Quote from Ross on June 17, 2026, 22:09

Hello

We checked the plugin code carefully comparing the current version with the previous one. Here is what was changed and our conclusion.

File classes/shortcodes.php, line 835:

Old code:
get_template_part('mdf_templates/' . $template . '/index');

New code:
get_template_part('mdf_templates/' . basename($template) . '/index');

This was a security fix to prevent path traversal. The basename() call strips any directory path from the template name, leaving only the last segment.

File ext/helper.php, SQL query building functions (mdf_post_title_filter, mdf_post_content_filter, mdf_post_title_or_content_filter, mdf_post_title_and_content_filter):

Old code used raw string interpolation like:
$words[$key] = " post_title LIKE '%{$word}%' ";

New code uses proper WordPress prepared statements:
$words[$key] = wpdb−>prepare("posttitleLIKEwpdb->prepare(" post_title LIKE %s ", '%' . $wpdb->esc_like( wpdb−>prepare("postt​itleLIKEword) . '%');

This was a security fix for SQL injection. No functional change for normal use cases.

Our conclusion: neither of these changes should affect the display of results via [mdf_results_by_ajax]. The rest of the code between versions is identical in logic, only formatting/indentation differs.

Our best guess for your issue: if you are using a custom template for results (for example, the template= parameter in your shortcode, or the search_result_tpl setting pointing to a path like mdf_templates/some/subfolder/index), the basename() change may now be stripping the subfolder part and the template can no longer be found, resulting in empty output.

Could you check your shortcode and widget settings and tell us what value you have for the template or search_result_tpl parameter?

Place please actual purchase code of the plugin into the private area of this ticket: (if version is premium)
https://share.pluginus.net/image/i20230222134241.png
https://share.pluginus.net/image/i20230222134615.png
https://share.pluginus.net/image/i20230222134511.png

Quote from Zetema on June 18, 2026, 09:43

[spoiler][/spoiler]

Hi,
first of all, thanks for your reply.
I entered the license code as requested.

On my site, I use this shortcode
[spoiler] [mdf_results_by_ajax shortcode="mdf_custom template=any/scuole_Rox24 post_type=schedadidattica orderby=date order=desc page=0 per_page=12 pagination=tb meta_data_filter_cat=86" animate=0 animate_target=body][/spoiler]

While on my template page, I use these variables:

[spoiler]

<?php if (!defined('ABSPATH')) die('No direct access allowed'); ?>
<?php
wp_enqueue_style('scuole_ROX', get_template_directory_uri() . '/mdf_templates/any/scuole_ROX/css/bootstrap.min.css');
wp_enqueue_style('scuole_ROX', get_template_directory_uri() . '/mdf_templates/any/scuole_ROX/css/styles.css');
global $mdf_loop;
MDTF_SORT_PANEL::mdtf_catalog_ordering();
?>

[/spoiler]

What should I do to make this update work?

You can now view the site online with version 2.3.0.1. [spoiler]https://scuole.museiincomuneroma.it/per-la-tua-classe/risultati-2/?slg=schedadidattica&mdf_cat=86&page_mdf=a669e7f9541bcb62fbfb0c9071b607b7[/spoiler]

Quote from Alex Dev on June 19, 2026, 14:59

Hello

Thanks for digging into this and for your patience.

We checked it on our side and confirmed the issue. In the last update we added a security fix that used the basename() function to clean the template path, but this also strips out subfolders, which is why a template path like any/scuole_Rox24 stopped working and your results page showed no content.

Could you please replace this line in the file classes/shortcodes.php:

Find:

get_template_part('mdf_templates/' . basename($template) . '/index');

AND replace to:

$template_parts = explode('/', str_replace('\\', '/', $template));
$template_parts = array_filter($template_parts, function($p) {
    return $p !== '' AND $p !== '.' AND $p !== '..';
});
$safe_template = implode('/', $template_parts);
get_template_part('mdf_templates/' . $safe_template . '/index');

This keeps the same protection against path traversal, but it allows template paths with subfolders to work normally again, like in your case.

Could you please test this on your site and let us know if your results page is working again with your template? If this solves your issue, we will include this fix in the plugin and release it in one of the upcoming updates.

Looking forward to hearing if this resolved the problem.

Quote from Zetema on June 23, 2026, 09:04

Okay, thank you very much for your analysis and proposed solution.
I'll try to follow the instructions in the next few days and give you feedback on the resolution.
See you soon.

Quote from Alex Dev on June 24, 2026, 12:04

You are Welcome!