Release 3.4
September 22, 2026
28 changes
3.4 is built for Bricks 2.4. AT now loads together with the faster Bricks builder, and its toolbar icons and tweaks work again with the redesigned 2.4 toolbar, while still supporting older Bricks versions. This release also fixes a long list of bugs, retires three builder tweaks that Bricks no longer needs, and adds an extensive round of security hardening. We recommend updating.
FIX
License requests now verify SSL certificates
When AT activates or checks your license, it now makes sure it's really talking to the Advanced Themer license server over a secure connection.
FIX
Safer reading of AT page settings
AT now reads its per-page settings more strictly, which closes off a class of attacks that relies on tampered stored data. This is a behind-the-scenes hardening, and your settings work as before.
FIX
Settings import only restores AT options
When you import an AT settings file, only AT's own settings are restored. A modified file can no longer change other WordPress settings. The imported values are also saved the standard WordPress way.
FIX
Advanced CSS: stricter permissions for child theme and WPCodeBox updates
Saving changes to your child theme's stylesheet now follows WordPress's own rule for editing theme files, including sites where theme file editing is disabled. The WPCodeBox sync now only updates style snippets and never touches code snippets.
FIX
Class Importer: only regular web URLs are accepted
The Class Importer now only accepts normal web addresses for remote stylesheets. That blocks attempts to make your server read its own private files or reach internal network addresses.
FIX
Query Manager: PHP errors are no longer displayed
If a custom query in the Query Manager had an error, technical details could be shown on the page. Errors now stay hidden from visitors, and the site's normal error settings are always put back afterwards.
FIX
AI: stricter checks when saving generated images
Only users who are allowed to upload media can save AI-generated images to the Media Library, and AT checks that each file really is an image before saving it.
FIX
AI: better protection for your OpenAI API key
Your OpenAI API key is now better protected. Only users with full builder access can use it, and it no longer appears in the source of the Theme Settings page or of the builder. To change it, type a new key. Leaving the field as it is keeps the saved key.
FIX
Removed unneeded AJAX hooks for logged-out visitors
Some of AT's background actions were also open to visitors who aren't logged in, although only builder users need them. They're now limited to logged-in users, which reduces what's exposed on your site.
FIX
Frontend output of several AT features is now escaped
Values from the dark mode elements, the meta theme color, page transitions and the forced default color scheme are now cleaned before they're added to your pages. Unexpected characters can no longer break your markup or be misused. Your pages look exactly the same.