TryonX Release History

Uploaded photos are now identified by their contents and re-encoded on the server; the file name and type sent by the browser are no longer trusted. Previously a crafted upload could be stored with an executable extension in a public folder. Please update.

The garment image is read on the server from the product's own images instead of being uploaded by the browser, so the endpoint can no longer be used to run arbitrary images through your Gemini key

Removed the unused tryonx_store_photo endpoint; upload folders block script execution; API key is sent as a header instead of in the URL; technical API errors are no longer shown to shoppers

Try-on failed when product images were served from a CDN or another domain

Product pages served from a full-page cache showed expired security tokens and could expose one visitor's saved-photo link to others; a cookie was set for every visitor on every page

Rate limit could be bypassed by clearing cookies; it is now per account or IP and only counts requests that reach the AI

Analytics conversion query was incorrect and very slow on stores with many orders; date ranges ignored the site timezone; analytics queries failed on WordPress older than 6.2

.htaccess rules that caused 500 errors for result images on some Apache 2.4 servers; upload folders were rewritten on every page load

Uploaded photo preview never appeared; wrong price shown for shortcode buttons and "Try More Products"; add-to-cart for variations with "Any" attributes; "Try More Products" error for a deleted category; page could stay unscrollable after quickly reopening the window

Try On buttons added to the page after load (infinite scroll, quick view) did not open the window

Variable product variation selector inside the modal — the single flat dropdown only ever displayed the first option and could conflict with themes/swatch plugins that replace native <select> styling. The modal now renders one selector per product attribute (Size, Color, …), matching WooCommerce's native picker, and drives the add-to-cart URL for the result screen

Variable product variation selector — each try-on button now carries its own variation data (single product, shortcode, and archive layouts)

Add-to-cart link uses the selected variation's URL instead of the parent product's generic URL

Variation labels now include attribute names (e.g. Size, Color) so options are distinguishable

Fallback variation loading when get_available_variations() defers to AJAX on large variable products

Fatal error on product pages when themes set global $product to a slug string (Elementor, Hello Elementor, Divi, and similar)

Generated try-on result images showing as broken — upload URLs were missing a slash between folder and filename

Session photo thumbnails not loading in the try-on modal

Session-only try-on no longer requires re-uploading user image

Upload directory paths unified (tryonx-results, tryonx-temp, tryonx-sessions)

$_FILES sanitization bug that broke image uploads

Bug fixes and stability improvements