .mp4 file.
[Fixed] review was not visible in the per hour mode.
[Updated] Homey Core plugin
[Updated] Homey Login Register plugin
[Updated] Slider Revolution Plugin
[Updated] WP Bakery Plugin