#221- Mary Hubbard On Restoring Trust And Safety, WordPress And WooCommerce Sites Targeted

Issue #221 | May 27, 2025 | Reading time: 19 mins

Hello!

WordPress turned 22, and we’re thrilled to share that WP-Content.co is celebrating its 5th anniversary alongside it! 🎉 It’s been an incredible journey of publishing and growing with the WordPress community.

This week on The WP Week Newsletter, we cover Mary Hubbard’s insights on restoring trust while preserving safety, the latest developments involving Automattic, Matt Mullenweg, and the WP Engine drama, the upcoming Cost of Goods Sold feature in WooCommerce core, exciting new projects, and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by Kinsta, Omnisend, and WP Job Openings

Kinsta Managed Hosting

Kinsta – Highest-rated managed WordPress hosting provider on G2 Check it out →

Omnisend

Boost your sales with email & SMS—without breaking the bank Check it out →

Easy-peasy Recruitment Plugin

Create a career page and start recruiting talents in a few minutes Check it out →

🗣️TALK OF THE TOWN

Mary Hubbard on restoring trust while preserving safety

Mary Hubbard reflects on the recent efforts to rebuild trust by reviewing previously banned accounts with fairness and care. While most were reinstated, some remained blocked due to safety concerns. She emphasizes the need for clearer processes, transparent communication, and shared moderation responsibilities to ensure a healthier, more resilient community.

📰 WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

Introducing the Polyglots Team reps for 2025 and beyond

The team reps for 2025 are Ahmed Kabir Chaion, Nidhi Jain, and Luis Rull.

Second plaintiff to join class action against Automattic, Mullenweg over WP Engine dispute: Ryan Keller, who is suing over WP Engine’s temporary blocked access to WordPress.org, plans to expand his proposed class action and respond to Automattic’s push to dismiss.
The Cost of Goods Sold (COGS) feature is coming to WooCommerce core: The COGS feature, currently in the experimental section, is set to graduate out of beta in WooCommerce 10.0. It helps merchants calculate profit margins, improve inventory and pricing decisions, and track financial performance.
Another fake Cloudflare verification targets WordPress sites: A new Cloudflare infection has once again been targeting WordPress sites. This new iteration of malware mimics a legitimate-looking Cloudflare verification page, which then tricks victims into following various commands and downloading malware.
Remote prompt injection in GitLab Duo leads to source code theft: Researchers found critical vulnerabilities in GitLab Duo’s AI assistant that allowed attackers to steal private source code and confidential data by injecting hidden prompts and malicious HTML. After responsible disclosure, GitLab patched these issues, preventing Duo from rendering unsafe external HTML tags and blocking the exfiltration technique.
Sophisticated & stealthy formjacking malware targets e-commerce checkout pages: The Wordfence Threat Intelligence team recently uncovered a sophisticated formjacking malware targeting WooCommerce sites. This malware injects a fake payment form into legitimate checkout processes and exfiltrates sensitive customer data to a remote Command & Control (C2) server.
Google slashes customer match list minimums in search campaigns to 100 users: Google lowered the customer match list minimum from 1,000 to 100 users, opening the door for smaller advertisers to leverage powerful audience targeting.
Google claims AI search delivers ‘quality clicks’ despite traffic loss: Google claims AI search delivers “more qualified clicks” despite documented traffic losses to websites. Publishers aren’t provided with data to verify Google’s quality claims. Organic traffic is decreasing with AI search while ad performance remains unchanged.
Google announces largest ads bidding update in over a decade: Google launches Smart Bidding Exploration, a new feature to help advertisers unlock untapped conversions by expanding eligible queries without changing audience targeting.
From idea to app: Introducing Stitch, a new way to design UIs: Stitch is a new experiment from Google Labs that allows you to turn simple prompt and image inputs into complex UI designs and frontend code in minutes.

💵 INVESTMENTS, ACQUISITIONS & PARTNERSHIPS

group.one to acquire MiniCRM: group.one has signed an agreement to acquire MiniCRM Zrt. including its Romanian subsidiary MiniCRM Software SRL, a leading provider of CRM solutions for small and medium-sized businesses in Europe.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

WP Engine unveils global survey revealing WordPress offers 44% lower total cost of ownership than proprietary CMS platforms

Based on a survey of more than 1,700 digital decision-makers across the U.S., U.K., and Australia, the report reveals that businesses using WordPress experience up to 44% cost savings compared to those relying on proprietary CMS platforms.

Bringing world-class AI tools to Lithuanian schools: Hostinger along with tech accelerator Tesonet, launched a nationwide initiative offering Lithuanian schools free access to two advanced AI tools, nexos.ai and Hostinger Horizons. The goal behind the initiative is to bring both teachers and students in the 9-12th grades up to speed with the latest developments in AI, ensuring Lithuanian competitiveness on the global stage.
The usage statistics and market share of Elementor: As of May 26, 2025, Elementor powers 12.4% of all websites, and 17.4% of websites that use a known content management system (CMS). In comparison, WordPress is used by 43.5% of all websites.
Patchstack is one of the leading CVE Coordinators: Patchstack has now become the second-largest CNA assigner, surpassing Microsoft, Red Hat, and Oracle, according to data published by CVE.icu. The Top CNA assigner is Mitre.org.
StoreUI.net is looking for a new owner: Remi Corson is looking for interested buyers for StoreUI.net, a headless SaaS solution designed for managing WooCommerce stores.
Rian Rietveld is aiming to improve WordPress accessibility documentation and here’s how you can help: Accessibility expert Rian Rietveld is working to improve WordPress with clear, up-to-date accessibility documentation. After finding that much of the existing content is outdated and limited, she aims to build practical resources, and it will be hosted as an open-source project. This effort needs funding (€7500/month) to cover Rian’s time and travel to contribute at WordCamps with the Accessibility Team.
Katie Keith is looking for a new owner for their Easy Digital Downloads EU VAT WordPress plugin: The plugin is open to acquisition and has shown strong performance, generating $14,712 in revenue over the past year with 61% year-over-year growth, a low 3% refund rate, and solid multi-year renewal rates. The asking price is $44,136 (3× annual revenue).
Radio Station by netmix releases new updates for Pro and Free versions: The free version, Radio Station 2.5.12, now includes updated block translation and element functions, along with a fix for preload player settings in block editing. Radio Station Pro 2.6.9 brings an updated Freemius SDK, Teleporter support for AJAX links, improved reload handling, multiview date syncing, and several bug fixes.
Elementor showcased its new CSS-only carousel: Developed in partnership with Google, it is built using the new UI Element API without requiring JavaScript, resulting in smaller page sizes, improved performance, and better accessibility.
Gravity Wiz launches Spellbook: Spellbook is their new lightweight platform plugin that lets users manage all their Gravity Wiz products in one place inside WordPress.
Benjamin Zekavica receives the Yoast Care fund for his contribution to the WordPress community: Benjamin Zekavica, a member of the WordPress Core Team, is the latest recipient of the Yoast Care fund.

🚀 NEW PROJECTS

Introducing StellarSites: StellarSites is your shortcut to building a beautiful WordPress website with built-in hosting, security, design tools, and premium plugins pre-installed.
All new WP Bulk Plugin Updater: Developed by Tom McFarlin, this is a PHP tool that automates WordPress plugin updates with individual Git commits, push capabilities, and detailed logging for easy site maintenance.
Devio Chat launching in July: Robert DeVore is launching his new project, Devio Chat, this July, an AI chat tool built for creators, developers, and businesses who want more control, smarter workflows, and answers from multiple AIs, all in one place.
Send by Elementor launched: A lightweight, intuitive email marketing tool built specifically for WordPress and WooCommerce users. Discover more tips and updates on their YouTube channel.
The all-new Rate My Product Page tool: Josh Kohlbach built this tool to help e-commerce store owners instantly assess how optimized their product pages are for conversions.
The Repo: A new way to share and discover WordPress plugins on GitHub: James Welbes has introduced The Repo, a community-powered directory for WordPress plugins and themes hosted on GitHub.
All new User Registration Block for Gravity Forms: The plugin, created by Johnathon Williams, allows users to place the Gravity Forms User Registration Add-On login form directly into any post or page, right inside the block editor.
FluentAffiliate, a new affiliate plugin coming soon: Set to launch soon, FluentAffiliate, a modern affiliate management plugin for WordPress designed to fix the common frustrations with outdated, clunky affiliate tools. Built for creators, agencies, and eCommerce or membership site owners, it offers features like multi-site management, fraud prevention, tiered commissions, and full integration with FluentCRM for email automation.
Dynamic Header & Navigation for Block Themes plugin: The plugin created by Hans-Gerd Gerhards adds a modern sticky header with smooth, animated shrinking effects for both the header and the site logo.
Introducing CardPress: Rodrigo Donini has launched CardPress, a tool that turns your public WordPress.org profile into a beautifully designed shareable card that highlights your avatar, name, badges, and contributions.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

How WordPress community helps you: Scholarships, grants & support programs: Astha Jain explains how the WordPress community supports underrepresented contributors and speakers through scholarships, grants, and fellowships that help cover travel, accommodation, and event costs for attending WordCamps. From Astha Jain.
In conversation with Bridget Willard: Bridget Willard shared her life experience from growing up in a quiet church town and her 25-year marriage to moving to Texas in 2020 and rediscovering herself. She reflects on love, loss, cultural experiences, and her passion for marketing and the WordPress community. From Seriously, Bud?
Speculative Loading, or a brief history of landing a performance feature in WordPress Core: Felix Arntz recounts the two-year journey of bringing the Speculative Loading feature to WordPress Core, detailing how an experimental idea leveraging a new browser API evolved through plugin development, community collaboration, and performance testing led to its official launch in WordPress 6.8. From Felix Arntz.
Matt Mullenweg settles caregiver lawsuits days before trial: Claims of wage theft, discrimination, retaliation, and defamation brought by two former caregivers against WordPress co-founder Matt Mullenweg have quietly settled after a nearly three-year legal battle. From The Repository.
10 Off-page SEO strategies that (still) work: This article outlines 10 effective off-page strategies for agencies, including LinkedIn content, podcasts, YouTube Shorts, Reddit engagement, guest posts, and AI-optimized content. From Rocket.net.
Perspectives on the state of WordPress accessibility: Bet Hannon, Joe Dolson, and Amber Hinds, and lead organizer, Isla Waite, conversed about the current state of accessibility in WordPress, how they see it changing in the future, and what’s in the works for the WP Accessibility Day nonprofit and event this year. From WP Accessibility Day.
Field report: PressConf 2025: . The WP Community Collective (WPCC) was able to connect with key community leaders, promote WPCC, and explore partnerships. Key outcomes included distributing 100+ WPCC zines with GoDaddy, logging over 60 valuable contacts, opening talks with five enterprise brands, recruiting five new members, and gaining important insights for future WPCC programming and governance. From WPCC.
Stop obsessing over image optimization: Remkus de Vries argues that while image optimization is useful, it’s often overemphasized during web performance audits. Most slow websites suffer from deeper issues like poor loading priorities, render-blocking resources, and inefficient rendering paths, not uncompressed images.
The end of mass media? How AI will reshape music, writing, video—and everything else: Instead of shared songs, articles, or videos, people will consume media tailored to their mood, personality, and preferences, created in real time by AI. From WinningWP.
75+ WordPress AI statistics (2025): The article by WP Mayor provides a comprehensive collection of statistics showcasing AI adoption, tools, and trends in WordPress for 2025.
Security tips for WordPress multisite managers: This guide covers best practices to secure your network, from setup and updates to hardening, monitoring, and using tools, plugins, and managed hosting for stronger, simplified protection. From Kinsta.
The future of ecommerce: Product discovery in an AI-driven world: James Kemp highlights that e-commerce is moving from traditional SEO to AI-driven product discovery. AI assistants like ChatGPT provide personalized recommendations, reducing website traffic. Success now relies on structured product data and AI integration. From James Kemp.
Case study: Rapyd Cloud moves fast – Patchstack makes sure it stays safe: Rapyd Cloud integrated Patchstack to secure complex WordPress sites without slowing down. The result, over 1.3M vulnerabilities patched in 6 months, 88K weekly threat triggers blocked, and 15+ hours of support time saved weekly.
What do AI site builders mean for freelancers?: Eric Karkovack explores what AI site builders could mean for the future of freelancing. Do they signal the end of an era? or are they just another tool for the DIY crowd? From The WP Minute.
10 hidden GitHub gems that’ll make you go “holy forking repositories!”: The article explores libraries that enhance visuals, simplify AI and data handling, streamline input formatting, and make web development more interactive. From Dev.to.
How to vibe code: 11 vibe coding best practices to start building with AI: The article offers 11 best practices for “vibe coding” guiding readers on how to go from a rough idea to a usable product by planning ahead, breaking down builds, collaborating with AI tools wisely, and staying flexible throughout the process. From Zapier.
How to tame scope creep in WordPress development: The article explores actionable strategies to anticipate, prevent, and manage scope creep in WordPress development, without burning bridges with clients. From Delicious Brains.
Accessibility Report 2025: The report revealed that 99.89% of HTML emails tested contain accessibility issues categorized as “Serious” or “Critical”. Only 21 emails (< 0.01%) passed all accessibility checks, and so on. From Emailmarkup.
CISO’s guide to web privacy validation and why it’s important: This CISO’s guide provides a practical roadmap for continuous web privacy validation that’s aligned with real-world practices. From The Hacker News.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

Your first custom WP-CLI command in 5 minutes: From WPShout
7 smart ways to use AI in WordPress development: From Kinsta
How to build a CSS-only carousel in WordPress Gutenberg with zero JavaScript: From Jamie Marsland
Diagnosing and fixing a sudden drop in website traffic: A practical guide: From WordPress.com
Implementing a custom block style variation using only JSON files: From Kau-Boys
How to check and manage the version of WordPress and your plugins like a pro: From WP Marmite
How to add schema markup in WordPress (with & without a plugin): From Jetpack

📆 SAVE THE DATES

Do not miss a WordPress event ever again

WordCamp Europe on 5-7 June 2025: Tickets are now available. The schedule has been published.
WPCampus 2025 on July 23–25, 2025: The call for proposals is now open.
WordCamp US on August 26-29, 2025: The call for organizers and sponsor applications is now open.
SomeConf 2025: The event is in the early planning stages. The call for sponsors and speakers is now live.
WordCamp Canada on October 16-17 2025: The call for sponsors is now open.
WordCamp Asia 2026: It is tentatively planned for early February 2026 and the call for organizers is now open.

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS

4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
15% off yearly plans at Videvo (Coupon Code – WPV15)
30% off for 4 months at Cloudways, valid until May 31, 2025 (Coupon code HAPPYWP22)

MORE DEALS

Up to 83% off web hosting plans of Hostinger (The offer is valid from May 1st until May 30th)
Up to 50% off on BookingPress plugin
Up to 70% off on Shared Hosting plans at InMotion Hosting (Till May 29, 2025)
50% off for the first 6 months on all monthly standard plans at Kinsta
50% off 3 months on Liquid Web’s Bare Metal server hosting
20% off for Constellation plugin
60% off for the lifetime plan for the Modern Cart for WooCommerce plugin.