Sparkling – Free Flat Design WordPress Theme

• Theme Documentation

= 2.6.3 =

• Welcome screen: fixed the Recommended Plugins tab, which 2.6.2 broke. Core styles .plugin-card for a plain .wrap page, but the tab rendered inside .about-wrap, and about.css restyles p, h3 and img for everything inside it and loads after list-tables.css. Core’s flex layout for the card grid is also scoped to the .plugin-install-php body class, which only exists on plugin-install.php. Together those collapsed #the-list to zero height and inflated cards to ~1950px tall. The plugin tabs now close .about-wrap after the tab navigation and render in a plain .wrap, and the page borrows core’s plugin-install-php body class, so the card grid, equal-height cards and responsive columns all come from core. Verified at 900-1920px: 2 columns up to 1440, 3 columns from 1680, no overlap, no ragged rows, card heights 294-387px. Still no theme CSS for this tab.

= 2.6.2 =

• Welcome screen: rebuilt the Recommended Plugins tab on core’s own markup.
• The plugin cards were hand-rolled with ~80 lines of custom CSS: a fixed 315px height, absolutely positioned bars, a padding-right hack to clear the button, and text-overflow:ellipsis. Plugin names were truncated, the dark "Active:" bar overflowed the card, and the action button sat on top of it.
• The tab now renders core’s plugin-card markup — the same structure wp-admin uses on Plugins > Add New — so the grid, buttons, icon placement and responsive behaviour all come from core’s plugin-install stylesheet. Active plugins use core’s disabled "Active" button instead of a custom dark bar, and each card gains a description, author, "More Details" link and a version/status footer.
• Deleted the 80 lines of CSS this replaced (welcome.css: 206 -> 124 lines). The tab now ships no theme CSS at all.
• Core’s plugin-install assets are enqueued on admin_enqueue_scripts instead of inside the section template, which ran after the head was printed and only landed via late styles.
• welcome.css was loading on every admin screen; it is now scoped to the welcome page.
• The tab no longer breaks when wordpress.org is unreachable: plugins_api() returning WP_Error was previously dereferenced directly.

= 2.6.1 =

• Fixes found by testing against a real site (30 posts, 19 pages, Jetpack and five other plugins) on nginx + MySQL + PHP 8.5.3.
• Front page slider: fixed a regression introduced in 2.5.0. Swapping the slider’s image size to the fixed 1140px ‘sparkling-featured-fullwidth’ made slides narrower than the viewport on wide screens, and flexslider.css renders slide images at their natural width, so they were centred with blank gaps either side. The slider now requests ‘full’ (which is what 2.4.11 effectively served) and style.css restores the width:100% fill that flexslider.css declares and then overrides with width:auto further down. Slides now fill the slider from 375px to 1920px, and srcset still serves an appropriately sized candidate.
• Front page slider: with the slider enabled but no post in the chosen category carrying a featured image, the theme printed an empty <div class="flexslider"><ul class="slides"></ul></div> that FlexSlider could not initialise. The markup is now only emitted when there is at least one slide.

= 2.6.0 =

• Removes the bundled Epsilon framework in favour of WordPress-native Customizer APIs.
• Deleted inc/libraries/epsilon-framework (38 files, 436K). The theme used exactly one thing from it: a checkbox control, seven times. The "recommended actions" and "pro" sections it also loaded were registered but never instantiated.
• Its AJAX layer registered handlers with no nonce and no capability check, including a dispatcher that invoked static methods named in $_POST. Practical impact was limited (narrow class allowlist, return value discarded), but any logged-in user could reach it, and count() on a non-array $_POST value was a PHP 8 fatal. That surface is now gone entirely.
• Replaced Epsilon_Control_Toggle with Sparkling_Customize_Toggle_Control, a self-contained WP_Customize_Control. The control is presentation only — values are stored and sanitised by the WP_Customize_Setting it attaches to — so no saved setting changes. Verified: the Customizer renders pixel-identically, and toggling a setting round-trips to the same stored values as before (1 / ”).
• Epsilon_Control_Toggle remains as a deprecated alias so child themes that registered their own controls with it keep working. Verified against a simulated child theme.
• Ported the on/off switch and tooltip styles into assets/css/customizer.css, loaded only on the Customizer controls screen, and added a visible keyboard focus state the original switch lacked.
• Fixed a latent fatal in sparkling_customize_register(): get_setting() returns null for an unregistered setting, and assigning ->transport on null is fatal on PHP 8. Each setting is now checked first.

= 2.5.0 =

• Compatibility, security and maintenance release. Verified against WordPress 7.0.2 on PHP 8.5. Security
• Fixed an unauthenticated site configuration change. sparkling_set_pages() was hooked to admin_init with no capability or nonce check. admin-ajax.php fires admin_init before its authentication branch, so any anonymous request to admin-ajax.php?action=sparkling_set_frontpage could switch show_on_front. It is now an authenticated wp_ajax_ handler requiring manage_options and a nonce.
• Removed sparkling_activate_plugin() and sparkling_deactivate_plugin(). Both acted on query parameters without verifying a nonce, making them CSRF-exploitable against an administrator. Nothing in the theme linked to them; the recommended-plugins tab uses core’s own nonced URLs.
• Added nonce and capability checks to the welcome screen’s AJAX dismiss handlers, which also echoed $_GET[‘id’] unescaped (reflected XSS).
• Added a nonce and capability check to the sparkling_get_attachment_media AJAX endpoint.
• sparkling_sanitize_hexcolor() returned its raw input when validation failed, so arbitrary text could be stored and printed into the theme’s inline <style> block. Invalid values are now rejected, and every colour is re-validated at output time.
• Removed html_entity_decode() from the legacy custom CSS output, which could turn escaped markup back into a live </style><script> break-out.
• Escaped tag names, author display names, author bios and post titles in the single post and comment templates. These render user-supplied data, so a contributor could previously store markup that executed for every visitor.
• …and 26 further changes

= 2.4.11 =

• Tested up to WordPress 6.8.

• Added WooCommerce support
• Removed legacy code
• Improved layout manager
• Added options for sticky/fixed navigation.

= 2.1.1 =

• Removed redundant function

= 2.1.0 =

• Added WP-PageNavi support
• Fixed option for comment section on static pages
• Fixed problem with French translation

= 2.0 =

• Removed Options Framework in favor to WordPress Theme Customizer. Be careful with this update as it might break things.
• Added layout selector for individual posts/pages.
• Other code cleanups and improvements.

= 1.9.3 =

• Improved menu color customization options
• Prepared theme for WordPress 4.3 update.

= 1.9.2 =

• Fixed minor bug with attachment pages.
• Fixed minor bug with navigation submenu color on mobile devices.
• Other menu styling improvements
• Added Simplified Chinese thanks to KagurazakaKotori

= 1.9.1 =

• Fixed two minor bugs in custom theme widgets

= 1.9.0 =

• Introduced option to change full content vs excerpt for blog page.
• New option to disable comments on static pages via Customizer
• Removed redundant search form override
• Added Spotify icon
• Updated FontAwesome library to 4.3
• Added Indonesian translation

= 1.8.5 =

• Properly escaped all translation strings
• Updated translation files

= 1.8.3 =

• Added Czech translation
• Added Ukrainian translation thanks to Vladyslav
• Added Traditional Chinese thanks to ShuChun

= 1.8.2 =

• Fixed overlapping CSS selectors when using tag called “navigation”.
• Improved coding for author box below post content
• Author box is now visible only if there is a author bio/description to show.

= 1.8.1 =

• Removed accidently added string from header.php

= 1.8.0 =

• Updated Options Framework
• Improved theme translation support
• Added support for WPML multilingual plugin
• Other code tweaks and cleanups
• Added Lithuanian translation

= 1.7.12 =

• Updated Bootstrap framework to 3.3.4
• Fixed comment layout on mobile when multiple levels of comments are present

= 1.7.11 =

• Added Japanese translation

= 1.7.10 =

• Added Bulgarian translation thanks to @pbosakov

= 1.7.9 =

• Added Turkish translation thanks to Ender İskender

= 1.7.8 =

• Improved favicon functionality. Now loaded in WordPress dashboard and frontend.

= 1.7.7 =

• Fixed minor problems with newly introduced title-tag

= 1.7.6 =

• Theme now uses “title-tag” that was introduced with WordPress 4.1
• Updated Bootstrap to 3.3.2

= 1.7.5 =

• Removed front-page.php template. Instead you can use full-width or regular page template on frontpage
• Small code cleanup
• Updated Bootstrap classes for full-width template
• Updated Russian translation

= 1.7.1 =

• Updated Bootstrap to v3.3.1

= 1.7.0 =

• Updated Bootstrap to 3.3.0
• Updated Font Awesome icons to 4.2.0

= 1.6.3 =

• Improved Child Theme support
• Added GitHub Icon

= 1.6.2 =

• Added Romanian translation thanks to Bogdan Patru

= 1.6.1 =

• Added Skype URI support for icons
• Added Persian language thanks to Robert Nicjoo
• Added Portuguese (Portugal) translation thanks to Vasco Cruz

= 1.6.0 =

• Added Portuguese translation thanks to Lucas Mandelli
• Updated Bootstrap to 3.2
• Added more flexibility to slider functions via functions.min.js file.
• Fixed problems with IE 10 & 11
• Updated modernizer
• Added bbPress support
• Improved theme responsiveness

= 1.5.1 =

• Updated German translations
• Added another German translation with more polite form thanks to Steffen Lober

= 1.5.0 =

• Improved Child Theme support
• Recreated Social Icons
• Added SoundCloud and Vimeo icons
• Recreated default WordPress gallery support
• Improved code consistency in extra.php file
• Several other code improvement for main theme functions
• Recreated logic behind color in Theme Options. Now these settings provides with more flexibility.
• Added German translations thanks to Bernd Schray

= 1.4.2 =

• Fixed problem with mobile navigation
• Improved customization options for Navigation bar
• Defined default social icon color.

= 1.4.1 =

• Added Russian translation thanks to Evgeny Able
• Improved Child Theme support
• Updated Dutch translation

= 1.4.0 =

• Fixed next/previous button placement on mobile devices.
• Improved full-width page layout.
• Added Polish translation thanks to jerry1333
• Added Dutch translation thanks to Niels Hoogenhout
• Updated Options Framework to 1.8.0
• Updated FontAwesome to 4.1

= 1.3.0 =

• Added foursquare icon in Sparkling social widget and footer.
• Added Italian translation thanks to Achille D’Aniello
• Added French translation thanks to Antoine Lorence
• Updated translations files
• Updated 404 error page (404.php)
• Improved WordPress default galleries
• Added different content width for full-width pages.

= 1.2.0 =

• Added Spanish translation thanks to Hugo
• Moved some functions from jQuery to PHP to avoid conflicts with plugins and other JavaScript based scripts.
• Improved main theme JavaScript compatibility with other plugins and scripts.
• Added Modernizr for better HTML5 and CSS3 support

= 1.1 =

• Removed all traces from Underscore template that weren’t replaced already. Theme is still based on Underscore but removed some strings to avoid confusion.

= 1.0.4 =

• Changed Author URI.
• Added right heading tag for default widgets

= 1.0.1 =

• Social network urls are now properly escaped using “esc_url”
• Added licensing information for images in theme screenshot
• Updated screenshot
• Improved wp_register_style for Google fonts to be compatible with SSL
• Removed do_shortcodes from extras.php which falls under plugin territory
• Fixed missing .js error.

= 1.0 =

• Initial release