Securitycheck Pro for WordPress 2.4.3 released

I have updated Securitycheck Pro for WordPress to version 2.4.3 to fix some bugs and add improvements:
+ Fixed the firewall's XSS filter blocking legitimate content (e.g. images) saved by users allowed to publish unfiltered HTML (block editor, classic meta boxes such as event or custom field plugins, classic editor), which caused "Updating failed. The response is not a valid JSON response" errors and added the user to the dynamic blacklist; the XSS filter no longer applies to content these users send from the site itself, while requests coming from other websites and URL parameters are still filtered (new "Do not apply the XSS filter to trusted users" option, enabled by default)
+ Added field exceptions: a filter can now be disabled for a single field of a single URL, directly from the Firewall Logs ("Add field exception" button) or in Firewall Configuration > Exceptions > Fields
+ Fixed URL exception lists with more than one comma-separated value never matching any URL; each value is now compared with the beginning of the URL path, ignoring the query string, so it can no longer be bypassed by adding the excepted URL to the query string (lists with several values, which previously had no effect, now take effect, so please review them)
+ Fixed the firewall not inspecting values nested more than two levels deep in request parameters (e.g. a[x][y][z])
+ Fixed the "Forbid new admin accounts" protection not recording the deleted account's username or origin in the Firewall Logs: the log now shows the removed username and the account's registration IP (labelled unverified, kept out of the IP column so it can't be blacklisted by mistake), and the entry and its alert email are no longer suppressed by the per-IP daily log limit
+ Hardened the "you cannot blacklist your own IP" safeguard so it also applies to the dynamic blacklist (previously only the static blacklist), preventing an administrator from locking themselves out
+ Fixed the daily alert-email limit never being applied (the counter was never incremented), which could let notification emails flood the administrator; the configured From address/name and HTML content type are now applied

Special thanks to Ad for reporting this issue in such detail.

Regards,
Jose