Reviewer follow-up: adds a publish-specific capability check (publish_xtrc_courses) to the course publish REST endpoint, and composes the certificate PDF stylesheet block from a constant instead of a literal style element (PDF markup, not enqueueable front-end CSS). No DB changes.<\/p>","2.1.8":"
Reviewer round: updates bundled Chart.js to v4.5.1, hardens drip-override nonces, binds the override SQL via prepare(), sanitizes the certificate layout JSON and SCRIPT_NAME, lowers the admin menu position, and drops the deprecated XC_* aliases. No DB changes.<\/p>","2.1.7":"
Plugin Check round 4: rewrites the React course-builder UX: save-failure banner now wraps multi-line and shows the full error message (was truncated at ~360px). Update on a published course no longer hard-blocks when a Quiz lesson has zero questions \u2014 saves with an amber warning. Publish still blocks. No DB changes.<\/p>","2.1.5":" Fixes the React course builder "Save failed \u2014 Quiz not found." error on every Update \/ Publish of a course containing a Quiz lesson. Builder now sends Adds plugin-row Settings \/ Upgrade \/ Docs \/ Support links. Fixes 4 Plugin Check findings: badge-icon upload isset() guard, bulk-token + lesson-player $_GET wp_unslash + sanitize (lesson-player is a regression of work that never reached main), uninstall.php NoCaching suppression. No DB changes.<\/p>","2.1.3":" Fixes the React course builder "Save failed \u2014 Invalid parameter(s): live_meeting_*" error on Video, Text, PDF, Audio, and Quiz lessons. The builder now strips fields irrelevant to the selected content type before PATCHing. No DB or schema changes \u2014 safe to upgrade.<\/p>","2.1.2":" PHPCS \/ Plugin Check round 3: $wpdb call suppressions converted from single-line phpcs:ignore to phpcs:disable\/enable BLOCK form, translators comments added on the Courses list page, $_SERVER \/ $_GET \/ $_FILES reads sanitized, tax_query slow-query suppression added. No DB or behaviour changes.<\/p>","2.1.1":" Admin-menu fixes: Xtreme Courses now sits immediately after Dashboard instead of below Tutor LMS \/ ReviewX \/ Elementor, and editing a course \/ lesson \/ quiz \/ section \/ question no longer collapses the Xtreme Courses sidebar menu. No database changes \u2014 safe to upgrade.<\/p>","2.1.0":" Admin UX restructure: top-level menu moves to position 3, submenus register centrally, new server-rendered Courses page replaces the CPT screen, dashboard gains stat tiles + activity feed, fresh installs see a 4-step welcome wizard. Existing 2.0.x sites upgrade silently, no DB changes.<\/p>","2.0.8":" PHPCS \/ Plugin Check round 2: ~40 $wpdb queries gain the missing PluginCheck DirectDB suppression, real prepare() placeholder-count bugs fixed, nonce checks added to badge \/ leaderboard admin handlers, readme short description rewritten in plain English. No database or behavioural changes.<\/p>","2.0.7":" Plugin Check \/ PHPCS cleanup: WordPress.org compliance round: Chart.js bundled locally (no CDN), Zoom signature endpoint now enforces drip rules, constants renamed to Restores the course builder admin screen for users upgrading from 2.0.1 \u2014 bookmarks and cached links to old post-type slugs are now redirected instead of producing an empty screen. Sweeps stale option keys left over by the 2.0.2 prefix rename. No database schema changes.<\/p>","2.0.2":" WordPress.org Plugin Check compliance: prefix length, inline style extraction, translator label fix. First-time installs only \u2014 internal identifier rename is not back-compatible with 2.0.x installs that already store data.<\/p>","2.0.1":" WordPress.org submission preparation. No database changes \u2014 safe to upgrade from 2.0.0.<\/p>","2.0.0":" This release adds the Analytics admin panel, digest email, improved CSV exports, and a complete uninstall routine. Upgrading from 1.x is seamless \u2014 no manual database migration required.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3568275,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3568275,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3568275,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3568275,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":{"xtreme-courses\/student-dashboard":{"name":"xtreme-courses\/student-dashboard","title":"Xtreme Courses Student Dashboard"},"xtreme-courses\/leaderboard":{"name":"xtreme-courses\/leaderboard","title":"Xtreme Courses Leaderboard"}},"tagged_versions":["2.1.9"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"React Drag-and-Drop Course Builder \u2014 build and reorder sections and lessons visually.","2":"Student Dashboard \u2014 progress rings, resume button, certificates, achievements.","3":"Quiz Engine \u2014 configurable pass threshold, timer, and instant results screen.","4":"Analytics Dashboard \u2014 Chart.js charts for enrollments, revenue, and quiz performance.","5":"Certificate Template Editor \u2014 drag-to-position dynamic text fields on a custom background.","6":"Gamification \u2014 XP bar, badge grid, and leaderboard widget."}},"plugin_section":[],"plugin_tags":[7114,18342,2195,583,286],"plugin_category":[45,53],"plugin_contributors":[266606],"plugin_business_model":[],"class_list":["post-312864","plugin","type-plugin","status-publish","hentry","plugin_tags-courses","plugin_tags-elearning","plugin_tags-lms","plugin_tags-quiz","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_category-ratings-and-reviews","plugin_contributors-xtremplugins","plugin_committers-xtremplugins"],"banners":{"banner":"https:\/\/ps.w.org\/xtreme-courses\/assets\/banner-772x250.png?rev=3568275","banner_2x":"https:\/\/ps.w.org\/xtreme-courses\/assets\/banner-1544x500.png?rev=3568275","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/xtreme-courses\/assets\/icon-128x128.png?rev=3568275","icon_2x":"https:\/\/ps.w.org\/xtreme-courses\/assets\/icon-256x256.png?rev=3568275","generated":false},"screenshots":[],"raw_content":"\n Xtreme Courses<\/strong> is a complete learning management system (LMS) plugin<\/strong> for WordPress. Build structured online courses in a React drag-and-drop builder, sell them through WooCommerce, schedule drip content, run auto-graded quizzes, issue verifiable PDF certificates, and keep students engaged with XP, badges, and leaderboards \u2014 all from your own WordPress site.<\/p>\n\n No upsells. No locked features.<\/strong> There is no \"Pro\" version of Xtreme Courses \u2014 every feature listed on this page ships in the free download and is fully functional out of the box. No upgrade nags, no feature gates, no artificial limits on courses, students, or enrollments.<\/p>\n\n Plugin homepage<\/a> \u00b7 Documentation<\/a> \u00b7 Support<\/a><\/p>\n\n If you've evaluated the established LMS plugins (LearnDash, LifterLMS, Tutor LMS, LearnPress, Sensei) you already know the pattern: the features you actually need to run a paid course business \u2014 certificates, drip scheduling, quizzes, e-commerce checkout, reporting \u2014 are spread across paid tiers and per-feature add-ons. Xtreme Courses is built differently:<\/p>\n\n A free alternative to LearnDash<\/strong>, LifterLMS<\/strong>, Tutor LMS<\/strong>, LearnPress<\/strong>, and Sensei<\/strong> for course creators who want the complete LMS feature set without per-feature pricing.<\/p>\n\n Core Features (Free):<\/strong><\/p>\n\n Technical Highlights:<\/strong><\/p>\n\n This plugin bundles Chart.js v4.5.1<\/strong> (MIT, Copyright 2014-2025 Chart.js Contributors) for the Analytics admin panel. The script is served from the plugin folder at This plugin can connect to one third-party service. It is opt-in<\/strong> \u2014 it is only contacted when an admin or instructor explicitly creates a live lesson and a student attends it. The default install of the plugin does not contact any external service.<\/p>\n\n If an admin or instructor creates a live lesson and pastes a Zoom meeting URL into the lesson, then when a student opens that lesson the plugin will:<\/p>\n\n If you do not use the live-lesson feature (no live lesson with a Zoom URL is ever created), the Zoom SDK is never loaded and Zoom is never contacted.<\/p>\n\n Service provider: Zoom Communications, Inc. Terms of Service<\/a> \u00b7 Privacy Statement<\/a><\/p>\n\n Xtreme Courses is free software: you can redistribute it and\/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.<\/p>\n\n Xtreme Courses is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.<\/p>\n\n You should have received a copy of the GNU General Public License along with Xtreme Courses. If not, see https:\/\/www.gnu.org\/licenses\/gpl-2.0.html.<\/p>\n\n\n Minimum Requirements:<\/strong><\/p>\n\n Recommended:<\/strong><\/p>\n\n Yes. There is no premium version \u2014 every feature on this page (course builder, WooCommerce selling, quizzes, drip content, certificates, gamification, live lessons, analytics) ships in the free plugin with no artificial limits on courses, students, or enrollments.<\/p><\/dd>\n WooCommerce is not required for free courses, but is needed for paid enrollment, subscription-gated courses, bulk enrollment coupons, and revenue analytics.<\/p><\/dd>\n Yes. Xtreme Courses provides a standalone React drag-and-drop course builder in wp-admin, a shortcode\/Gutenberg block for the student dashboard, and a custom lesson player \u2014 no page builder required.<\/p><\/dd>\n Yes. Certificates are generated as PDF files using mPDF (PHP, no external service). Each certificate has a unique ID and a public verification URL.<\/p><\/dd>\n Yes. The gamification system awards XP on lesson and quiz completion. Badge trigger conditions (e.g., \"Complete 1 course\", \"Earn 500 XP\") are configurable in the admin.<\/p><\/dd>\n Yes. Instructors can schedule live lessons with a Zoom meeting URL\/ID. If Zoom SDK credentials are configured, the meeting embeds directly in the lesson page. Without SDK credentials, a styled pre-join card with the meeting link is displayed.<\/p><\/dd>\n Yes. The uninstall routine removes all custom database tables, plugin options, Action Scheduler jobs, and uploaded files in the Full documentation lives at xtremeplugins.com\/docs\/xtreme-courses<\/a>, covering course building, selling with WooCommerce, drip scheduling, quizzes, certificates, and gamification setup.<\/p><\/dd>\n Please use the WordPress.org support forum<\/a> for this plugin, or reach us through xtremeplugins.com\/support<\/a>.<\/p><\/dd>\n\n<\/dl>\n\n\n For the complete release notes for every individual version, see CHANGELOG.md in the source repository.<\/p>","raw_excerpt":"Sell and run online courses on WordPress \u2014 LMS with WooCommerce checkout, quizzes, drip content, certificates, gamification. Free, no upsells.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/312864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=312864"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/xtremplugins"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=312864"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=312864"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=312864"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=312864"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=312864"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=312864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}$_GET['xtrc_bulk_token']<\/code> read so wp_unslash()<\/code> wraps the raw $_GET<\/code> value directly (sniff-compatible pattern). Trims oversize Upgrade Notices to comply with the 300-char guideline. No DB or schema changes.<\/p>","2.1.6":"lesson.quiz_id<\/code> instead of the lesson ID; backend validate_quiz()<\/code> falls back through lesson-ID lookup. No DB or schema changes.<\/p>","2.1.4":"unlink()<\/code> \u2192 wp_delete_file()<\/code>, direct $wpdb<\/code> writes wrapped in proper phpcs:disable\/enable<\/code> blocks, get_posts()<\/code> slow-query suppressions, and certificate-admin input sanitisation tightened. No database, UI, or behavioural changes \u2014 safe to upgrade.<\/p>","2.0.6":"XTREMECOURSES_*<\/code> (old XC_*<\/code> aliases kept for one release), certificate verification page styles properly enqueued. No database changes.<\/p>","2.0.3":"Why Xtreme Courses?<\/h4>\n\n
\n
\n
xc_instructor<\/code> role with scoped access to own courses, student roster, and earnings.<\/li>\n\n
\/xtreme-courses\/v1\/<\/code><\/li>\nBundled libraries<\/h3>\n\n
assets\/js\/vendor\/chart.umd.min.js<\/code> \u2014 no third-party CDN is contacted.<\/p>\n\nExternal services<\/h3>\n\n
Zoom Meeting SDK (optional, used for live lessons)<\/h4>\n\n
\n
https:\/\/source.zoom.us\/zoom-meeting-3.1.2.min.js<\/code> on that lesson page only.<\/li>\nLicense<\/h3>\n\n
\n
xtreme-courses<\/code> folder to the \/wp-content\/plugins\/<\/code> directory, or install directly via the WordPress Plugins screen.<\/li>\n\n
\n
\n
Is Xtreme Courses really free?<\/h3><\/dt>\n
Does Xtreme Courses require WooCommerce?<\/h3><\/dt>\n
Can I use Xtreme Courses without a page builder?<\/h3><\/dt>\n
Are certificates generated server-side?<\/h3><\/dt>\n
Can students earn badges and XP?<\/h3><\/dt>\n
Does Xtreme Courses support Zoom?<\/h3><\/dt>\n
Is my data removed when I uninstall the plugin?<\/h3><\/dt>\n
wp-content\/uploads\/xtreme-courses\/<\/code> directory.<\/p><\/dd>\nWhere can I find documentation?<\/h3><\/dt>\n
Where do I report bugs or request features?<\/h3><\/dt>\n
2.1.9<\/h4>\n\n
\n
POST \/xtreme-courses\/v1\/courses\/{id}\/publish<\/code>) now uses a dedicated publish_course_permissions_check()<\/code> gate. Publishing previously shared the editing gate (edit_post<\/code> ownership only); it now additionally requires the publish-specific primitive capability for the course post type (publish_xtrc_courses<\/code>, resolved from the CPT capability_type<\/code>). An author who can edit a draft but lacks the publish capability is denied \u2014 the permission check now matches the strength of the action. includes\/REST\/class-courses-controller.php<\/code>.<\/li>\n<style><\/code> element, with an expanded comment clarifying that this CSS is parsed by the bundled PDF engine (never streamed to the browser) so wp_enqueue_style()<\/code> does not apply. Every browser-facing script and style in the plugin is registered\/enqueued via wp_register_*<\/code> \/ wp_enqueue_*<\/code>; this block is PDF-document markup, not front-end output. Output is byte-identical. includes\/Certificate\/class-certificate-generator.php<\/code>.<\/li>\n== Changelog ==<\/code> section is trimmed below WordPress.org's 5000-character limit (older per-version entries rolled up; full history retained in CHANGELOG.md).<\/li>\n2.1.8<\/h4>\n\n
\n
filemtime()<\/code>-busted enqueue; the optional mPDF autoloader now loads only from the plugin's own vendor\/<\/code> (the non-portable ABSPATH<\/code> fallback was removed); lowered the top-level admin menu position from 2 to 58; hardened the drip-override nonces to fail closed and moved _wpnonce<\/code> verification to the top of the set\/remove handlers; bound the per-student override IN ()<\/code> lists via %d<\/code> in wpdb::prepare()<\/code>; sanitized the certificate-layout JSON ($_POST['xtrc_cert_layout']<\/code>) and $_SERVER['SCRIPT_NAME']<\/code> at the boundary; assembled the certificate PDF HTML as a returned string and escaped the Courses-list status row with wp_kses_post()<\/code>; and removed the deprecated 2-character XC_*<\/code> constant aliases (the XTREMECOURSES_*<\/code> constants are now the only names). No database or schema changes.<\/li>\n<\/ul>\n\n2.1.x (2.1.0 \u2013 2.1.7)<\/h4>\n\n
\n
2.0.x<\/h4>\n\n
\n
XC_*<\/code> constants renamed to XTREMECOURSES_*<\/code>, folder\/slug\/namespace normalized to xtreme-courses<\/code>, certificate PDF CSS moved to a bundled file, plus numerous escaping, prefix, nonce, and $wpdb<\/code>-suppression fixes.<\/li>\n<\/ul>\n\n1.x<\/h4>\n\n
\n