diff --git a/assets/css/debug-tools.css b/assets/css/debug-tools.css
index 46e57ebb1..0de8e1eba 100644
--- a/assets/css/debug-tools.css
+++ b/assets/css/debug-tools.css
@@ -1,6 +1,6 @@
 .wcpdf_debug_settings_sections,
 #debug-tools {
-	width: calc(100% - 4em);
+	width: 100%;
 	max-width: 50vw;
 }
 
diff --git a/assets/css/debug-tools.min.css b/assets/css/debug-tools.min.css
index d6294b27b..2b670c1cf 100644
--- a/assets/css/debug-tools.min.css
+++ b/assets/css/debug-tools.min.css
@@ -1 +1 @@
-#debug-tools,.wcpdf_debug_settings_sections{width:calc(100% - 4em);max-width:50vw}#debug-tools{width:100%;margin-top:2em}#debug-tools .wrapper{width:auto;border:1px solid #ccc}#debug-tools .wrapper .tool{padding:20px}#debug-tools .wrapper .tool:not(:last-child){border-bottom:1px solid #ccc}#debug-tools .wrapper .tool h4{margin:0}#debug-tools .wrapper .tool input[type=file]{font-size:14px;line-height:2;color:#2c3338;border:1px solid #8c8f94;box-shadow:none;border-radius:3px;padding:0 24px 0 8px;min-height:30px;max-width:25rem}#debug-tools #danger_zone{margin-top:20px;background-color:#fcf9e8}#debug-tools #danger_zone .notice{margin:0}#debug-tools .add-info{margin-left:6px}#document_custom_redirect_page,#document_custom_redirect_page+.description{display:none}
\ No newline at end of file
+#debug-tools,.wcpdf_debug_settings_sections{width:100%;max-width:50vw}#debug-tools{width:100%;margin-top:2em}#debug-tools .wrapper{width:auto;border:1px solid #ccc}#debug-tools .wrapper .tool{padding:20px}#debug-tools .wrapper .tool:not(:last-child){border-bottom:1px solid #ccc}#debug-tools .wrapper .tool h4{margin:0}#debug-tools .wrapper .tool input[type=file]{font-size:14px;line-height:2;color:#2c3338;border:1px solid #8c8f94;box-shadow:none;border-radius:3px;padding:0 24px 0 8px;min-height:30px;max-width:25rem}#debug-tools #danger_zone{margin-top:20px;background-color:#fcf9e8}#debug-tools #danger_zone .notice{margin:0}#debug-tools .add-info{margin-left:6px}#document_custom_redirect_page,#document_custom_redirect_page+.description{display:none}
\ No newline at end of file
diff --git a/assets/css/jquery-ui.min.css b/assets/css/jquery-ui.min.css
new file mode 100644
index 000000000..b7babfd2e
--- /dev/null
+++ b/assets/css/jquery-ui.min.css
@@ -0,0 +1,7 @@
+/*! jQuery UI - v1.14.0 - 2024-08-05
+* https://jqueryui.com
+* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css
+* To view and modify this theme, visit https://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=glass&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=glass&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=flat&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=flat&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px
+* Copyright OpenJS Foundation and other contributors; Licensed MIT */
+
+.ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:before,.ui-helper-clearfix:after{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:absolute;opacity:0}.ui-front{z-index:100}.ui-state-disabled{cursor:default!important;pointer-events:none}.ui-icon{display:inline-block;vertical-align:middle;margin-top:-.25em;position:relative;text-indent:-99999px;overflow:hidden;background-repeat:no-repeat}.ui-widget-icon-block{left:50%;margin-left:-8px;display:block}.ui-widget-overlay{position:fixed;top:0;left:0;width:100%;height:100%}.ui-accordion .ui-accordion-header{display:block;cursor:pointer;position:relative;margin:2px 0 0 0;padding:.5em .5em .5em .7em;font-size:100%}.ui-accordion .ui-accordion-content{padding:1em 2.2em;border-top:0;overflow:auto}.ui-autocomplete{position:absolute;top:0;left:0;cursor:default}.ui-menu{list-style:none;padding:0;margin:0;display:block;outline:0}.ui-menu .ui-menu{position:absolute}.ui-menu .ui-menu-item{margin:0;cursor:pointer}.ui-menu .ui-menu-item-wrapper{position:relative;padding:3px 1em 3px .4em}.ui-menu .ui-menu-divider{margin:5px 0;height:0;font-size:0;line-height:0;border-width:1px 0 0 0}.ui-menu .ui-state-focus,.ui-menu .ui-state-active{margin:-1px}.ui-menu-icons{position:relative}.ui-menu-icons .ui-menu-item-wrapper{padding-left:2em}.ui-menu .ui-icon{position:absolute;top:0;bottom:0;left:.2em;margin:auto 0}.ui-menu .ui-menu-icon{left:auto;right:0}.ui-button{padding:.4em 1em;display:inline-block;position:relative;line-height:normal;margin-right:.1em;cursor:pointer;vertical-align:middle;text-align:center;-webkit-user-select:none;user-select:none}.ui-button,.ui-button:link,.ui-button:visited,.ui-button:hover,.ui-button:active{text-decoration:none}.ui-button-icon-only{width:2em;box-sizing:border-box;text-indent:-9999px;white-space:nowrap}input.ui-button.ui-button-icon-only{text-indent:0}.ui-button-icon-only .ui-icon{position:absolute;top:50%;left:50%;margin-top:-8px;margin-left:-8px}.ui-button.ui-icon-notext .ui-icon{padding:0;width:2.1em;height:2.1em;text-indent:-9999px;white-space:nowrap}input.ui-button.ui-icon-notext .ui-icon{width:auto;height:auto;text-indent:0;white-space:normal;padding:.4em 1em}input.ui-button::-moz-focus-inner,button.ui-button::-moz-focus-inner{border:0;padding:0}.ui-controlgroup{vertical-align:middle;display:inline-block}.ui-controlgroup > .ui-controlgroup-item{float:left;margin-left:0;margin-right:0}.ui-controlgroup > .ui-controlgroup-item:focus,.ui-controlgroup > .ui-controlgroup-item.ui-visual-focus{z-index:9999}.ui-controlgroup-vertical > .ui-controlgroup-item{display:block;float:none;width:100%;margin-top:0;margin-bottom:0;text-align:left}.ui-controlgroup-vertical .ui-controlgroup-item{box-sizing:border-box}.ui-controlgroup .ui-controlgroup-label{padding:.4em 1em}.ui-controlgroup .ui-controlgroup-label span{font-size:80%}.ui-controlgroup-horizontal .ui-controlgroup-label + .ui-controlgroup-item{border-left:none}.ui-controlgroup-vertical .ui-controlgroup-label + .ui-controlgroup-item{border-top:none}.ui-controlgroup-horizontal .ui-controlgroup-label.ui-widget-content{border-right:none}.ui-controlgroup-vertical .ui-controlgroup-label.ui-widget-content{border-bottom:none}.ui-controlgroup-vertical .ui-spinner-input{width:calc( 100% - 2.4em )}.ui-controlgroup-vertical .ui-spinner .ui-spinner-up{border-top-style:solid}.ui-checkboxradio-label .ui-icon-background{box-shadow:inset 1px 1px 1px #ccc;border-radius:.12em;border:none}.ui-checkboxradio-radio-label .ui-icon-background{width:16px;height:16px;border-radius:1em;overflow:visible;border:none}.ui-checkboxradio-radio-label.ui-checkboxradio-checked .ui-icon,.ui-checkboxradio-radio-label.ui-checkboxradio-checked:hover .ui-icon{background-image:none;width:8px;height:8px;border-width:4px;border-style:solid}.ui-checkboxradio-disabled{pointer-events:none}.ui-datepicker{width:17em;padding:.2em .2em 0;display:none}.ui-datepicker .ui-datepicker-header{position:relative;padding:.2em 0}.ui-datepicker .ui-datepicker-prev,.ui-datepicker .ui-datepicker-next{position:absolute;top:2px;width:1.8em;height:1.8em}.ui-datepicker .ui-datepicker-prev-hover,.ui-datepicker .ui-datepicker-next-hover{top:1px}.ui-datepicker .ui-datepicker-prev{left:2px}.ui-datepicker .ui-datepicker-next{right:2px}.ui-datepicker .ui-datepicker-prev-hover{left:1px}.ui-datepicker .ui-datepicker-next-hover{right:1px}.ui-datepicker .ui-datepicker-prev span,.ui-datepicker .ui-datepicker-next span{display:block;position:absolute;left:50%;margin-left:-8px;top:50%;margin-top:-8px}.ui-datepicker .ui-datepicker-title{margin:0 2.3em;line-height:1.8em;text-align:center}.ui-datepicker .ui-datepicker-title select{font-size:1em;margin:1px 0}.ui-datepicker select.ui-datepicker-month,.ui-datepicker select.ui-datepicker-year{width:45%}.ui-datepicker table{width:100%;font-size:.9em;border-collapse:collapse;margin:0 0 .4em}.ui-datepicker th{padding:.7em .3em;text-align:center;font-weight:bold;border:0}.ui-datepicker td{border:0;padding:1px}.ui-datepicker td span,.ui-datepicker td a{display:block;padding:.2em;text-align:right;text-decoration:none}.ui-datepicker .ui-datepicker-buttonpane{background-image:none;margin:.7em 0 0 0;padding:0 .2em;border-left:0;border-right:0;border-bottom:0}.ui-datepicker .ui-datepicker-buttonpane button{float:right;margin:.5em .2em .4em;cursor:pointer;padding:.2em .6em .3em .6em;width:auto;overflow:visible}.ui-datepicker .ui-datepicker-buttonpane button.ui-datepicker-current{float:left}.ui-datepicker.ui-datepicker-multi{width:auto}.ui-datepicker-multi .ui-datepicker-group{float:left}.ui-datepicker-multi .ui-datepicker-group table{width:95%;margin:0 auto .4em}.ui-datepicker-multi-2 .ui-datepicker-group{width:50%}.ui-datepicker-multi-3 .ui-datepicker-group{width:33.3%}.ui-datepicker-multi-4 .ui-datepicker-group{width:25%}.ui-datepicker-multi .ui-datepicker-group-last .ui-datepicker-header,.ui-datepicker-multi .ui-datepicker-group-middle .ui-datepicker-header{border-left-width:0}.ui-datepicker-multi .ui-datepicker-buttonpane{clear:left}.ui-datepicker-row-break{clear:both;width:100%;font-size:0}.ui-datepicker-rtl{direction:rtl}.ui-datepicker-rtl .ui-datepicker-prev{right:2px;left:auto}.ui-datepicker-rtl .ui-datepicker-next{left:2px;right:auto}.ui-datepicker-rtl .ui-datepicker-prev:hover{right:1px;left:auto}.ui-datepicker-rtl .ui-datepicker-next:hover{left:1px;right:auto}.ui-datepicker-rtl .ui-datepicker-buttonpane{clear:right}.ui-datepicker-rtl .ui-datepicker-buttonpane button{float:left}.ui-datepicker-rtl .ui-datepicker-buttonpane button.ui-datepicker-current,.ui-datepicker-rtl .ui-datepicker-group{float:right}.ui-datepicker-rtl .ui-datepicker-group-last .ui-datepicker-header,.ui-datepicker-rtl .ui-datepicker-group-middle .ui-datepicker-header{border-right-width:0;border-left-width:1px}.ui-datepicker .ui-icon{display:block;text-indent:-99999px;overflow:hidden;background-repeat:no-repeat;left:.5em;top:.3em}.ui-dialog{position:absolute;top:0;left:0;padding:.2em;outline:0}.ui-dialog .ui-dialog-titlebar{padding:.4em 1em;position:relative}.ui-dialog .ui-dialog-title{float:left;margin:.1em 0;white-space:nowrap;width:90%;overflow:hidden;text-overflow:ellipsis}.ui-dialog .ui-dialog-titlebar-close{position:absolute;right:.3em;top:50%;width:20px;margin:-10px 0 0 0;padding:1px;height:20px}.ui-dialog .ui-dialog-content{position:relative;border:0;padding:.5em 1em;background:none;overflow:auto}.ui-dialog .ui-dialog-buttonpane{text-align:left;border-width:1px 0 0 0;background-image:none;margin-top:.5em;padding:.3em 1em .5em .4em}.ui-dialog .ui-dialog-buttonpane .ui-dialog-buttonset{float:right}.ui-dialog .ui-dialog-buttonpane button{margin:.5em .4em .5em 0;cursor:pointer}.ui-dialog .ui-resizable-n{height:2px;top:0}.ui-dialog .ui-resizable-e{width:2px;right:0}.ui-dialog .ui-resizable-s{height:2px;bottom:0}.ui-dialog .ui-resizable-w{width:2px;left:0}.ui-dialog .ui-resizable-se,.ui-dialog .ui-resizable-sw,.ui-dialog .ui-resizable-ne,.ui-dialog .ui-resizable-nw{width:7px;height:7px}.ui-dialog .ui-resizable-se{right:0;bottom:0}.ui-dialog .ui-resizable-sw{left:0;bottom:0}.ui-dialog .ui-resizable-ne{right:0;top:0}.ui-dialog .ui-resizable-nw{left:0;top:0}.ui-draggable .ui-dialog-titlebar{cursor:move}.ui-draggable-handle{touch-action:none}.ui-resizable{position:relative}.ui-resizable-handle{position:absolute;font-size:0.1px;display:block;touch-action:none}.ui-resizable-disabled .ui-resizable-handle,.ui-resizable-autohide .ui-resizable-handle{display:none}.ui-resizable-n{cursor:n-resize;height:7px;width:100%;top:-5px;left:0}.ui-resizable-s{cursor:s-resize;height:7px;width:100%;bottom:-5px;left:0}.ui-resizable-e{cursor:e-resize;width:7px;right:-5px;top:0;height:100%}.ui-resizable-w{cursor:w-resize;width:7px;left:-5px;top:0;height:100%}.ui-resizable-se{cursor:se-resize;width:12px;height:12px;right:1px;bottom:1px}.ui-resizable-sw{cursor:sw-resize;width:9px;height:9px;left:-5px;bottom:-5px}.ui-resizable-nw{cursor:nw-resize;width:9px;height:9px;left:-5px;top:-5px}.ui-resizable-ne{cursor:ne-resize;width:9px;height:9px;right:-5px;top:-5px}.ui-progressbar{height:2em;text-align:left;overflow:hidden}.ui-progressbar .ui-progressbar-value{margin:-1px;height:100%}.ui-progressbar .ui-progressbar-overlay{background:url("data:image/gif;base64,R0lGODlhKAAoAIABAAAAAP///yH/C05FVFNDQVBFMi4wAwEAAAAh+QQJAQABACwAAAAAKAAoAAACkYwNqXrdC52DS06a7MFZI+4FHBCKoDeWKXqymPqGqxvJrXZbMx7Ttc+w9XgU2FB3lOyQRWET2IFGiU9m1frDVpxZZc6bfHwv4c1YXP6k1Vdy292Fb6UkuvFtXpvWSzA+HycXJHUXiGYIiMg2R6W459gnWGfHNdjIqDWVqemH2ekpObkpOlppWUqZiqr6edqqWQAAIfkECQEAAQAsAAAAACgAKAAAApSMgZnGfaqcg1E2uuzDmmHUBR8Qil95hiPKqWn3aqtLsS18y7G1SzNeowWBENtQd+T1JktP05nzPTdJZlR6vUxNWWjV+vUWhWNkWFwxl9VpZRedYcflIOLafaa28XdsH/ynlcc1uPVDZxQIR0K25+cICCmoqCe5mGhZOfeYSUh5yJcJyrkZWWpaR8doJ2o4NYq62lAAACH5BAkBAAEALAAAAAAoACgAAAKVDI4Yy22ZnINRNqosw0Bv7i1gyHUkFj7oSaWlu3ovC8GxNso5fluz3qLVhBVeT/Lz7ZTHyxL5dDalQWPVOsQWtRnuwXaFTj9jVVh8pma9JjZ4zYSj5ZOyma7uuolffh+IR5aW97cHuBUXKGKXlKjn+DiHWMcYJah4N0lYCMlJOXipGRr5qdgoSTrqWSq6WFl2ypoaUAAAIfkECQEAAQAsAAAAACgAKAAAApaEb6HLgd/iO7FNWtcFWe+ufODGjRfoiJ2akShbueb0wtI50zm02pbvwfWEMWBQ1zKGlLIhskiEPm9R6vRXxV4ZzWT2yHOGpWMyorblKlNp8HmHEb/lCXjcW7bmtXP8Xt229OVWR1fod2eWqNfHuMjXCPkIGNileOiImVmCOEmoSfn3yXlJWmoHGhqp6ilYuWYpmTqKUgAAIfkECQEAAQAsAAAAACgAKAAAApiEH6kb58biQ3FNWtMFWW3eNVcojuFGfqnZqSebuS06w5V80/X02pKe8zFwP6EFWOT1lDFk8rGERh1TTNOocQ61Hm4Xm2VexUHpzjymViHrFbiELsefVrn6XKfnt2Q9G/+Xdie499XHd2g4h7ioOGhXGJboGAnXSBnoBwKYyfioubZJ2Hn0RuRZaflZOil56Zp6iioKSXpUAAAh+QQJAQABACwAAAAAKAAoAAACkoQRqRvnxuI7kU1a1UU5bd5tnSeOZXhmn5lWK3qNTWvRdQxP8qvaC+/yaYQzXO7BMvaUEmJRd3TsiMAgswmNYrSgZdYrTX6tSHGZO73ezuAw2uxuQ+BbeZfMxsexY35+/Qe4J1inV0g4x3WHuMhIl2jXOKT2Q+VU5fgoSUI52VfZyfkJGkha6jmY+aaYdirq+lQAACH5BAkBAAEALAAAAAAoACgAAAKWBIKpYe0L3YNKToqswUlvznigd4wiR4KhZrKt9Upqip61i9E3vMvxRdHlbEFiEXfk9YARYxOZZD6VQ2pUunBmtRXo1Lf8hMVVcNl8JafV38aM2/Fu5V16Bn63r6xt97j09+MXSFi4BniGFae3hzbH9+hYBzkpuUh5aZmHuanZOZgIuvbGiNeomCnaxxap2upaCZsq+1kAACH5BAkBAAEALAAAAAAoACgAAAKXjI8By5zf4kOxTVrXNVlv1X0d8IGZGKLnNpYtm8Lr9cqVeuOSvfOW79D9aDHizNhDJidFZhNydEahOaDH6nomtJjp1tutKoNWkvA6JqfRVLHU/QUfau9l2x7G54d1fl995xcIGAdXqMfBNadoYrhH+Mg2KBlpVpbluCiXmMnZ2Sh4GBqJ+ckIOqqJ6LmKSllZmsoq6wpQAAAh+QQJAQABACwAAAAAKAAoAAAClYx/oLvoxuJDkU1a1YUZbJ59nSd2ZXhWqbRa2/gF8Gu2DY3iqs7yrq+xBYEkYvFSM8aSSObE+ZgRl1BHFZNr7pRCavZ5BW2142hY3AN/zWtsmf12p9XxxFl2lpLn1rseztfXZjdIWIf2s5dItwjYKBgo9yg5pHgzJXTEeGlZuenpyPmpGQoKOWkYmSpaSnqKileI2FAAACH5BAkBAAEALAAAAAAoACgAAAKVjB+gu+jG4kORTVrVhRlsnn2dJ3ZleFaptFrb+CXmO9OozeL5VfP99HvAWhpiUdcwkpBH3825AwYdU8xTqlLGhtCosArKMpvfa1mMRae9VvWZfeB2XfPkeLmm18lUcBj+p5dnN8jXZ3YIGEhYuOUn45aoCDkp16hl5IjYJvjWKcnoGQpqyPlpOhr3aElaqrq56Bq7VAAAOw==");height:100%;opacity:0.25}.ui-progressbar-indeterminate .ui-progressbar-value{background-image:none}.ui-selectable{touch-action:none}.ui-selectable-helper{position:absolute;z-index:100;border:1px dotted black}.ui-selectmenu-menu{padding:0;margin:0;position:absolute;top:0;left:0;display:none}.ui-selectmenu-menu .ui-menu{overflow:auto;overflow-x:hidden;padding-bottom:1px}.ui-selectmenu-menu .ui-menu .ui-selectmenu-optgroup{font-size:1em;font-weight:bold;line-height:1.5;padding:2px 0.4em;margin:0.5em 0 0 0;height:auto;border:0}.ui-selectmenu-open{display:block}.ui-selectmenu-text{display:block;margin-right:20px;overflow:hidden;text-overflow:ellipsis}.ui-selectmenu-button.ui-button{text-align:left;white-space:nowrap;width:14em}.ui-selectmenu-icon.ui-icon{float:right;margin-top:0}.ui-slider{position:relative;text-align:left}.ui-slider .ui-slider-handle{position:absolute;z-index:2;width:1.2em;height:1.2em;cursor:pointer;touch-action:none}.ui-slider .ui-slider-range{position:absolute;z-index:1;font-size:.7em;display:block;border:0;background-position:0 0}.ui-slider-horizontal{height:.8em}.ui-slider-horizontal .ui-slider-handle{top:-.3em;margin-left:-.6em}.ui-slider-horizontal .ui-slider-range{top:0;height:100%}.ui-slider-horizontal .ui-slider-range-min{left:0}.ui-slider-horizontal .ui-slider-range-max{right:0}.ui-slider-vertical{width:.8em;height:100px}.ui-slider-vertical .ui-slider-handle{left:-.3em;margin-left:0;margin-bottom:-.6em}.ui-slider-vertical .ui-slider-range{left:0;width:100%}.ui-slider-vertical .ui-slider-range-min{bottom:0}.ui-slider-vertical .ui-slider-range-max{top:0}.ui-sortable-handle{touch-action:none}.ui-spinner{position:relative;display:inline-block;overflow:hidden;padding:0;vertical-align:middle}.ui-spinner-input{border:none;background:none;color:inherit;padding:.222em 0;margin:.2em 0;vertical-align:middle;margin-left:.4em;margin-right:2em}.ui-spinner-button{width:1.6em;height:50%;font-size:.5em;padding:0;margin:0;text-align:center;position:absolute;cursor:default;display:block;overflow:hidden;right:0}.ui-spinner a.ui-spinner-button{border-top-style:none;border-bottom-style:none;border-right-style:none}.ui-spinner-up{top:0}.ui-spinner-down{bottom:0}.ui-tabs{position:relative;padding:.2em}.ui-tabs .ui-tabs-nav{margin:0;padding:.2em .2em 0}.ui-tabs .ui-tabs-nav li{list-style:none;float:left;position:relative;top:0;margin:1px .2em 0 0;border-bottom-width:0;padding:0;white-space:nowrap}.ui-tabs .ui-tabs-nav .ui-tabs-anchor{float:left;padding:.5em 1em;text-decoration:none}.ui-tabs .ui-tabs-nav li.ui-tabs-active{margin-bottom:-1px;padding-bottom:1px}.ui-tabs .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor,.ui-tabs .ui-tabs-nav li.ui-state-disabled .ui-tabs-anchor,.ui-tabs .ui-tabs-nav li.ui-tabs-loading .ui-tabs-anchor{cursor:text}.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor{cursor:pointer}.ui-tabs .ui-tabs-panel{display:block;border-width:0;padding:1em 1.4em;background:none}.ui-tooltip{padding:8px;position:absolute;z-index:9999;max-width:300px}body .ui-tooltip{border-width:2px}.ui-widget{font-family:Verdana,Arial,sans-serif;font-size:1.1em}.ui-widget .ui-widget{font-size:1em}.ui-widget input,.ui-widget select,.ui-widget textarea,.ui-widget button{font-family:Verdana,Arial,sans-serif;font-size:1em}.ui-widget.ui-widget-content{border:1px solid #d3d3d3}.ui-widget-content{border:1px solid #aaa;background:#fff;color:#222}.ui-widget-content a{color:#222}.ui-widget-header{border:1px solid #aaa;background:#ccc url("images/ui-bg_highlight-soft_75_cccccc_1x100.png") 50% 50% repeat-x;color:#222;font-weight:bold}.ui-widget-header a{color:#222}.ui-state-default,.ui-widget-content .ui-state-default,.ui-widget-header .ui-state-default,.ui-button,html .ui-button.ui-state-disabled:hover,html .ui-button.ui-state-disabled:active{border:1px solid #d3d3d3;background:#e6e6e6 url("images/ui-bg_glass_75_e6e6e6_1x400.png") 50% 50% repeat-x;font-weight:normal;color:#555}.ui-state-default a,.ui-state-default a:link,.ui-state-default a:visited,a.ui-button,a:link.ui-button,a:visited.ui-button,.ui-button{color:#555;text-decoration:none}.ui-state-hover,.ui-widget-content .ui-state-hover,.ui-widget-header .ui-state-hover,.ui-state-focus,.ui-widget-content .ui-state-focus,.ui-widget-header .ui-state-focus,.ui-button:hover,.ui-button:focus{border:1px solid #999;background:#dadada url("images/ui-bg_glass_75_dadada_1x400.png") 50% 50% repeat-x;font-weight:normal;color:#212121}.ui-state-hover a,.ui-state-hover a:hover,.ui-state-hover a:link,.ui-state-hover a:visited,.ui-state-focus a,.ui-state-focus a:hover,.ui-state-focus a:link,.ui-state-focus a:visited,a.ui-button:hover,a.ui-button:focus{color:#212121;text-decoration:none}.ui-visual-focus{box-shadow:0 0 3px 1px rgb(94,158,214)}.ui-state-active,.ui-widget-content .ui-state-active,.ui-widget-header .ui-state-active,a.ui-button:active,.ui-button:active,.ui-button.ui-state-active:hover{border:1px solid #aaa;background:#fff url("images/ui-bg_glass_65_ffffff_1x400.png") 50% 50% repeat-x;font-weight:normal;color:#212121}.ui-icon-background,.ui-state-active .ui-icon-background{border:#aaa;background-color:#212121}.ui-state-active a,.ui-state-active a:link,.ui-state-active a:visited{color:#212121;text-decoration:none}.ui-state-highlight,.ui-widget-content .ui-state-highlight,.ui-widget-header .ui-state-highlight{border:1px solid #fcefa1;background:#fbf9ee url("images/ui-bg_glass_55_fbf9ee_1x400.png") 50% 50% repeat-x;color:#363636}.ui-state-checked{border:1px solid #fcefa1;background:#fbf9ee}.ui-state-highlight a,.ui-widget-content .ui-state-highlight a,.ui-widget-header .ui-state-highlight a{color:#363636}.ui-state-error,.ui-widget-content .ui-state-error,.ui-widget-header .ui-state-error{border:1px solid #cd0a0a;background:#fef1ec url("images/ui-bg_glass_95_fef1ec_1x400.png") 50% 50% repeat-x;color:#cd0a0a}.ui-state-error a,.ui-widget-content .ui-state-error a,.ui-widget-header .ui-state-error a{color:#cd0a0a}.ui-state-error-text,.ui-widget-content .ui-state-error-text,.ui-widget-header .ui-state-error-text{color:#cd0a0a}.ui-priority-primary,.ui-widget-content .ui-priority-primary,.ui-widget-header .ui-priority-primary{font-weight:bold}.ui-priority-secondary,.ui-widget-content .ui-priority-secondary,.ui-widget-header .ui-priority-secondary{opacity:.7;font-weight:normal}.ui-state-disabled,.ui-widget-content .ui-state-disabled,.ui-widget-header .ui-state-disabled{opacity:.35;background-image:none}.ui-icon{width:16px;height:16px}.ui-icon,.ui-widget-content .ui-icon{background-image:url("images/ui-icons_222222_256x240.png")}.ui-widget-header .ui-icon{background-image:url("images/ui-icons_222222_256x240.png")}.ui-state-hover .ui-icon,.ui-state-focus .ui-icon,.ui-button:hover .ui-icon,.ui-button:focus .ui-icon{background-image:url("images/ui-icons_454545_256x240.png")}.ui-state-active .ui-icon,.ui-button:active .ui-icon{background-image:url("images/ui-icons_454545_256x240.png")}.ui-state-highlight .ui-icon,.ui-button .ui-state-highlight.ui-icon{background-image:url("images/ui-icons_2e83ff_256x240.png")}.ui-state-error .ui-icon,.ui-state-error-text .ui-icon{background-image:url("images/ui-icons_cd0a0a_256x240.png")}.ui-button .ui-icon{background-image:url("images/ui-icons_888888_256x240.png")}.ui-icon-blank.ui-icon-blank.ui-icon-blank{background-image:none}.ui-icon-caret-1-n{background-position:0 0}.ui-icon-caret-1-ne{background-position:-16px 0}.ui-icon-caret-1-e{background-position:-32px 0}.ui-icon-caret-1-se{background-position:-48px 0}.ui-icon-caret-1-s{background-position:-65px 0}.ui-icon-caret-1-sw{background-position:-80px 0}.ui-icon-caret-1-w{background-position:-96px 0}.ui-icon-caret-1-nw{background-position:-112px 0}.ui-icon-caret-2-n-s{background-position:-128px 0}.ui-icon-caret-2-e-w{background-position:-144px 0}.ui-icon-triangle-1-n{background-position:0 -16px}.ui-icon-triangle-1-ne{background-position:-16px -16px}.ui-icon-triangle-1-e{background-position:-32px -16px}.ui-icon-triangle-1-se{background-position:-48px -16px}.ui-icon-triangle-1-s{background-position:-65px -16px}.ui-icon-triangle-1-sw{background-position:-80px -16px}.ui-icon-triangle-1-w{background-position:-96px -16px}.ui-icon-triangle-1-nw{background-position:-112px -16px}.ui-icon-triangle-2-n-s{background-position:-128px -16px}.ui-icon-triangle-2-e-w{background-position:-144px -16px}.ui-icon-arrow-1-n{background-position:0 -32px}.ui-icon-arrow-1-ne{background-position:-16px -32px}.ui-icon-arrow-1-e{background-position:-32px -32px}.ui-icon-arrow-1-se{background-position:-48px -32px}.ui-icon-arrow-1-s{background-position:-65px -32px}.ui-icon-arrow-1-sw{background-position:-80px -32px}.ui-icon-arrow-1-w{background-position:-96px -32px}.ui-icon-arrow-1-nw{background-position:-112px -32px}.ui-icon-arrow-2-n-s{background-position:-128px -32px}.ui-icon-arrow-2-ne-sw{background-position:-144px -32px}.ui-icon-arrow-2-e-w{background-position:-160px -32px}.ui-icon-arrow-2-se-nw{background-position:-176px -32px}.ui-icon-arrowstop-1-n{background-position:-192px -32px}.ui-icon-arrowstop-1-e{background-position:-208px -32px}.ui-icon-arrowstop-1-s{background-position:-224px -32px}.ui-icon-arrowstop-1-w{background-position:-240px -32px}.ui-icon-arrowthick-1-n{background-position:1px -48px}.ui-icon-arrowthick-1-ne{background-position:-16px -48px}.ui-icon-arrowthick-1-e{background-position:-32px -48px}.ui-icon-arrowthick-1-se{background-position:-48px -48px}.ui-icon-arrowthick-1-s{background-position:-64px -48px}.ui-icon-arrowthick-1-sw{background-position:-80px -48px}.ui-icon-arrowthick-1-w{background-position:-96px -48px}.ui-icon-arrowthick-1-nw{background-position:-112px -48px}.ui-icon-arrowthick-2-n-s{background-position:-128px -48px}.ui-icon-arrowthick-2-ne-sw{background-position:-144px -48px}.ui-icon-arrowthick-2-e-w{background-position:-160px -48px}.ui-icon-arrowthick-2-se-nw{background-position:-176px -48px}.ui-icon-arrowthickstop-1-n{background-position:-192px -48px}.ui-icon-arrowthickstop-1-e{background-position:-208px -48px}.ui-icon-arrowthickstop-1-s{background-position:-224px -48px}.ui-icon-arrowthickstop-1-w{background-position:-240px -48px}.ui-icon-arrowreturnthick-1-w{background-position:0 -64px}.ui-icon-arrowreturnthick-1-n{background-position:-16px -64px}.ui-icon-arrowreturnthick-1-e{background-position:-32px -64px}.ui-icon-arrowreturnthick-1-s{background-position:-48px -64px}.ui-icon-arrowreturn-1-w{background-position:-64px -64px}.ui-icon-arrowreturn-1-n{background-position:-80px -64px}.ui-icon-arrowreturn-1-e{background-position:-96px -64px}.ui-icon-arrowreturn-1-s{background-position:-112px -64px}.ui-icon-arrowrefresh-1-w{background-position:-128px -64px}.ui-icon-arrowrefresh-1-n{background-position:-144px -64px}.ui-icon-arrowrefresh-1-e{background-position:-160px -64px}.ui-icon-arrowrefresh-1-s{background-position:-176px -64px}.ui-icon-arrow-4{background-position:0 -80px}.ui-icon-arrow-4-diag{background-position:-16px -80px}.ui-icon-extlink{background-position:-32px -80px}.ui-icon-newwin{background-position:-48px -80px}.ui-icon-refresh{background-position:-64px -80px}.ui-icon-shuffle{background-position:-80px -80px}.ui-icon-transfer-e-w{background-position:-96px -80px}.ui-icon-transferthick-e-w{background-position:-112px -80px}.ui-icon-folder-collapsed{background-position:0 -96px}.ui-icon-folder-open{background-position:-16px -96px}.ui-icon-document{background-position:-32px -96px}.ui-icon-document-b{background-position:-48px -96px}.ui-icon-note{background-position:-64px -96px}.ui-icon-mail-closed{background-position:-80px -96px}.ui-icon-mail-open{background-position:-96px -96px}.ui-icon-suitcase{background-position:-112px -96px}.ui-icon-comment{background-position:-128px -96px}.ui-icon-person{background-position:-144px -96px}.ui-icon-print{background-position:-160px -96px}.ui-icon-trash{background-position:-176px -96px}.ui-icon-locked{background-position:-192px -96px}.ui-icon-unlocked{background-position:-208px -96px}.ui-icon-bookmark{background-position:-224px -96px}.ui-icon-tag{background-position:-240px -96px}.ui-icon-home{background-position:0 -112px}.ui-icon-flag{background-position:-16px -112px}.ui-icon-calendar{background-position:-32px -112px}.ui-icon-cart{background-position:-48px -112px}.ui-icon-pencil{background-position:-64px -112px}.ui-icon-clock{background-position:-80px -112px}.ui-icon-disk{background-position:-96px -112px}.ui-icon-calculator{background-position:-112px -112px}.ui-icon-zoomin{background-position:-128px -112px}.ui-icon-zoomout{background-position:-144px -112px}.ui-icon-search{background-position:-160px -112px}.ui-icon-wrench{background-position:-176px -112px}.ui-icon-gear{background-position:-192px -112px}.ui-icon-heart{background-position:-208px -112px}.ui-icon-star{background-position:-224px -112px}.ui-icon-link{background-position:-240px -112px}.ui-icon-cancel{background-position:0 -128px}.ui-icon-plus{background-position:-16px -128px}.ui-icon-plusthick{background-position:-32px -128px}.ui-icon-minus{background-position:-48px -128px}.ui-icon-minusthick{background-position:-64px -128px}.ui-icon-close{background-position:-80px -128px}.ui-icon-closethick{background-position:-96px -128px}.ui-icon-key{background-position:-112px -128px}.ui-icon-lightbulb{background-position:-128px -128px}.ui-icon-scissors{background-position:-144px -128px}.ui-icon-clipboard{background-position:-160px -128px}.ui-icon-copy{background-position:-176px -128px}.ui-icon-contact{background-position:-192px -128px}.ui-icon-image{background-position:-208px -128px}.ui-icon-video{background-position:-224px -128px}.ui-icon-script{background-position:-240px -128px}.ui-icon-alert{background-position:0 -144px}.ui-icon-info{background-position:-16px -144px}.ui-icon-notice{background-position:-32px -144px}.ui-icon-help{background-position:-48px -144px}.ui-icon-check{background-position:-64px -144px}.ui-icon-bullet{background-position:-80px -144px}.ui-icon-radio-on{background-position:-96px -144px}.ui-icon-radio-off{background-position:-112px -144px}.ui-icon-pin-w{background-position:-128px -144px}.ui-icon-pin-s{background-position:-144px -144px}.ui-icon-play{background-position:0 -160px}.ui-icon-pause{background-position:-16px -160px}.ui-icon-seek-next{background-position:-32px -160px}.ui-icon-seek-prev{background-position:-48px -160px}.ui-icon-seek-end{background-position:-64px -160px}.ui-icon-seek-start{background-position:-80px -160px}.ui-icon-seek-first{background-position:-80px -160px}.ui-icon-stop{background-position:-96px -160px}.ui-icon-eject{background-position:-112px -160px}.ui-icon-volume-off{background-position:-128px -160px}.ui-icon-volume-on{background-position:-144px -160px}.ui-icon-power{background-position:0 -176px}.ui-icon-signal-diag{background-position:-16px -176px}.ui-icon-signal{background-position:-32px -176px}.ui-icon-battery-0{background-position:-48px -176px}.ui-icon-battery-1{background-position:-64px -176px}.ui-icon-battery-2{background-position:-80px -176px}.ui-icon-battery-3{background-position:-96px -176px}.ui-icon-circle-plus{background-position:0 -192px}.ui-icon-circle-minus{background-position:-16px -192px}.ui-icon-circle-close{background-position:-32px -192px}.ui-icon-circle-triangle-e{background-position:-48px -192px}.ui-icon-circle-triangle-s{background-position:-64px -192px}.ui-icon-circle-triangle-w{background-position:-80px -192px}.ui-icon-circle-triangle-n{background-position:-96px -192px}.ui-icon-circle-arrow-e{background-position:-112px -192px}.ui-icon-circle-arrow-s{background-position:-128px -192px}.ui-icon-circle-arrow-w{background-position:-144px -192px}.ui-icon-circle-arrow-n{background-position:-160px -192px}.ui-icon-circle-zoomin{background-position:-176px -192px}.ui-icon-circle-zoomout{background-position:-192px -192px}.ui-icon-circle-check{background-position:-208px -192px}.ui-icon-circlesmall-plus{background-position:0 -208px}.ui-icon-circlesmall-minus{background-position:-16px -208px}.ui-icon-circlesmall-close{background-position:-32px -208px}.ui-icon-squaresmall-plus{background-position:-48px -208px}.ui-icon-squaresmall-minus{background-position:-64px -208px}.ui-icon-squaresmall-close{background-position:-80px -208px}.ui-icon-grip-dotted-vertical{background-position:0 -224px}.ui-icon-grip-dotted-horizontal{background-position:-16px -224px}.ui-icon-grip-solid-vertical{background-position:-32px -224px}.ui-icon-grip-solid-horizontal{background-position:-48px -224px}.ui-icon-gripsmall-diagonal-se{background-position:-64px -224px}.ui-icon-grip-diagonal-se{background-position:-80px -224px}.ui-corner-all,.ui-corner-top,.ui-corner-left,.ui-corner-tl{border-top-left-radius:4px}.ui-corner-all,.ui-corner-top,.ui-corner-right,.ui-corner-tr{border-top-right-radius:4px}.ui-corner-all,.ui-corner-bottom,.ui-corner-left,.ui-corner-bl{border-bottom-left-radius:4px}.ui-corner-all,.ui-corner-bottom,.ui-corner-right,.ui-corner-br{border-bottom-right-radius:4px}.ui-widget-overlay{background:#aaa;opacity:.3}.ui-widget-shadow{box-shadow:-8px -8px 8px #aaa}
\ No newline at end of file
diff --git a/assets/css/settings-styles.css b/assets/css/settings-styles.css
index c597044f4..74c9c8585 100644
--- a/assets/css/settings-styles.css
+++ b/assets/css/settings-styles.css
@@ -509,7 +509,8 @@ body.woocommerce_page_wpo_wcpdf_options_page {
 	font-size: 12px;
 }
 
-#wpo-wcpdf-settings .system-status-table {
+#wpo-wcpdf-settings .system-status-table,
+#wpo-wcpdf-settings .form-table {
 	margin-top: 2em;
 }
 
diff --git a/assets/css/settings-styles.min.css b/assets/css/settings-styles.min.css
index bfc61b66c..fd96d2d16 100644
--- a/assets/css/settings-styles.min.css
+++ b/assets/css/settings-styles.min.css
@@ -1 +1 @@
-span.wpo-warning{display:inline-block;border:1px solid red;border-left:4px solid red;padding:5px 15px;background-color:#fff}.wcpdf-extensions-ad,.wcpdf-promo-ad{position:relative;min-height:90px;border:1px solid #6e1edc;background-color:#f1e9fc;padding:15px;padding-left:100px;margin-top:30px}img.wpo-helper{position:absolute;bottom:0;left:3px}.wcpdf-extensions-ad h3,.wcpdf-promo-ad h3{margin:0;padding:20px;font-weight:400;font-family:serif;letter-spacing:-1px;font-size:2.25em}.wcpdf-promo-ad p{margin:0;padding:0 20px;font-size:1.15em}.wcpdf-promo-ad p.upgrade-tab{margin-top:30px;font-style:italic;font-size:1em}.wcpdf-promo-ad p.expiration{font-size:.8em;padding-top:8px}.wcpdf-extensions-ad a,.wcpdf-promo-ad a{color:#6e1edc}.wcpdf-extensions-ad a.dismiss,.wcpdf-promo-ad a.dismiss{padding:10px 20px}.wcpdf-promo-ad p strong.code{font-size:1.3em;font-family:serif;padding:.1em .4em;background:#6e1edc;color:#fff;border-radius:5px;font-weight:400}.wcpdf-extensions-ad i{padding-left:20px}.wcpdf-extensions-ad ul,.wcpdf-promo-ad ul{margin:0;margin-left:40px}.wcpdf-extensions li{margin:0}.wcpdf-extensions li ul{list-style-type:square;margin-top:.5em;margin-bottom:.5em}.wcpdf-extensions>li:before{content:"";border-color:transparent transparent transparent #111;border-style:solid;border-width:.35em .35em .35em .45em;display:block;height:0;width:0;left:-1em;top:.9em;position:relative}.wcpdf-extensions li:not(.expanded){cursor:pointer}.wcpdf-extensions .expanded:before{border-color:#111 transparent transparent transparent;left:-1.17em;border-width:.45em .45em .35em .35em!important}.wcpdf-extensions .more{padding:10px;background-color:#fff;border:1px solid #ccc;border-radius:5px}.wcpdf-extensions table td{vertical-align:top}.dropbox-logo{margin-bottom:-10px;margin-right:10px}.cloud-logo{margin-bottom:-10px;margin-top:-5px;margin-right:10px}#img-header_logo{max-height:200px;width:auto;max-width:100%}.multiple-text-input label{padding-right:1em}table.multiple-text-input td{padding:0}table.wcpdf_documents_settings_list{width:100%;border-collapse:collapse;border-spacing:0;background-color:#fff;border-top:2px solid #000}table.wcpdf_documents_settings_list tr.odd{background-color:#ebf5ff}table.wcpdf_documents_settings_list td{padding:5px}table.wcpdf_documents_settings_list a{text-decoration:none}table.wcpdf_documents_settings_list td.settings-icon{text-align:right}table.wcpdf_documents_settings_list td.title{font-weight:700}.wcpdf-settings-sections ul{height:3em}.wcpdf-settings-sections ul li{float:left;margin-right:10px}.wcpdf-settings-sections ul li a{text-decoration:none;display:inline-block;padding:.8em 1em;color:#50575e;border:1px solid #c3c4c7;box-sizing:border-box}.wcpdf-settings-sections ul li a.active{border:2px solid #51266b;padding:calc(.8em - 1px) calc(1em - 1px);color:#000}.wcpdf_document_settings_sections{position:relative}.wcpdf_document_settings_sections>h2{cursor:pointer;padding:1em .8em;margin:0;border:1px solid #c3c4c7;background:#fff}.wcpdf_document_settings_sections ul{background:#fff;list-style:none;margin:0;padding:0;width:100%;display:block;height:auto;display:none;box-sizing:border-box;position:absolute;border-left:1px solid #c3c4c7;border-right:1px solid #c3c4c7;z-index:1000;box-shadow:0 35px 35px -8px rgba(0,0,0,.1);-webkit-box-shadow:0 35px 35px -8px rgba(0,0,0,.1)}.wcpdf_document_settings_sections ul.active{display:block}.wcpdf_document_settings_sections ul li{box-sizing:border-box;padding:0;margin-bottom:0;border-bottom:1px solid #eaeaea;font-size:1.1em}.wcpdf_document_settings_sections ul li:last-child{border-color:#c3c4c7}.wcpdf_document_settings_sections ul li:hover{cursor:pointer;background:#51266b;color:#fff}.wcpdf_document_settings_sections ul li:hover a{color:#fff}.wcpdf_document_settings_sections ul li a{color:#000;text-decoration:none;padding:1.2em 1.6em;display:block}.wcpdf_document_settings_sections .arrow-down{font-size:.7em;color:#999;margin-left:8px;font-weight:400;float:right}.wcpdf_document_settings_sections p:hover,.wcpdf_document_settings_sections p:hover>.arrow-down{color:#222}.wcpdf_advanced_numbers_choose_table{margin-top:20px}.wcpdf_document_settings_document_output_formats{margin-bottom:30px}.edit-next-number{opacity:.5}.edit-next-number:hover{opacity:1;cursor:pointer}.wpo-wcpdf-pointer.wp-pointer-top .wp-pointer-arrow,.wpo-wcpdf-pointer.wp-pointer-top .wp-pointer-arrow-inner{border-bottom-color:#51266b}.wpo-wcpdf-pointer .wp-pointer-content h3{border-color:#51266b;background:#51266b}.wpo-wcpdf-pointer .wp-pointer-content h3:before{color:#51266b}body.woocommerce_page_wpo_wcpdf_options_page{background:#fdfdfd}.wrap [class$=icon32]+h2{font-size:18px;padding:1em}.wrap .notice{margin:15px 0 0}.nav-tab-wrapper:not(.wcpdf_debug_settings_sections>.nav-tab-wrapper) a.nav-tab{background:0 0;border:none;border-bottom:3px solid transparent;padding:1em 0;margin:0 1.2em;font-size:15px}.nav-tab-wrapper:not(.wcpdf_debug_settings_sections>.nav-tab-wrapper) a.nav-tab.nav-tab-active{border-bottom:3px solid #51266b}#wpo-wcpdf-preview-wrapper{width:100%;height:auto;position:relative;display:flex;align-items:flex-start}#wpo-wcpdf-preview-wrapper .preview-document,#wpo-wcpdf-preview-wrapper .sidebar{transition:.3s ease-in-out}#wpo-wcpdf-preview-wrapper .sidebar{height:auto;padding:4em 0 0 0;box-sizing:border-box;background:0 0;flex:0 0 35%;overflow-x:hidden}#wpo-wcpdf-preview-wrapper .sidebar>form{background:0 0!important;overflow:visible;padding:0;margin-left:2em;box-sizing:border-box;width:calc(100% - 4em);max-width:50vw}#wpo-wcpdf-preview-wrapper .sidebar>form.editor{max-width:none}#wpo-wcpdf-preview-wrapper .sidebar .form-table,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>th{display:block;width:100%;padding:0}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>th{padding-bottom:.6em}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr:not(:last-child)>td{padding-bottom:2.4em}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td p.description{font-size:.85em;padding-top:.7em}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td p.description>span.wpo-warning{width:100%;box-sizing:border-box;word-wrap:break-word}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input[type=email],#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input[type=text],#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input[type=url],#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>select,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>textarea{max-width:none;width:100%}#wpo-wcpdf-preview-wrapper input[type=text][size],#wpo-wcpdf-preview-wrapper input[type=url][size]{width:auto!important;max-width:100%!important}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input#next_invoice_number{width:auto!important}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar .form-table>tbody>tr{display:grid;grid-template-columns:1fr 2fr;gap:4em}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2{border-bottom:1px solid #c3c4c7;padding:1em 0 1em 5px;margin:0;font-weight:400;color:#222;font-family:sans-serif;font-size:1.3em;letter-spacing:-.01em;position:relative;transition:transform .3s;cursor:pointer}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2~.form-table{border-left:1px solid #c3c4c7;border-right:1px solid #c3c4c7;border-bottom:1px solid #c3c4c7;padding:2em;margin-top:-1px;background:#fff;margin-bottom:20px}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2::after{content:'\f347';font-family:dashicons;font-size:16px;color:#82878c;position:absolute;right:5px;top:50%;transform:translateY(-50%);transition:transform .15s}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2:hover:after{color:#222}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2.active::after{transform:translateY(-50%) rotate(180deg)}#wpo-wcpdf-preview-wrapper .my_account_buttons_custom{margin-top:1em}#wpo-wcpdf-settings .form-table .ui-tabs-nav{padding-left:0!important;margin-left:0!important}#wpo-wcpdf-settings .translations input,#wpo-wcpdf-settings .translations textarea{width:100%}#wpo-wcpdf-settings .wcpdf-attachment-settings-hint{border-left:4px solid #51266b}#wpo-wcpdf-settings .notice-info.inline{border-left-color:#51266b}#wpo-wcpdf-settings table#document-link-access-type{margin-top:-15px}#wpo-wcpdf-settings table#document-link-access-type td.option{padding-left:0}#wpo-wcpdf-settings table#document-link-access-type td{padding-top:0;padding-bottom:6px;font-size:12px}#wpo-wcpdf-settings .system-status-table{margin-top:2em}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar{flex:0 0 100%}#wpo-wcpdf-preview-wrapper[data-preview-states="1"].ubl .sidebar>form{max-width:100%}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=full] .sidebar{flex:0 0 95%;margin-left:-95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .sidebar{flex:0 0 35%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=full] .sidebar{margin-left:-35%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=full] .sidebar{transition-delay:.4s}#wpo-wcpdf-preview-wrapper .preview-document{padding:0;box-sizing:border-box;position:sticky;top:2.4em;flex:0 0 60%}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .preview-document{display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .preview-document{display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=full] .preview-document{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .preview-document{flex:0 0 60%;margin-right:-60%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .preview-document{flex:0 0 60%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=full] .preview-document{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=full] .preview-document{transition-delay:.4s}.preview-document .preview{width:100%;box-sizing:border-box;padding-right:5%}.preview-document .preview>#preview-ubl{width:100%;height:100%;overflow-wrap:anywhere;background-color:#222;color:#fff;padding:2em}.preview-document .preview>#preview-canvas{display:block;max-width:800px;max-height:85vh;width:auto!important;margin:0 auto;background:#fff;box-shadow:8px 8px 8px rgba(0,0,0,.1),-8px -8px 8px rgba(0,0,0,.02);-webkit-box-shadow:8px 8px 8px rgba(0,0,0,.1),-8px -8px 8px rgba(0,0,0,.02)}#wpo-wcpdf-preview-wrapper[data-preview-states="2"] #preview-canvas{max-height:170vh}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=sidebar] #preview-canvas{max-height:170vh;transition:max-height .4s ease-in-out .3s}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=full] #preview-canvas{transition:max-height .4s ease-in-out 0s}.preview-document .preview-data-wrapper{width:100%;height:4em}.preview-document .preview-data-wrapper .preview-document-type,.preview-document .preview-data-wrapper .preview-order-data{float:right}.preview-document .preview-data-wrapper .preview-document-type{margin-right:30px}.preview-document .preview-data-wrapper .preview-document-type ul>li{text-decoration:none;color:initial;padding:1.4em 1.6em}.preview-document .preview-data-wrapper .preview-document-type ul>li:hover{color:#fff!important}.preview-document .preview-data-wrapper .save-settings{padding:1em 0 0 0;float:right;overflow:hidden;position:relative}.preview-document .preview-data-wrapper .save-settings p{padding:0;margin:0 0 0 2em;position:relative;margin-right:-200px;transition:margin-right .3s ease-out}.preview-document .preview-data-wrapper .save-settings p:after{content:'';display:block;pointer-events:none;position:absolute;box-sizing:border-box;border-radius:3px;right:0;top:0;background:0 0;width:100%;height:100%;z-index:10;border:0 solid #fff;animation:border-pulse 4s infinite}@keyframes border-pulse{0%{border-color:rgba(255,255,255,0);border-width:8px}50%{border-color:#fff;border-width:0}}.preview-document .preview-data-wrapper .save-settings p input:focus{outline-width:0;box-shadow:none}.preview-document .preview-data p{padding:1.4em 0;margin:0;color:#666;text-align:right;cursor:pointer;font-weight:lighter;float:right}.preview-document .preview-data p.order-search{display:none}.preview-document .preview-data input{float:right;margin:1em 0 0 1em;padding:.1em .5em;width:20ch;margin-right:-25ch;display:none}.preview-document .preview-data input.active{margin-right:0;display:inline-block}.preview-document .preview-data ul{position:absolute;right:0;top:4em;background:#fff;box-shadow:0 0 25px -10px rgba(0,0,0,.2);-webkit-box-shadow:0 0 25px -10px rgba(0,0,0,.2);list-style:none;margin:0;padding:0;min-width:24em;display:block;height:0;overflow:hidden}.preview-document .preview-data ul.active{height:auto;z-index:1}.preview-document .preview-data ul li{box-sizing:border-box;padding:0;margin-bottom:0;border-bottom:1px solid #eaeaea;font-size:1.1em}.preview-document .preview-data ul li:hover{cursor:pointer;background:#51266b;color:#fff}.preview-document .preview-data ul li a,.preview-document .preview-data.preview-order-data ul li{display:block;padding:1.4em 1.6em}.preview-document .preview-data .arrow-down{font-size:.8em;color:#999;margin-left:8px}.preview-document .preview-data p:hover,.preview-document .preview-data p:hover>.arrow-down{color:#222}.preview-document .preview-data #preview-order-search-results{display:none;position:absolute;right:0;top:4em;width:300px;box-shadow:0 0 25px -10px rgba(0,0,0,.2);-webkit-box-shadow:0 0 25px -10px rgba(0,0,0,.2);padding:20px 0;background-color:#fff;z-index:99}.preview-document .preview-data #preview-order-search-results a{display:block;border-left:1px solid #999;border-right:1px solid #999;border-top:1px solid #999;color:#000;padding:10px;margin:0 20px;text-decoration:none;cursor:pointer}.preview-document .preview-data #preview-order-search-results a:last-child{border-bottom:1px solid #999}.preview-document .preview-data #preview-order-search-results a:hover{background-color:#51266b;color:#fff}.preview-document .preview-data #preview-order-search-results .order-number{font-weight:700}.preview-document .preview-data #preview-order-search-results .date,.preview-document .preview-data #preview-order-search-results .total{margin-top:6px;display:inline-block}.preview-document .preview-data #preview-order-search-results .total{float:right}.preview-document .preview-data #preview-order-search-results .error{margin:0 20px}.preview-document .preview-order-search-wrapper{position:relative;float:right}.preview-document .preview-order-search-wrapper img.preview-order-search-clear{position:absolute;width:30px;height:16px;top:22px;right:6px;display:none;cursor:pointer}#wpo-wcpdf-preview-wrapper .gutter{flex:0 0 5%;position:sticky;top:2.4em;height:170vh}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .gutter .slide-left,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .gutter .slide-left{float:right}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .gutter .slide-left{border:none}#wpo-wcpdf-preview-wrapper .slider{box-sizing:border-box;padding-top:2.4em;color:#999;font-weight:700;cursor:pointer;font-size:.7em;line-height:1em;width:50%;height:100%;float:left}#wpo-wcpdf-preview-wrapper .slider.slide-left{text-align:right;padding-right:10px;border-right:1px solid #ccc}#wpo-wcpdf-preview-wrapper .slider.slide-right{text-align:left;padding-left:10px;border-left:1px solid #ccc;display:none}#wpo-wcpdf-preview-wrapper .gutter-arrow{width:0;height:0;border-top:3px solid transparent;border-bottom:3px solid transparent;display:block}#wpo-wcpdf-preview-wrapper .arrow-left{border-right:7px solid #999;float:right}#wpo-wcpdf-preview-wrapper .arrow-right{border-left:7px solid #999}#wpo-wcpdf-preview-wrapper .slider:hover>.arrow-left{border-right:7px solid #222}#wpo-wcpdf-preview-wrapper .slider:hover>.arrow-right{border-left:7px solid #222}#wpo-wcpdf-preview-wrapper .slider.slide-left:after{position:absolute;top:1.55em;right:2em;font-size:1.4em;display:none}#wpo-wcpdf-preview-wrapper .slider.slide-right:after{position:absolute;top:1.55em;left:2em;font-size:1.4em;display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .gutter{display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .gutter{height:100vh}#wpo-wcpdf-preview-wrapper[data-preview-state=full] .slide-right:after{display:inline-block}#wpo-wcpdf-preview-wrapper[data-preview-state=closed] .slide-left:after{display:inline-block}#wpo-wcpdf-preview-wrapper.static .gutter,#wpo-wcpdf-preview-wrapper.static .preview-document{position:static!important}#wpo-wcpdf-preview-wrapper.static .sidebar{height:170vh!important;overflow:hidden}#wpo-wcpdf-preview-wrapper input.readonly,#wpo-wcpdf-preview-wrapper input[readonly],#wpo-wcpdf-preview-wrapper textarea.readonly,#wpo-wcpdf-preview-wrapper textarea[readonly]{background-color:#f8f8f8}#wpo-wcpdf-preview-wrapper[data-preview-state=sidebar] .select2.select2-container{width:100%!important}.wcpdf_ubl_settings_sections{margin-bottom:4em}#wpo-wcpdf-preview-wrapper input#due_date_days{text-align:right}#wpo-wcpdf-preview-wrapper input#due_date_days:disabled{background-color:#eaeaea;color:#999}sup.wcpdf_beta{background-color:#51266b;color:#fff;font-size:7pt;padding:1px 2px;border-radius:2px}@media screen and (min-width:1920px){.preview-document .preview>#preview-canvas{max-width:900px}}@media screen and (max-width:1200px){.preview-document .preview>#preview-canvas{max-width:680px}.nav-tab-wrapper a.nav-tab{padding:1em 2em;margin:0 .5em .5em 0;border:1px solid #ccc;box-sizing:border-box;height:4em}.nav-tab-wrapper a.nav-tab.nav-tab-active{border:3px solid #51266b}.preview-document .preview>#preview-canvas{width:80vw!important}#wpo-wcpdf-preview-wrapper .sidebar>form{max-width:100%}#wpo-wcpdf-preview-wrapper[data-preview-state=closed] .select2.select2-container{width:100%!important}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar .form-table>tbody>tr{gap:2em}.preview-document .preview-data-wrapper{height:6em}.preview-document .preview-data p{padding:2.2em 0}#wpo-wcpdf-preview-wrapper .slider.slide-left:after,#wpo-wcpdf-preview-wrapper .slider.slide-right:after{top:1.5em;padding:1em;background:#fff;border:1px solid #ccc}#wpo-wcpdf-preview-wrapper .slider.slide-right:after{left:0}#wpo-wcpdf-preview-wrapper .slider.slide-left:after{right:0}#wpo-wcpdf-preview-wrapper .multiple-text-input tr td:nth-child(2),#wpo-wcpdf-preview-wrapper .multiple-text-input tr td:nth-child(3){float:left;margin-bottom:10px}#wpo-wcpdf-preview-wrapper .multiple-text-input tr td .woocommerce-help-tip:after{padding:.5em .8em;font-size:1.2em;line-height:inherit}}@media screen and (max-width:860px){#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar .form-table>tbody>tr{display:block}}div.upgrade-table-description{padding:0 0 3em 1em}div.upgrade-table-description h1{font-family:serif;letter-spacing:-1px;font-size:3em}div.upgrade-table-description p{font-size:1.1em}#upgrade-table{width:100%;border-collapse:collapse;font-size:1.2em;margin-bottom:3em}#upgrade-table td,#upgrade-table th{padding:.8em 2em;border-bottom:1px solid #ccc;text-align:center}#upgrade-table th{font-weight:400;font-size:1.1em}#upgrade-table td:not(.last),#upgrade-table th:not(.last){width:200px}#upgrade-table tr:last-child td{border:none}#upgrade-table td.feature-label{text-align:left;padding-left:1em;font-weight:700;width:500px}#upgrade-table td.feature-label span.description{display:inline-block;padding-top:10px;font-size:.8em;line-height:1.4em;font-weight:400;color:#555}#upgrade-table td span.feature-available{display:inline-block;width:24px;height:24px;background-repeat:no-repeat;background-size:cover}#upgrade-table a,div.upgrade-table-description a{color:#6e1edc;white-space:nowrap}#upgrade-table .upgrade-links h4{margin:1em 0 .5em 0}#upgrade-table .upgrade-links p{margin:0;font-style:oblique;font-size:.8em}#plugin-recommendations a.upgrade_button,#upgrade-table .upgrade-links a.upgrade_button{display:inline-block;background:#fff;padding:1em 3em 1em 2em;border-radius:12px;border:1px solid #6e1edc;text-decoration:none;margin:2em 0;position:relative}#plugin-recommendations a.upgrade_button:after,#upgrade-table .upgrade-links a.upgrade_button:after{content:' \2192';display:block;position:absolute;right:1.8em;top:1.1em;transition:.5s}#plugin-recommendations a.upgrade_button:hover:after,#upgrade-table .upgrade-links a.upgrade_button:hover:after{right:1.1em;font-weight:700}#plugin-recommendations a.upgrade_button:focus,#plugin-recommendations a.upgrade_button:hover,#upgrade-table .upgrade-links a.upgrade_button:focus,#upgrade-table .upgrade-links a.upgrade_button:hover{background:#6e1edc;color:#fcfbf7}#plugin-recommendations{border-radius:8px;background-color:#f1e9fc;padding:4em 3em}#plugin-recommendations .card-container{max-width:1100px;display:grid;grid-template-columns:repeat(3,1fr);grid-gap:3em;padding:2em 0}#plugin-recommendations .recommendation-card{margin-top:0;border-radius:6px;background-color:#fff;box-shadow:0 0 25px -10px rgba(0,0,0,.2);box-sizing:border-box;font-size:15px;overflow:hidden;transition:.2s}#plugin-recommendations .recommendation-card:nth-child(n+4){display:none}#plugin-recommendations .recommendation-card:hover{scale:1.02}#plugin-recommendations .recommendation-card.currently-installed{opacity:.5}#plugin-recommendations .recommendation-card .card-content{padding:0 4em 3em 2em}#plugin-recommendations .recommendation-card img{width:100%}#plugin-recommendations .recommendation-card h5{text-align:left;font-size:1.4em;line-height:1.3em;font-weight:700;margin:1em 0}#plugin-recommendations .recommendation-card p{text-align:left;padding-bottom:10px}#plugin-recommendations .recommendation-card a.upgrade_button{margin:0}#plugin-recommendations .recommendation-card span.currently-installed{font-size:.7em;color:#fff;background-color:#6e1edc;padding:1em 2em;border-radius:12px;margin:0;display:inline-block}@media screen and (max-width:1100px){#upgrade-table{font-size:1em;line-height:1.2em}#upgrade-table td:not(.last),#upgrade-table th:not(.last){width:25%;padding:.8em 1em}#upgrade-table td.last,#upgrade-table th.last{width:0;padding:0}#upgrade-table td.feature-label span.description{padding-top:6px}#plugin-recommendations .card-container{grid-gap:2em}}@media screen and (max-width:968px){#plugin-recommendations .card-container{grid-template-columns:repeat(1,1fr);padding-right:40%}}@media screen and (max-width:782px){#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td:has(input[type=checkbox]+input[type=text])>input{display:inline-block}}@media screen and (max-width:767px){#upgrade-table td.feature-label span.description{display:none}#upgrade-table td:not(.last),#upgrade-table th:not(.last){width:20%}#upgrade-table td.first{width:40%}#plugin-recommendations .card-container{padding-right:0}}@media screen and (max-width:649px){div.upgrade-table-description{padding-left:.8em}div.upgrade-table-description p{font-size:1em}#upgrade-table{font-size:.8em}#upgrade-table td,#upgrade-table th{padding:.5em .8em!important}#upgrade-table td span.feature-available{width:18px;height:18px}#upgrade-table .upgrade-links a{white-space:normal;padding:.6em .8em;border-radius:6px}#upgrade-table .upgrade-links a:after{display:none}#plugin-recommendations .card-container{justify-content:center}}@media screen and (max-width:782px){input[type=checkbox],input[type=radio]{margin-bottom:.5em}}
\ No newline at end of file
+span.wpo-warning{display:inline-block;border:1px solid red;border-left:4px solid red;padding:5px 15px;background-color:#fff}.wcpdf-extensions-ad,.wcpdf-promo-ad{position:relative;min-height:90px;border:1px solid #6e1edc;background-color:#f1e9fc;padding:15px;padding-left:100px;margin-top:30px}img.wpo-helper{position:absolute;bottom:0;left:3px}.wcpdf-extensions-ad h3,.wcpdf-promo-ad h3{margin:0;padding:20px;font-weight:400;font-family:serif;letter-spacing:-1px;font-size:2.25em}.wcpdf-promo-ad p{margin:0;padding:0 20px;font-size:1.15em}.wcpdf-promo-ad p.upgrade-tab{margin-top:30px;font-style:italic;font-size:1em}.wcpdf-promo-ad p.expiration{font-size:.8em;padding-top:8px}.wcpdf-extensions-ad a,.wcpdf-promo-ad a{color:#6e1edc}.wcpdf-extensions-ad a.dismiss,.wcpdf-promo-ad a.dismiss{padding:10px 20px}.wcpdf-promo-ad p strong.code{font-size:1.3em;font-family:serif;padding:.1em .4em;background:#6e1edc;color:#fff;border-radius:5px;font-weight:400}.wcpdf-extensions-ad i{padding-left:20px}.wcpdf-extensions-ad ul,.wcpdf-promo-ad ul{margin:0;margin-left:40px}.wcpdf-extensions li{margin:0}.wcpdf-extensions li ul{list-style-type:square;margin-top:.5em;margin-bottom:.5em}.wcpdf-extensions>li:before{content:"";border-color:transparent transparent transparent #111;border-style:solid;border-width:.35em .35em .35em .45em;display:block;height:0;width:0;left:-1em;top:.9em;position:relative}.wcpdf-extensions li:not(.expanded){cursor:pointer}.wcpdf-extensions .expanded:before{border-color:#111 transparent transparent transparent;left:-1.17em;border-width:.45em .45em .35em .35em!important}.wcpdf-extensions .more{padding:10px;background-color:#fff;border:1px solid #ccc;border-radius:5px}.wcpdf-extensions table td{vertical-align:top}.dropbox-logo{margin-bottom:-10px;margin-right:10px}.cloud-logo{margin-bottom:-10px;margin-top:-5px;margin-right:10px}#img-header_logo{max-height:200px;width:auto;max-width:100%}.multiple-text-input label{padding-right:1em}table.multiple-text-input td{padding:0}table.wcpdf_documents_settings_list{width:100%;border-collapse:collapse;border-spacing:0;background-color:#fff;border-top:2px solid #000}table.wcpdf_documents_settings_list tr.odd{background-color:#ebf5ff}table.wcpdf_documents_settings_list td{padding:5px}table.wcpdf_documents_settings_list a{text-decoration:none}table.wcpdf_documents_settings_list td.settings-icon{text-align:right}table.wcpdf_documents_settings_list td.title{font-weight:700}.wcpdf-settings-sections ul{height:3em}.wcpdf-settings-sections ul li{float:left;margin-right:10px}.wcpdf-settings-sections ul li a{text-decoration:none;display:inline-block;padding:.8em 1em;color:#50575e;border:1px solid #c3c4c7;box-sizing:border-box}.wcpdf-settings-sections ul li a.active{border:2px solid #51266b;padding:calc(.8em - 1px) calc(1em - 1px);color:#000}.wcpdf_document_settings_sections{position:relative}.wcpdf_document_settings_sections>h2{cursor:pointer;padding:1em .8em;margin:0;border:1px solid #c3c4c7;background:#fff}.wcpdf_document_settings_sections ul{background:#fff;list-style:none;margin:0;padding:0;width:100%;display:block;height:auto;display:none;box-sizing:border-box;position:absolute;border-left:1px solid #c3c4c7;border-right:1px solid #c3c4c7;z-index:1000;box-shadow:0 35px 35px -8px rgba(0,0,0,.1);-webkit-box-shadow:0 35px 35px -8px rgba(0,0,0,.1)}.wcpdf_document_settings_sections ul.active{display:block}.wcpdf_document_settings_sections ul li{box-sizing:border-box;padding:0;margin-bottom:0;border-bottom:1px solid #eaeaea;font-size:1.1em}.wcpdf_document_settings_sections ul li:last-child{border-color:#c3c4c7}.wcpdf_document_settings_sections ul li:hover{cursor:pointer;background:#51266b;color:#fff}.wcpdf_document_settings_sections ul li:hover a{color:#fff}.wcpdf_document_settings_sections ul li a{color:#000;text-decoration:none;padding:1.2em 1.6em;display:block}.wcpdf_document_settings_sections .arrow-down{font-size:.7em;color:#999;margin-left:8px;font-weight:400;float:right}.wcpdf_document_settings_sections p:hover,.wcpdf_document_settings_sections p:hover>.arrow-down{color:#222}.wcpdf_advanced_numbers_choose_table{margin-top:20px}.wcpdf_document_settings_document_output_formats{margin-bottom:30px}.edit-next-number{opacity:.5}.edit-next-number:hover{opacity:1;cursor:pointer}.wpo-wcpdf-pointer.wp-pointer-top .wp-pointer-arrow,.wpo-wcpdf-pointer.wp-pointer-top .wp-pointer-arrow-inner{border-bottom-color:#51266b}.wpo-wcpdf-pointer .wp-pointer-content h3{border-color:#51266b;background:#51266b}.wpo-wcpdf-pointer .wp-pointer-content h3:before{color:#51266b}body.woocommerce_page_wpo_wcpdf_options_page{background:#fdfdfd}.wrap [class$=icon32]+h2{font-size:18px;padding:1em}.wrap .notice{margin:15px 0 0}.nav-tab-wrapper:not(.wcpdf_debug_settings_sections>.nav-tab-wrapper) a.nav-tab{background:0 0;border:none;border-bottom:3px solid transparent;padding:1em 0;margin:0 1.2em;font-size:15px}.nav-tab-wrapper:not(.wcpdf_debug_settings_sections>.nav-tab-wrapper) a.nav-tab.nav-tab-active{border-bottom:3px solid #51266b}#wpo-wcpdf-preview-wrapper{width:100%;height:auto;position:relative;display:flex;align-items:flex-start}#wpo-wcpdf-preview-wrapper .preview-document,#wpo-wcpdf-preview-wrapper .sidebar{transition:.3s ease-in-out}#wpo-wcpdf-preview-wrapper .sidebar{height:auto;padding:4em 0 0 0;box-sizing:border-box;background:0 0;flex:0 0 35%;overflow-x:hidden}#wpo-wcpdf-preview-wrapper .sidebar>form{background:0 0!important;overflow:visible;padding:0;margin-left:2em;box-sizing:border-box;width:calc(100% - 4em);max-width:50vw}#wpo-wcpdf-preview-wrapper .sidebar>form.editor{max-width:none}#wpo-wcpdf-preview-wrapper .sidebar .form-table,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>th{display:block;width:100%;padding:0}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>th{padding-bottom:.6em}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr:not(:last-child)>td{padding-bottom:2.4em}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td p.description{font-size:.85em;padding-top:.7em}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td p.description>span.wpo-warning{width:100%;box-sizing:border-box;word-wrap:break-word}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input[type=email],#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input[type=text],#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input[type=url],#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>select,#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>textarea{max-width:none;width:100%}#wpo-wcpdf-preview-wrapper input[type=text][size],#wpo-wcpdf-preview-wrapper input[type=url][size]{width:auto!important;max-width:100%!important}#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td>input#next_invoice_number{width:auto!important}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar .form-table>tbody>tr{display:grid;grid-template-columns:1fr 2fr;gap:4em}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2{border-bottom:1px solid #c3c4c7;padding:1em 0 1em 5px;margin:0;font-weight:400;color:#222;font-family:sans-serif;font-size:1.3em;letter-spacing:-.01em;position:relative;transition:transform .3s;cursor:pointer}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2~.form-table{border-left:1px solid #c3c4c7;border-right:1px solid #c3c4c7;border-bottom:1px solid #c3c4c7;padding:2em;margin-top:-1px;background:#fff;margin-bottom:20px}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2::after{content:'\f347';font-family:dashicons;font-size:16px;color:#82878c;position:absolute;right:5px;top:50%;transform:translateY(-50%);transition:transform .15s}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2:hover:after{color:#222}#wpo-wcpdf-preview-wrapper .sidebar .settings_category h2.active::after{transform:translateY(-50%) rotate(180deg)}#wpo-wcpdf-preview-wrapper .my_account_buttons_custom{margin-top:1em}#wpo-wcpdf-settings .form-table .ui-tabs-nav{padding-left:0!important;margin-left:0!important}#wpo-wcpdf-settings .translations input,#wpo-wcpdf-settings .translations textarea{width:100%}#wpo-wcpdf-settings .wcpdf-attachment-settings-hint{border-left:4px solid #51266b}#wpo-wcpdf-settings .notice-info.inline{border-left-color:#51266b}#wpo-wcpdf-settings table#document-link-access-type{margin-top:-15px}#wpo-wcpdf-settings table#document-link-access-type td.option{padding-left:0}#wpo-wcpdf-settings table#document-link-access-type td{padding-top:0;padding-bottom:6px;font-size:12px}#wpo-wcpdf-settings .form-table,#wpo-wcpdf-settings .system-status-table{margin-top:2em}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar{flex:0 0 100%}#wpo-wcpdf-preview-wrapper[data-preview-states="1"].ubl .sidebar>form{max-width:100%}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=full] .sidebar{flex:0 0 95%;margin-left:-95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .sidebar{flex:0 0 35%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=full] .sidebar{margin-left:-35%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=full] .sidebar{transition-delay:.4s}#wpo-wcpdf-preview-wrapper .preview-document{padding:0;box-sizing:border-box;position:sticky;top:2.4em;flex:0 0 60%}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .preview-document{display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .preview-document{display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=full] .preview-document{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .preview-document{flex:0 0 60%;margin-right:-60%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .preview-document{flex:0 0 60%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=full] .preview-document{flex:0 0 95%}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=full] .preview-document{transition-delay:.4s}.preview-document .preview{width:100%;box-sizing:border-box;padding-right:5%}.preview-document .preview>#preview-ubl{width:100%;height:100%;overflow-wrap:anywhere;background-color:#222;color:#fff;padding:2em}.preview-document .preview>#preview-canvas{display:block;max-width:800px;max-height:85vh;width:auto!important;margin:0 auto;background:#fff;box-shadow:8px 8px 8px rgba(0,0,0,.1),-8px -8px 8px rgba(0,0,0,.02);-webkit-box-shadow:8px 8px 8px rgba(0,0,0,.1),-8px -8px 8px rgba(0,0,0,.02)}#wpo-wcpdf-preview-wrapper[data-preview-states="2"] #preview-canvas{max-height:170vh}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=sidebar] #preview-canvas{max-height:170vh;transition:max-height .4s ease-in-out .3s}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-from-preview-state=full] #preview-canvas{transition:max-height .4s ease-in-out 0s}.preview-document .preview-data-wrapper{width:100%;height:4em}.preview-document .preview-data-wrapper .preview-document-type,.preview-document .preview-data-wrapper .preview-order-data{float:right}.preview-document .preview-data-wrapper .preview-document-type{margin-right:30px}.preview-document .preview-data-wrapper .preview-document-type ul>li{text-decoration:none;color:initial;padding:1.4em 1.6em}.preview-document .preview-data-wrapper .preview-document-type ul>li:hover{color:#fff!important}.preview-document .preview-data-wrapper .save-settings{padding:1em 0 0 0;float:right;overflow:hidden;position:relative}.preview-document .preview-data-wrapper .save-settings p{padding:0;margin:0 0 0 2em;position:relative;margin-right:-200px;transition:margin-right .3s ease-out}.preview-document .preview-data-wrapper .save-settings p:after{content:'';display:block;pointer-events:none;position:absolute;box-sizing:border-box;border-radius:3px;right:0;top:0;background:0 0;width:100%;height:100%;z-index:10;border:0 solid #fff;animation:border-pulse 4s infinite}@keyframes border-pulse{0%{border-color:rgba(255,255,255,0);border-width:8px}50%{border-color:#fff;border-width:0}}.preview-document .preview-data-wrapper .save-settings p input:focus{outline-width:0;box-shadow:none}.preview-document .preview-data p{padding:1.4em 0;margin:0;color:#666;text-align:right;cursor:pointer;font-weight:lighter;float:right}.preview-document .preview-data p.order-search{display:none}.preview-document .preview-data input{float:right;margin:1em 0 0 1em;padding:.1em .5em;width:20ch;margin-right:-25ch;display:none}.preview-document .preview-data input.active{margin-right:0;display:inline-block}.preview-document .preview-data ul{position:absolute;right:0;top:4em;background:#fff;box-shadow:0 0 25px -10px rgba(0,0,0,.2);-webkit-box-shadow:0 0 25px -10px rgba(0,0,0,.2);list-style:none;margin:0;padding:0;min-width:24em;display:block;height:0;overflow:hidden}.preview-document .preview-data ul.active{height:auto;z-index:1}.preview-document .preview-data ul li{box-sizing:border-box;padding:0;margin-bottom:0;border-bottom:1px solid #eaeaea;font-size:1.1em}.preview-document .preview-data ul li:hover{cursor:pointer;background:#51266b;color:#fff}.preview-document .preview-data ul li a,.preview-document .preview-data.preview-order-data ul li{display:block;padding:1.4em 1.6em}.preview-document .preview-data .arrow-down{font-size:.8em;color:#999;margin-left:8px}.preview-document .preview-data p:hover,.preview-document .preview-data p:hover>.arrow-down{color:#222}.preview-document .preview-data #preview-order-search-results{display:none;position:absolute;right:0;top:4em;width:300px;box-shadow:0 0 25px -10px rgba(0,0,0,.2);-webkit-box-shadow:0 0 25px -10px rgba(0,0,0,.2);padding:20px 0;background-color:#fff;z-index:99}.preview-document .preview-data #preview-order-search-results a{display:block;border-left:1px solid #999;border-right:1px solid #999;border-top:1px solid #999;color:#000;padding:10px;margin:0 20px;text-decoration:none;cursor:pointer}.preview-document .preview-data #preview-order-search-results a:last-child{border-bottom:1px solid #999}.preview-document .preview-data #preview-order-search-results a:hover{background-color:#51266b;color:#fff}.preview-document .preview-data #preview-order-search-results .order-number{font-weight:700}.preview-document .preview-data #preview-order-search-results .date,.preview-document .preview-data #preview-order-search-results .total{margin-top:6px;display:inline-block}.preview-document .preview-data #preview-order-search-results .total{float:right}.preview-document .preview-data #preview-order-search-results .error{margin:0 20px}.preview-document .preview-order-search-wrapper{position:relative;float:right}.preview-document .preview-order-search-wrapper img.preview-order-search-clear{position:absolute;width:30px;height:16px;top:22px;right:6px;display:none;cursor:pointer}#wpo-wcpdf-preview-wrapper .gutter{flex:0 0 5%;position:sticky;top:2.4em;height:170vh}#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .gutter .slide-left,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .gutter .slide-left{float:right}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .gutter .slide-left{border:none}#wpo-wcpdf-preview-wrapper .slider{box-sizing:border-box;padding-top:2.4em;color:#999;font-weight:700;cursor:pointer;font-size:.7em;line-height:1em;width:50%;height:100%;float:left}#wpo-wcpdf-preview-wrapper .slider.slide-left{text-align:right;padding-right:10px;border-right:1px solid #ccc}#wpo-wcpdf-preview-wrapper .slider.slide-right{text-align:left;padding-left:10px;border-left:1px solid #ccc;display:none}#wpo-wcpdf-preview-wrapper .gutter-arrow{width:0;height:0;border-top:3px solid transparent;border-bottom:3px solid transparent;display:block}#wpo-wcpdf-preview-wrapper .arrow-left{border-right:7px solid #999;float:right}#wpo-wcpdf-preview-wrapper .arrow-right{border-left:7px solid #999}#wpo-wcpdf-preview-wrapper .slider:hover>.arrow-left{border-right:7px solid #222}#wpo-wcpdf-preview-wrapper .slider:hover>.arrow-right{border-left:7px solid #222}#wpo-wcpdf-preview-wrapper .slider.slide-left:after{position:absolute;top:1.55em;right:2em;font-size:1.4em;display:none}#wpo-wcpdf-preview-wrapper .slider.slide-right:after{position:absolute;top:1.55em;left:2em;font-size:1.4em;display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .gutter{display:none}#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=sidebar] .gutter{height:100vh}#wpo-wcpdf-preview-wrapper[data-preview-state=full] .slide-right:after{display:inline-block}#wpo-wcpdf-preview-wrapper[data-preview-state=closed] .slide-left:after{display:inline-block}#wpo-wcpdf-preview-wrapper.static .gutter,#wpo-wcpdf-preview-wrapper.static .preview-document{position:static!important}#wpo-wcpdf-preview-wrapper.static .sidebar{height:170vh!important;overflow:hidden}#wpo-wcpdf-preview-wrapper input.readonly,#wpo-wcpdf-preview-wrapper input[readonly],#wpo-wcpdf-preview-wrapper textarea.readonly,#wpo-wcpdf-preview-wrapper textarea[readonly]{background-color:#f8f8f8}#wpo-wcpdf-preview-wrapper[data-preview-state=sidebar] .select2.select2-container{width:100%!important}.wcpdf_ubl_settings_sections{margin-bottom:4em}#wpo-wcpdf-preview-wrapper input#due_date_days{text-align:right}#wpo-wcpdf-preview-wrapper input#due_date_days:disabled{background-color:#eaeaea;color:#999}sup.wcpdf_beta{background-color:#51266b;color:#fff;font-size:7pt;padding:1px 2px;border-radius:2px}@media screen and (min-width:1920px){.preview-document .preview>#preview-canvas{max-width:900px}}@media screen and (max-width:1200px){.preview-document .preview>#preview-canvas{max-width:680px}.nav-tab-wrapper a.nav-tab{padding:1em 2em;margin:0 .5em .5em 0;border:1px solid #ccc;box-sizing:border-box;height:4em}.nav-tab-wrapper a.nav-tab.nav-tab-active{border:3px solid #51266b}.preview-document .preview>#preview-canvas{width:80vw!important}#wpo-wcpdf-preview-wrapper .sidebar>form{max-width:100%}#wpo-wcpdf-preview-wrapper[data-preview-state=closed] .select2.select2-container{width:100%!important}#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar .form-table>tbody>tr{gap:2em}.preview-document .preview-data-wrapper{height:6em}.preview-document .preview-data p{padding:2.2em 0}#wpo-wcpdf-preview-wrapper .slider.slide-left:after,#wpo-wcpdf-preview-wrapper .slider.slide-right:after{top:1.5em;padding:1em;background:#fff;border:1px solid #ccc}#wpo-wcpdf-preview-wrapper .slider.slide-right:after{left:0}#wpo-wcpdf-preview-wrapper .slider.slide-left:after{right:0}#wpo-wcpdf-preview-wrapper .multiple-text-input tr td:nth-child(2),#wpo-wcpdf-preview-wrapper .multiple-text-input tr td:nth-child(3){float:left;margin-bottom:10px}#wpo-wcpdf-preview-wrapper .multiple-text-input tr td .woocommerce-help-tip:after{padding:.5em .8em;font-size:1.2em;line-height:inherit}}@media screen and (max-width:860px){#wpo-wcpdf-preview-wrapper[data-preview-states="1"] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="2"][data-preview-state=closed] .sidebar .form-table>tbody>tr,#wpo-wcpdf-preview-wrapper[data-preview-states="3"][data-preview-state=closed] .sidebar .form-table>tbody>tr{display:block}}div.upgrade-table-description{padding:0 0 3em 1em}div.upgrade-table-description h1{font-family:serif;letter-spacing:-1px;font-size:3em}div.upgrade-table-description p{font-size:1.1em}#upgrade-table{width:100%;border-collapse:collapse;font-size:1.2em;margin-bottom:3em}#upgrade-table td,#upgrade-table th{padding:.8em 2em;border-bottom:1px solid #ccc;text-align:center}#upgrade-table th{font-weight:400;font-size:1.1em}#upgrade-table td:not(.last),#upgrade-table th:not(.last){width:200px}#upgrade-table tr:last-child td{border:none}#upgrade-table td.feature-label{text-align:left;padding-left:1em;font-weight:700;width:500px}#upgrade-table td.feature-label span.description{display:inline-block;padding-top:10px;font-size:.8em;line-height:1.4em;font-weight:400;color:#555}#upgrade-table td span.feature-available{display:inline-block;width:24px;height:24px;background-repeat:no-repeat;background-size:cover}#upgrade-table a,div.upgrade-table-description a{color:#6e1edc;white-space:nowrap}#upgrade-table .upgrade-links h4{margin:1em 0 .5em 0}#upgrade-table .upgrade-links p{margin:0;font-style:oblique;font-size:.8em}#plugin-recommendations a.upgrade_button,#upgrade-table .upgrade-links a.upgrade_button{display:inline-block;background:#fff;padding:1em 3em 1em 2em;border-radius:12px;border:1px solid #6e1edc;text-decoration:none;margin:2em 0;position:relative}#plugin-recommendations a.upgrade_button:after,#upgrade-table .upgrade-links a.upgrade_button:after{content:' \2192';display:block;position:absolute;right:1.8em;top:1.1em;transition:.5s}#plugin-recommendations a.upgrade_button:hover:after,#upgrade-table .upgrade-links a.upgrade_button:hover:after{right:1.1em;font-weight:700}#plugin-recommendations a.upgrade_button:focus,#plugin-recommendations a.upgrade_button:hover,#upgrade-table .upgrade-links a.upgrade_button:focus,#upgrade-table .upgrade-links a.upgrade_button:hover{background:#6e1edc;color:#fcfbf7}#plugin-recommendations{border-radius:8px;background-color:#f1e9fc;padding:4em 3em}#plugin-recommendations .card-container{max-width:1100px;display:grid;grid-template-columns:repeat(3,1fr);grid-gap:3em;padding:2em 0}#plugin-recommendations .recommendation-card{margin-top:0;border-radius:6px;background-color:#fff;box-shadow:0 0 25px -10px rgba(0,0,0,.2);box-sizing:border-box;font-size:15px;overflow:hidden;transition:.2s}#plugin-recommendations .recommendation-card:nth-child(n+4){display:none}#plugin-recommendations .recommendation-card:hover{scale:1.02}#plugin-recommendations .recommendation-card.currently-installed{opacity:.5}#plugin-recommendations .recommendation-card .card-content{padding:0 4em 3em 2em}#plugin-recommendations .recommendation-card img{width:100%}#plugin-recommendations .recommendation-card h5{text-align:left;font-size:1.4em;line-height:1.3em;font-weight:700;margin:1em 0}#plugin-recommendations .recommendation-card p{text-align:left;padding-bottom:10px}#plugin-recommendations .recommendation-card a.upgrade_button{margin:0}#plugin-recommendations .recommendation-card span.currently-installed{font-size:.7em;color:#fff;background-color:#6e1edc;padding:1em 2em;border-radius:12px;margin:0;display:inline-block}@media screen and (max-width:1100px){#upgrade-table{font-size:1em;line-height:1.2em}#upgrade-table td:not(.last),#upgrade-table th:not(.last){width:25%;padding:.8em 1em}#upgrade-table td.last,#upgrade-table th.last{width:0;padding:0}#upgrade-table td.feature-label span.description{padding-top:6px}#plugin-recommendations .card-container{grid-gap:2em}}@media screen and (max-width:968px){#plugin-recommendations .card-container{grid-template-columns:repeat(1,1fr);padding-right:40%}}@media screen and (max-width:782px){#wpo-wcpdf-preview-wrapper .sidebar .form-table>tbody>tr>td:has(input[type=checkbox]+input[type=text])>input{display:inline-block}}@media screen and (max-width:767px){#upgrade-table td.feature-label span.description{display:none}#upgrade-table td:not(.last),#upgrade-table th:not(.last){width:20%}#upgrade-table td.first{width:40%}#plugin-recommendations .card-container{padding-right:0}}@media screen and (max-width:649px){div.upgrade-table-description{padding-left:.8em}div.upgrade-table-description p{font-size:1em}#upgrade-table{font-size:.8em}#upgrade-table td,#upgrade-table th{padding:.5em .8em!important}#upgrade-table td span.feature-available{width:18px;height:18px}#upgrade-table .upgrade-links a{white-space:normal;padding:.6em .8em;border-radius:6px}#upgrade-table .upgrade-links a:after{display:none}#plugin-recommendations .card-container{justify-content:center}}@media screen and (max-width:782px){input[type=checkbox],input[type=radio]{margin-bottom:.5em}}
\ No newline at end of file
diff --git a/includes/Admin.php b/includes/Admin.php
index c6cb6e71e..9b34cec4e 100644
--- a/includes/Admin.php
+++ b/includes/Admin.php
@@ -21,7 +21,7 @@ public static function instance() {
 		return self::$_instance;
 	}
 
-	public function __construct()	{
+	public function __construct() {
 		add_action( 'woocommerce_admin_order_actions_end', array( $this, 'add_listing_actions' ) );
 
 		if ( $this->invoice_columns_enabled() ) { // prevents the expensive hooks below to be attached. Improves Order List page loading speed
@@ -88,7 +88,7 @@ public function review_plugin_notice() {
 		} else {
 			if ( isset( $_REQUEST['wpo_wcpdf_dismiss_review'] ) && isset( $_REQUEST['_wpdismissnonce'] ) ) {
 				// validate nonce
-				if ( ! wp_verify_nonce( $_REQUEST['_wpdismissnonce'], 'dismiss_review_nonce' ) ) {
+				if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpdismissnonce'] ) ), 'dismiss_review_nonce' ) ) {
 					wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_dismiss_review' );
 					return;
 				} else {
@@ -102,7 +102,7 @@ public function review_plugin_notice() {
 			if ( $invoice_count > 100 ) {
 				// keep track of how many days this notice is show so we can remove it after 7 days
 				$notice_shown_on = get_option( 'wpo_wcpdf_review_notice_shown', array() );
-				$today           = date('Y-m-d');
+				$today           = gmdate( 'Y-m-d' );
 				if ( ! in_array( $today, $notice_shown_on ) ) {
 					$notice_shown_on[] = $today;
 					update_option( 'wpo_wcpdf_review_notice_shown', $notice_shown_on );
@@ -116,8 +116,15 @@ public function review_plugin_notice() {
 				$rounded_count = (int) substr( (string) $invoice_count, 0, 1 ) * pow( 10, strlen( (string) $invoice_count ) - 1);
 				?>
 				<div class="notice notice-info is-dismissible wpo-wcpdf-review-notice">
-					<?php /* translators: rounded count */ ?>
-					<h3><?php printf( esc_html__( 'Wow, you have created more than %d invoices with our plugin!', 'woocommerce-pdf-invoices-packing-slips' ), $rounded_count ); ?></h3>
+					<h3>
+						<?php
+							printf(
+								/* translators: rounded count */
+								esc_html__( 'Wow, you have created more than %d invoices with our plugin!', 'woocommerce-pdf-invoices-packing-slips' ),
+								esc_html( $rounded_count )
+							);
+						?>
+					</h3>
 					<p><?php esc_html_e( 'It would mean a lot to us if you would quickly give our plugin a 5-star rating. Help us spread the word and boost our motivation!', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 					<ul>
 						<li><a href="https://wordpress.org/support/plugin/woocommerce-pdf-invoices-packing-slips/reviews/?rate=5#new-post" class="button"><?php esc_html_e( 'Yes you deserve it!', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></a></li>
@@ -151,7 +158,7 @@ public function install_wizard_notice() {
 		} else {
 			if ( isset( $_REQUEST['wpo_wcpdf_dismiss_install'] ) && isset( $_REQUEST['_wpdismissnonce'] ) ) {
 				// validate nonce
-				if ( ! wp_verify_nonce( $_REQUEST['_wpdismissnonce'], 'dismiss_install_nonce' ) ) {
+				if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpdismissnonce'] ) ), 'dismiss_install_nonce' ) ) {
 					wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_dismiss_install' );
 					return;
 				} else {
@@ -182,7 +189,7 @@ public function install_wizard_notice() {
 
 	public function setup_wizard() {
 		// Setup/welcome
-		if ( ! empty( $_GET['page'] ) && $_GET['page'] == 'wpo-wcpdf-setup' ) {
+		if ( ! empty( $_GET['page'] ) && 'wpo-wcpdf-setup' === $_GET['page'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			delete_transient( 'wpo_wcpdf_new_install' );
 			SetupWizard::instance();
 		}
@@ -240,7 +247,7 @@ public function add_listing_actions( $order ) {
 								}
 
 								$listing_actions[$document->get_type()] = array(
-									'url'           => esc_url( $document_url ),
+									'url'           => $document_url,
 									'img'           => $icon,
 									'alt'           => "PDF " . $document_title,
 									'exists'        => $document_exists,
@@ -262,7 +269,7 @@ public function add_listing_actions( $order ) {
 								}
 
 								$listing_actions[ $document->get_type()."_{$output_format}" ] = array(
-									'url'           => esc_url( $document_url ),
+									'url'           => $document_url,
 									'img'           => $icon,
 									'alt'           => "UBL " . $document_title,
 									'exists'        => $document_exists,
@@ -292,15 +299,28 @@ public function add_listing_actions( $order ) {
 			// ubl replaces exists
 			$exists  = isset( $data['output_format'] ) && 'ubl' === $data['output_format'] ? '<svg class="icon-ubl" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M8.59323 18.3608L9.95263 16.9123L9.95212 16.8932L4.85783 12.112L9.64826 7.00791L8.18994 5.63922L2.03082 12.2016L8.59323 18.3608ZM15.4068 18.3608L14.0474 16.9123L14.0479 16.8932L19.1422 12.112L14.3517 7.00791L15.8101 5.63922L21.9692 12.2016L15.4068 18.3608Z"/></svg>' : $exists;
 
+			$allowed_svg_tags = array(
+				'svg' => array(
+					'class'   => true,
+					'xmlns'   => true,
+					'viewbox' => true, // Lowercase 'viewbox' because wp_kses() converts attribute names to lowercase
+				),
+				'path' => array(
+					'fill-rule' => true,
+					'clip-rule' => true,
+					'd'         => true,
+				),
+			);
+
 			if ( isset( $data['output_format'] ) && ( 'ubl' !== $data['output_format'] || $data['exists'] ) ) {
 				printf(
 					'<a href="%1$s" class="button tips wpo_wcpdf %2$s" target="_blank" alt="%3$s" data-tip="%3$s" style="background-image:url(%4$s);">%5$s%6$s</a>',
-					esc_attr( $data['url'] ),
+					esc_url( $data['url'] ),
 					esc_attr( $data['class'] ),
 					esc_attr( $data['alt'] ),
 					esc_attr( $data['img'] ),
-					$exists,
-					$printed
+					! empty( $exists ) ? wp_kses( $exists, $allowed_svg_tags ) : '',
+					! empty( $printed ) ? wp_kses( $printed, $allowed_svg_tags ) : ''
 				);
 			}
 		}
@@ -311,7 +331,9 @@ public function add_listing_actions( $order ) {
 	 * @param array $columns shop order columns
 	 */
 	public function add_invoice_columns( $columns ) {
-		if ( WPO_WCPDF()->order_util->custom_orders_table_usage_is_enabled() && isset( $_REQUEST['page'] ) && $_REQUEST['page'] == 'wc-orders' && isset( $_REQUEST['action'] ) && $_REQUEST['action'] == 'edit' ) {
+		$current_screen = get_current_screen();
+
+		if ( WPO_WCPDF()->order_util->custom_orders_table_usage_is_enabled() && 'woocommerce_page_wc-orders' !== $current_screen->id ) {
 			return $columns;
 		}
 
@@ -362,12 +384,12 @@ public function invoice_columns_data( $column, $post_or_order_object ) {
 		switch ( $column ) {
 			case 'invoice_number_column':
 				$invoice_number = ! empty( $invoice ) && ! empty( $invoice->get_number() ) ? $invoice->get_number() : '';
-				echo $invoice_number;
+				echo esc_html( $invoice_number );
 				do_action( 'wcpdf_invoice_number_column_end', $order );
 				break;
 			case 'invoice_date_column':
 				$invoice_date = ! empty( $invoice ) && ! empty( $invoice->get_date() ) ? $invoice->get_date()->date_i18n( wcpdf_date_format( $invoice, 'invoice_date_column' ) ) : '';
-				echo $invoice_date;
+				echo esc_html( $invoice_date );
 				do_action( 'wcpdf_invoice_date_column_end', $order );
 				break;
 			default:
@@ -605,25 +627,45 @@ public function pdf_actions_meta_box( $post_or_order_object ) {
 		<ul class="wpo_wcpdf-actions">
 			<?php
 			foreach ( $meta_box_actions as $document_type => $data ) {
-				$url                   = isset( $data['url'] ) ? esc_attr( $data['url'] ) : '';
-				$class                 = isset( $data['class'] ) ? esc_attr( $data['class'] ) : '';
-				$alt                   = isset( $data['alt'] ) ? esc_attr( $data['alt'] ) : '';
-				$title                 = isset( $data['title'] ) ? esc_attr( $data['title'] ) : '';
+				$url                   = isset( $data['url'] ) ? $data['url'] : '';
+				$class                 = isset( $data['class'] ) ? $data['class'] : '';
+				$alt                   = isset( $data['alt'] ) ? $data['alt'] : '';
+				$title                 = isset( $data['title'] ) ? $data['title'] : '';
 				$exists                = isset( $data['exists'] ) && $data['exists'] ? '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M9,20.42L2.79,14.21L5.62,11.38L9,14.77L18.88,4.88L21.71,7.71L9,20.42Z"></path></svg>' : '';
 				$manually_mark_printed = isset( $data['manually_mark_printed'] ) && $data['manually_mark_printed'] && ! empty( $data['mark_printed_url'] ) ? '<p class="printed-data">&#x21b3; <a href="'.$data['mark_printed_url'].'">'.__( 'Mark printed', 'woocommerce-pdf-invoices-packing-slips' ).'</a></p>' : '';
 				$printed               = isset( $data['printed'] ) && $data['printed'] ? '<svg class="icon-printed" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill-rule="evenodd" clip-rule="evenodd" d="M8 4H16V6H8V4ZM18 6H22V18H18V22H6V18H2V6H6V2H18V6ZM20 16H18V14H6V16H4V8H20V16ZM8 16H16V20H8V16ZM8 10H6V12H8V10Z"></path></svg>' : '';
 				$unmark_printed        = isset( $data['unmark_printed_url'] ) && $data['unmark_printed_url'] ? '<a class="unmark_printed" href="'.$data['unmark_printed_url'].'">'.__( 'Unmark', 'woocommerce-pdf-invoices-packing-slips' ).'</a>' : '';
 				$printed_data          = isset( $data['printed'] ) && $data['printed'] && ! empty( $data['printed_data']['date'] ) ? '<p class="printed-data">&#x21b3; '.$printed.''.date_i18n( 'Y/m/d g:i:s a', strtotime( $data['printed_data']['date'] ) ).''.$unmark_printed.'</p>' : '';
 
+				$allowed_tags = array(
+					'svg' => array(
+						'class'   => true,
+						'xmlns'   => true,
+						'viewbox' => true, // Lowercase 'viewbox' because wp_kses() converts attribute names to lowercase
+					),
+					'path' => array(
+						'fill-rule' => true,
+						'clip-rule' => true,
+						'd'         => true,
+					),
+					'p' => array(
+						'class' => true,
+					),
+					'a' => array(
+						'href' => true,
+						'class' => true,
+					),
+				);
+
 				printf(
 					'<li><a href="%1$s" class="button %2$s" target="_blank" alt="%3$s">%4$s%5$s</a>%6$s%7$s</li>',
-					$url,
-					$class,
-					$alt,
-					$title,
-					$exists,
-					$manually_mark_printed,
-					$printed_data
+					esc_url( $url ),
+					esc_attr( $class ),
+					esc_attr( $alt ),
+					esc_html( $title ),
+					! empty( $exists ) ? wp_kses( $exists, $allowed_tags ) : '',
+					wp_kses( $manually_mark_printed, $allowed_tags ),
+					! empty( $printed_data ) ? wp_kses( $printed_data, $allowed_tags ) : ''
 				);
 			}
 			?>
@@ -658,7 +700,7 @@ public function ubl_actions_meta_box( $post_or_order_object ) {
 					}
 
 					$meta_box_actions[ $document->get_type() ] = array(
-						'url'    => esc_url( $document_url ),
+						'url'    => $document_url,
 						'alt'    => "UBL " . $document_title,
 						'title'  => "UBL " . $document_title,
 						'exists' => $document_exists,
@@ -678,20 +720,33 @@ public function ubl_actions_meta_box( $post_or_order_object ) {
 				$ubl_documents = 0;
 
 				foreach ( $meta_box_actions as $document_type => $data ) {
-					$url    = isset( $data['url'] ) ? esc_attr( $data['url'] ) : '';
-					$class  = isset( $data['class'] ) ? esc_attr( $data['class'] ) : '';
-					$alt    = isset( $data['alt'] ) ? esc_attr( $data['alt'] ) : '';
-					$title  = isset( $data['title'] ) ? esc_attr( $data['title'] ) : '';
+					$url    = isset( $data['url'] ) ? $data['url'] : '';
+					$class  = isset( $data['class'] ) ? $data['class'] : '';
+					$alt    = isset( $data['alt'] ) ? $data['alt'] : '';
+					$title  = isset( $data['title'] ) ? $data['title'] : '';
 					$exists = isset( $data['exists'] ) && $data['exists'] ? '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M9,20.42L2.79,14.21L5.62,11.38L9,14.77L18.88,4.88L21.71,7.71L9,20.42Z"></path></svg>' : '';
 
+					$allowed_svg_tags = array(
+						'svg' => array(
+							'class'   => true,
+							'xmlns'   => true,
+							'viewbox' => true, // Lowercase 'viewbox' because wp_kses() converts attribute names to lowercase
+						),
+						'path' => array(
+							'fill-rule' => true,
+							'clip-rule' => true,
+							'd'         => true,
+						),
+					);
+
 					if ( ! empty( $exists ) ) {
 						printf(
 							'<li><a href="%1$s" class="button %2$s" target="_blank" alt="%3$s">%4$s%5$s</a></li>',
-							$url,
-							$class,
-							$alt,
-							$title,
-							$exists
+							esc_url( $url ),
+							esc_attr( $class ),
+							esc_attr( $alt ),
+							esc_html( $title ),
+							! empty( $exists ) ? wp_kses( $exists, $allowed_svg_tags ) : ''
 						);
 
 						$ubl_documents++;
@@ -699,7 +754,7 @@ public function ubl_actions_meta_box( $post_or_order_object ) {
 				}
 
 				if ( 0 === $ubl_documents ) {
-					_e( 'UBL documents require the correspondent PDF to be generated first.', 'woocommerce-pdf-invoices-packing-slips' );
+					esc_html_e( 'UBL documents require the correspondent PDF to be generated first.', 'woocommerce-pdf-invoices-packing-slips' );
 				}
 			?>
 		</ul>
@@ -805,14 +860,14 @@ public function output_number_date_edit_fields( $document, $data ): void {
 		$data = $this->get_current_values_for_document( $document, $data );
 
 		?>
-		<div class="wcpdf-data-fields" data-document="<?= esc_attr( $document->get_type() ); ?>" data-order_id="<?php echo esc_attr( $document->order->get_id() ); ?>">
+		<div class="wcpdf-data-fields" data-document="<?php echo esc_attr( $document->get_type() ); ?>" data-order_id="<?php echo esc_attr( $document->order->get_id() ); ?>">
 			<section class="wcpdf-data-fields-section number-date">
 				<!-- Title -->
 				<h4>
 					<?php echo wp_kses_post( $document->get_title() ); ?>
 					<?php if ( $document->exists() && ( isset( $data['number'] ) || isset( $data['date'] ) ) && $this->user_can_manage_document( $document->get_type() ) ) : ?>
 						<span class="wpo-wcpdf-edit-date-number dashicons dashicons-edit"></span>
-						<span class="wpo-wcpdf-delete-document dashicons dashicons-trash" data-action="delete" data-nonce="<?php echo wp_create_nonce( "wpo_wcpdf_delete_document" ); ?>"></span>
+						<span class="wpo-wcpdf-delete-document dashicons dashicons-trash" data-action="delete" data-nonce="<?php echo esc_attr( wp_create_nonce( 'wpo_wcpdf_delete_document' ) ); ?>"></span>
 						<?php do_action( 'wpo_wcpdf_document_actions', $document ); ?>
 					<?php endif; ?>
 				</h4>
@@ -821,42 +876,42 @@ public function output_number_date_edit_fields( $document, $data ): void {
 				<div class="read-only">
 					<?php if ( $document->exists() ) : ?>
 						<?php if ( isset( $data['number'] ) ) : ?>
-						<div class="<?= esc_attr( $document->get_type() ); ?>-number">
-							<p class="form-field <?= esc_attr( $data['number']['name'] ); ?>_field">
+						<div class="<?php echo esc_attr( $document->get_type() ); ?>-number">
+							<p class="form-field <?php echo esc_attr( $data['number']['name'] ); ?>_field">
 								<p>
-									<span><strong><?= wp_kses_post( $data['number']['label'] ); ?></strong></span>
-									<span><?= esc_attr( $data['number']['formatted'] ); ?></span>
+									<span><strong><?php echo wp_kses_post( $data['number']['label'] ); ?></strong></span>
+									<span><?php echo esc_attr( $data['number']['formatted'] ); ?></span>
 								</p>
 							</p>
 						</div>
 						<?php endif; ?>
 						<?php if( isset( $data['date'] ) ) : ?>
-						<div class="<?= esc_attr( $document->get_type() ); ?>-date">
+						<div class="<?php echo esc_attr( $document->get_type() ); ?>-date">
 							<p class="form-field form-field-wide">
 								<p>
-									<span><strong><?= wp_kses_post( $data['date']['label'] ); ?></strong></span>
-									<span><?= esc_attr( $data['date']['formatted'] ); ?></span>
+									<span><strong><?php echo wp_kses_post( $data['date']['label'] ); ?></strong></span>
+									<span><?php echo esc_attr( $data['date']['formatted'] ); ?></span>
 								</p>
 							</p>
 						</div>
 						<?php endif; ?>
 						<div class="pdf-more-details" style="display:none;">
 							<?php if ( isset( $data['display_date'] ) ) : ?>
-							<div class="<?= esc_attr( $document->get_type() ); ?>-display-date">
+							<div class="<?php echo esc_attr( $document->get_type() ); ?>-display-date">
 								<p class="form-field form-field-wide">
 									<p>
-										<span><strong><?= wp_kses_post( $data['display_date']['label'] ); ?></strong></span>
-										<span><?= esc_attr( $data['display_date']['value'] ); ?></span>
+										<span><strong><?php echo wp_kses_post( $data['display_date']['label'] ); ?></strong></span>
+										<span><?php echo esc_attr( $data['display_date']['value'] ); ?></span>
 									</p>
 								</p>
 							</div>
 							<?php endif; ?>
 							<?php if ( isset( $data['creation_trigger'] ) && ! empty( $data['creation_trigger']['value'] ) ) : ?>
-							<div class="<?= esc_attr( $document->get_type() ); ?>-creation-status">
+							<div class="<?php echo esc_attr( $document->get_type() ); ?>-creation-status">
 								<p class="form-field form-field-wide">
 									<p>
-										<span><strong><?= wp_kses_post( $data['creation_trigger']['label'] ); ?></strong></span>
-										<span><?= esc_attr( $data['creation_trigger']['value'] ); ?></span>
+										<span><strong><?php echo wp_kses_post( $data['creation_trigger']['label'] ); ?></strong></span>
+										<span><?php echo esc_attr( $data['creation_trigger']['value'] ); ?></span>
 									</p>
 								</p>
 							</div>
@@ -864,8 +919,8 @@ public function output_number_date_edit_fields( $document, $data ): void {
 						</div>
 						<?php if ( isset( $data['display_date'] ) || isset( $data['creation_trigger'] ) ) : ?>
 							<div>
-								<a href="#" class="view-more"><?php _e( 'View more details', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
-								<a href="#" class="hide-details" style="display:none;"><?php _e( 'Hide details', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
+								<a href="#" class="view-more"><?php esc_html_e( 'View more details', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
+								<a href="#" class="hide-details" style="display:none;"><?php esc_html_e( 'Hide details', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
 							</div>
 						<?php endif; ?>
 						<?php do_action( 'wpo_wcpdf_meta_box_after_document_data', $document, $document->order ); ?>
@@ -892,15 +947,15 @@ public function output_number_date_edit_fields( $document, $data ): void {
 				<!-- Editable -->
 				<div class="editable">
 					<?php if( isset( $data['number'] ) ) : ?>
-					<p class="form-field <?= esc_attr( $data['number']['name'] ); ?>_field">
-						<label for="<?= esc_attr( $data['number']['name'] ); ?>"><?= wp_kses_post( $data['number']['label'] ); ?></label>
-						<input type="text" class="short" style="" name="<?= esc_attr( $data['number']['name'] ); ?>" id="<?= esc_attr( $data['number']['name'] ); ?>" value="<?= esc_attr( $data['number']['plain'] ); ?>" disabled="disabled" > (<?= esc_html__( 'unformatted!', 'woocommerce-pdf-invoices-packing-slips' ); ?>)
+					<p class="form-field <?php echo esc_attr( $data['number']['name'] ); ?>_field">
+						<label for="<?php echo esc_attr( $data['number']['name'] ); ?>"><?php echo wp_kses_post( $data['number']['label'] ); ?></label>
+						<input type="text" class="short" style="" name="<?php echo esc_attr( $data['number']['name'] ); ?>" id="<?php echo esc_attr( $data['number']['name'] ); ?>" value="<?php echo esc_attr( $data['number']['plain'] ); ?>" disabled="disabled" > (<?php echo esc_html__( 'unformatted!', 'woocommerce-pdf-invoices-packing-slips' ); ?>)
 					</p>
 					<?php endif; ?>
 					<?php if( isset( $data['date'] ) ) : ?>
 					<p class="form-field form-field-wide">
-						<label for="<?= esc_attr( $data['date']['name'] ); ?>[date]"><?= wp_kses_post( $data['date']['label'] ); ?></label>
-						<input type="text" class="date-picker-field" name="<?= esc_attr( $data['date']['name'] ); ?>[date]" id="<?= esc_attr( $data['date']['name'] ); ?>[date]" maxlength="10" value="<?= esc_attr( $data['date']['date'] ); ?>" pattern="[0-9]{4}-(0[1-9]|1[012])-(0[1-9]|1[0-9]|2[0-9]|3[01])" disabled="disabled"/>@<input type="number" class="hour" disabled="disabled" placeholder="<?php esc_attr_e( 'h', 'woocommerce' ); ?>" name="<?= esc_attr( $data['date']['name'] ); ?>[hour]" id="<?= esc_attr( $data['date']['name'] ); ?>[hour]" min="0" max="23" size="2" value="<?= esc_attr( $data['date']['hour'] ); ?>" pattern="([01]?[0-9]{1}|2[0-3]{1})" />:<input type="number" class="minute" placeholder="<?php esc_attr_e( 'm', 'woocommerce' ); ?>" name="<?= esc_attr( $data['date']['name'] ); ?>[minute]" id="<?= esc_attr( $data['date']['name'] ); ?>[minute]" min="0" max="59" size="2" value="<?= esc_attr( $data['date']['minute'] ); ?>" pattern="[0-5]{1}[0-9]{1}"  disabled="disabled" />
+						<label for="<?php echo esc_attr( $data['date']['name'] ); ?>[date]"><?php echo wp_kses_post( $data['date']['label'] ); ?></label>
+						<input type="text" class="date-picker-field" name="<?php echo esc_attr( $data['date']['name'] ); ?>[date]" id="<?php echo esc_attr( $data['date']['name'] ); ?>[date]" maxlength="10" value="<?php echo esc_attr( $data['date']['date'] ); ?>" pattern="[0-9]{4}-(0[1-9]|1[012])-(0[1-9]|1[0-9]|2[0-9]|3[01])" disabled="disabled"/>@<input type="number" class="hour" disabled="disabled" placeholder="<?php esc_attr_e( 'h', 'woocommerce-pdf-invoices-packing-slips' ); ?>" name="<?php echo esc_attr( $data['date']['name'] ); ?>[hour]" id="<?php echo esc_attr( $data['date']['name'] ); ?>[hour]" min="0" max="23" size="2" value="<?php echo esc_attr( $data['date']['hour'] ); ?>" pattern="([01]?[0-9]{1}|2[0-3]{1})" />:<input type="number" class="minute" placeholder="<?php esc_attr_e( 'm', 'woocommerce-pdf-invoices-packing-slips' ); ?>" name="<?php echo esc_attr( $data['date']['name'] ); ?>[minute]" id="<?php echo esc_attr( $data['date']['name'] ); ?>[minute]" min="0" max="59" size="2" value="<?php echo esc_attr( $data['date']['minute'] ); ?>" pattern="[0-5]{1}[0-9]{1}"  disabled="disabled" />
 					</p>
 					<?php endif; ?>
 				</div>
@@ -912,17 +967,17 @@ public function output_number_date_edit_fields( $document, $data ): void {
 
 				<!-- Read only -->
 				<div class="read-only">
-					<span><strong><?= wp_kses_post( $data['notes']['label'] ); ?></strong></span>
+					<span><strong><?php echo wp_kses_post( $data['notes']['label'] ); ?></strong></span>
 					<?php if ( $this->user_can_manage_document( $document->get_type() ) ) : ?>
 						<span class="wpo-wcpdf-edit-document-notes dashicons dashicons-edit" data-edit="notes"></span>
 					<?php endif; ?>
-					<p><?= ( $data['notes']['value'] == strip_tags( $data['notes']['value'] ) ) ? wp_kses_post( nl2br( $data['notes']['value'] ) ) : wp_kses_post( $data['notes']['value'] ); ?></p>
+					<p><?php echo ( $data['notes']['value'] == wp_strip_all_tags( $data['notes']['value'] ) ) ? wp_kses_post( nl2br( $data['notes']['value'] ) ) : wp_kses_post( $data['notes']['value'] ); ?></p>
 				</div>
 				<!-- Editable -->
 				<div class="editable-notes">
 					<p class="form-field form-field-wide">
-						<label for="<?= esc_attr( $data['notes']['name'] ); ?>"><?= wp_kses_post( $data['notes']['label'] ); ?></label>
-						<p><textarea name="<?= esc_attr( $data['notes']['name'] ); ?>" class="<?= esc_attr( $data['notes']['name'] ); ?>" cols="60" rows="5" disabled="disabled"><?= wp_kses_post( $data['notes']['value'] ); ?></textarea></p>
+						<label for="<?php echo esc_attr( $data['notes']['name'] ); ?>"><?php echo wp_kses_post( $data['notes']['label'] ); ?></label>
+						<p><textarea name="<?php echo esc_attr( $data['notes']['name'] ); ?>" class="<?php echo esc_attr( $data['notes']['name'] ); ?>" cols="60" rows="5" disabled="disabled"><?php echo wp_kses_post( $data['notes']['value'] ); ?></textarea></p>
 					</p>
 				</div>
 
@@ -936,7 +991,7 @@ public function output_number_date_edit_fields( $document, $data ): void {
 			<!-- Save/Cancel buttons -->
 			<section class="wcpdf-data-fields-section wpo-wcpdf-document-buttons">
 				<div>
-					<a class="button button-primary wpo-wcpdf-save-document" data-nonce="<?php echo wp_create_nonce( "wpo_wcpdf_save_document" ); ?>" data-action="save"><?php esc_html_e( 'Save changes', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
+					<a class="button button-primary wpo-wcpdf-save-document" data-nonce="<?php echo esc_attr( wp_create_nonce( 'wpo_wcpdf_save_document' ) ); ?>" data-action="save"><?php esc_html_e( 'Save changes', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
 					<a class="button wpo-wcpdf-cancel"><?php esc_html_e( 'Cancel', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
 				</div>
 			</section>
@@ -948,7 +1003,7 @@ public function output_number_date_edit_fields( $document, $data ): void {
 	public function add_regenerate_document_button( $document ) {
 		$document_settings = $document->get_settings( true );
 		if ( $document->use_historical_settings() == true || isset( $document_settings['archive_pdf'] ) ) {
-			printf( '<span class="wpo-wcpdf-regenerate-document dashicons dashicons-update-alt" data-nonce="%s" data-action="regenerate"></span>', wp_create_nonce( "wpo_wcpdf_regenerate_document" ) );
+			printf( '<span class="wpo-wcpdf-regenerate-document dashicons dashicons-update-alt" data-nonce="%s" data-action="regenerate"></span>', esc_attr( wp_create_nonce( 'wpo_wcpdf_regenerate_document' ) ) );
 		}
 	}
 
@@ -974,9 +1029,8 @@ public function save_invoice_number_date( $order_id, $order ) {
 
 		$order_type = $order->get_type();
 
-		if ( $order_type == 'shop_order' ) {
-			// bail if this is not an actual 'Save order' action
-			if ( ! isset( $_POST['action'] ) || $_POST['action'] != 'editpost' ) {
+		if ( 'shop_order' === $order_type ) {
+			if ( empty( $_POST['woocommerce_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['woocommerce_meta_nonce'] ) ), 'woocommerce_save_data' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 				return;
 			}
 
@@ -1039,8 +1093,13 @@ public function return_false() {
 	public function send_emails( $post_or_order_object_id, $post_or_order_object ) {
 		$order = ( $post_or_order_object instanceof \WP_Post ) ? wc_get_order( $post_or_order_object->ID ) : $post_or_order_object;
 
+		// Check the nonce.
+		if ( empty( $_POST['woocommerce_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['woocommerce_meta_nonce'] ) ), 'woocommerce_save_data' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+			return;
+		}
+
 		if ( ! empty( $_POST['wpo_wcpdf_send_emails'] ) ) {
-			$action = wc_clean( $_POST['wpo_wcpdf_send_emails'] );
+			$action = sanitize_text_field( wp_unslash( $_POST['wpo_wcpdf_send_emails'] ) );
 			if ( ! empty( $action ) && strstr( $action, 'send_email_' ) ) {
 				$email_to_send = str_replace( 'send_email_', '', $action );
 				// Switch back to the site locale.
@@ -1111,39 +1170,43 @@ public function ajax_crud_document() {
 			) );
 		}
 
-		if ( ! isset($_POST['action']) ||  ! in_array( $_POST['action'], array( 'wpo_wcpdf_regenerate_document', 'wpo_wcpdf_save_document', 'wpo_wcpdf_delete_document' ) ) ) {
+		$request = stripslashes_deep( $_POST );
+
+		if ( ! isset( $request['action'] ) ||  ! in_array( $request['action'], array( 'wpo_wcpdf_regenerate_document', 'wpo_wcpdf_save_document', 'wpo_wcpdf_delete_document' ) ) ) {
 			wp_send_json_error( array(
 				'message' => esc_html__( 'Bad action!', 'woocommerce-pdf-invoices-packing-slips' ),
 			) );
 		}
 
-		if( empty($_POST['order_id']) || empty($_POST['document_type']) || empty($_POST['action_type']) ) {
+		if ( empty( $request['order_id'] ) || empty( $request['document_type'] ) || empty( $request['action_type'] ) ) {
 			wp_send_json_error( array(
 				'message' => esc_html__( 'Incomplete request!', 'woocommerce-pdf-invoices-packing-slips' ),
 			) );
 		}
 
-		if ( ! $this->user_can_manage_document( sanitize_text_field( $_POST['document_type'] ) ) ) {
+		if ( ! $this->user_can_manage_document( $request['document_type'] ) ) {
 			wp_send_json_error( array(
 				'message' => esc_html__( 'No permissions!', 'woocommerce-pdf-invoices-packing-slips' ),
 			) );
 		}
 
-		$order_id        = absint( $_POST['order_id'] );
-		$order           = wc_get_order( $order_id );
-		$document_type   = sanitize_text_field( $_POST['document_type'] );
-		$action_type     = sanitize_text_field( $_POST['action_type'] );
-		$notice          = sanitize_text_field( $_POST['wpcdf_document_data_notice'] );
+		$order_id      = absint( $request['order_id'] );
+		$order         = wc_get_order( $order_id );
+		$document_type = sanitize_text_field( $request['document_type'] );
+		$action_type   = sanitize_text_field( $request['action_type'] );
+		$notice        = isset( $request['wpcdf_document_data_notice'] ) ? sanitize_text_field( $request['wpcdf_document_data_notice'] ) : 'saved';
 
 		// parse form data
-		parse_str( $_POST['form_data'], $form_data );
+		parse_str( $request['form_data'], $form_data );
+
 		if ( is_array( $form_data ) ) {
 			foreach ( $form_data as $key => &$value ) {
-				if ( is_array( $value ) && !empty( $value[$order_id] ) ) {
-					$value = $value[$order_id];
+				if ( is_array( $value ) && ! empty( $value[ $order_id ] ) ) {
+					$value = $value[ $order_id ];
 				}
 			}
 		}
+
 		$form_data = stripslashes_deep( $form_data );
 
 		// notice messages
@@ -1168,7 +1231,7 @@ public function ajax_crud_document() {
 			if( ! empty( $document ) ) {
 
 				// perform legacy date fields replacements check
-				if( isset( $form_data["_wcpdf_{$document->slug}_date"] ) && ! is_array( $form_data["_wcpdf_{$document->slug}_date"] ) ) {
+				if ( isset( $form_data["_wcpdf_{$document->slug}_date"] ) && ! is_array( $form_data["_wcpdf_{$document->slug}_date"] ) ) {
 					$form_data = $this->legacy_date_fields_replacements( $form_data, $document->slug );
 				}
 
@@ -1176,15 +1239,15 @@ public function ajax_crud_document() {
 				$document_data = $this->process_order_document_form_data( $form_data, $document->slug );
 
 				// on regenerate
-				if( $action_type == 'regenerate' && $document->exists() ) {
+				if ( $action_type == 'regenerate' && $document->exists() ) {
 					$document->regenerate( $order, $document_data );
-					WPO_WCPDF()->main->log_document_creation_trigger_to_order_meta( $document, 'document_data', true );
+					WPO_WCPDF()->main->log_document_creation_trigger_to_order_meta( $document, 'document_data', true, $request );
 					$response = array(
 						'message' => $notice_messages[$notice]['success'],
 					);
 
 				// on delete
-				} elseif( $action_type == 'delete' && $document->exists() ) {
+				} elseif ( $action_type == 'delete' && $document->exists() ) {
 					$document->delete();
 
 					$response = array(
@@ -1192,7 +1255,7 @@ public function ajax_crud_document() {
 					);
 
 				// on save
-				} elseif( $action_type == 'save' ) {
+				} elseif ( $action_type == 'save' ) {
 					$is_new = false === $document->exists();
 					$document->set_data( $document_data, $order );
 
@@ -1205,7 +1268,7 @@ public function ajax_crud_document() {
 
 					if ( $is_new ) {
 						WPO_WCPDF()->main->log_document_creation_to_order_notes( $document, 'document_data' );
-						WPO_WCPDF()->main->log_document_creation_trigger_to_order_meta( $document, 'document_data' );
+						WPO_WCPDF()->main->log_document_creation_trigger_to_order_meta( $document, 'document_data', false, $request );
 						WPO_WCPDF()->main->mark_document_printed( $document, 'document_data' );
 					}
 					$response      = array(
@@ -1272,6 +1335,16 @@ public function process_order_document_form_data( $form_data, $document_slug )
 	{
 		$data = array();
 
+		if (
+			check_ajax_referer( 'wpo_wcpdf_regenerate_document', 'security', false ) === false &&
+			check_ajax_referer( 'wpo_wcpdf_save_document', 'security', false ) === false &&
+			check_ajax_referer( 'wpo_wcpdf_delete_document', 'security', false ) === false &&
+			( empty( $_POST['woocommerce_meta_nonce'] ) ||
+			  ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['woocommerce_meta_nonce'] ) ), 'woocommerce_save_data' ) ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+		) {
+			return $data;
+		}
+
 		if( isset( $form_data['_wcpdf_'.$document_slug.'_number'] ) ) {
 			$data['number'] = sanitize_text_field( $form_data['_wcpdf_'.$document_slug.'_number'] );
 		}
@@ -1283,7 +1356,7 @@ public function process_order_document_form_data( $form_data, $document_slug )
 			$minute       = ! empty( $form_data['_wcpdf_'.$document_slug.'_date']['minute'] ) ? $form_data['_wcpdf_'.$document_slug.'_date']['minute'] : '00';
 
 			// clean & sanitize input
-			$date         = date( 'Y-m-d', strtotime( $date ) );
+			$date         = gmdate( 'Y-m-d', strtotime( $date ) );
 			$hour         = sprintf('%02d', intval( $hour ));
 			$minute       = sprintf('%02d', intval( $minute ) );
 			$data['date'] = "{$date} {$hour}:{$minute}:00";
diff --git a/includes/Assets.php b/includes/Assets.php
index f6ff3de1e..539bc54d1 100644
--- a/includes/Assets.php
+++ b/includes/Assets.php
@@ -21,25 +21,18 @@ public static function instance() {
 	}
 
 	public function __construct()	{
-		add_action( 'wp_enqueue_scripts', array( $this, 'frontend_scripts_styles' ) );
-		add_action( 'admin_enqueue_scripts', array( $this, 'backend_scripts_styles' ), 11 ); // after WC
+		add_action( 'admin_enqueue_scripts', array( $this, 'backend_scripts_styles' ) );
 	}
 
 	/**
 	 * Load styles & scripts
 	 */
-	public function frontend_scripts_styles ( $hook ) {
-		# none yet
-	}
-
-	/**
-	 * Load styles & scripts
-	 */
-	public function backend_scripts_styles ( $hook ) {
+	public function backend_scripts_styles( $hook ) {
 		$suffix        = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
 		$pdfjs_version = '4.3.136';
 
 		global $wp_version;
+
 		if ( WPO_WCPDF()->admin->is_order_page() ) {
 
 			// STYLES
@@ -96,10 +89,10 @@ public function backend_scripts_styles ( $hook ) {
 
 		// only load on our own settings page
 		// maybe find a way to refer directly to WPO\IPS\Settings::$options_page_hook ?
-		if (
-			in_array( $hook, array( 'woocommerce_page_wpo_wcpdf_options_page', 'settings_page_wpo_wcpdf_options_page' ) ) ||
-			( isset( $_GET['page'] ) && 'wpo_wcpdf_options_page' === $_GET['page'] )
-		) {
+		if ( ! empty( $hook ) && false !== strpos( $hook, 'wpo_wcpdf_options_page' ) ) {
+			$tab = filter_input( INPUT_GET, 'tab', FILTER_DEFAULT );
+			$tab = sanitize_text_field( $tab );
+
 			wp_enqueue_style(
 				'wpo-wcpdf-settings-styles',
 				WPO_WCPDF()->plugin_url() . '/assets/css/settings-styles'.$suffix.'.css',
@@ -209,10 +202,78 @@ public function backend_scripts_styles ( $hook ) {
 			wp_enqueue_media();
 			wp_enqueue_script(
 				'wpo-wcpdf-media-upload',
-				WPO_WCPDF()->plugin_url() . '/assets/js/media-upload'.$suffix.'.js',
+				WPO_WCPDF()->plugin_url() . '/assets/js/media-upload' . $suffix . '.js',
 				array( 'jquery' ),
 				WPO_WCPDF_VERSION
 			);
+			
+			// status/debug page scripts
+			if ( 'debug' === $tab ) {
+				wp_enqueue_style(
+					'wpo-wcpdf-jquery-ui-styles',
+					WPO_WCPDF()->plugin_url() . '/assets/css/jquery-ui' . $suffix . '.css',
+					'1.14.0'
+				);
+
+				wp_enqueue_script( 'jquery-ui-datepicker' );
+
+				wp_enqueue_style(
+					'wpo-wcpdf-debug-tools-styles',
+					WPO_WCPDF()->plugin_url() . '/assets/css/debug-tools' . $suffix . '.css',
+					WPO_WCPDF_VERSION
+				);
+
+				wp_enqueue_script(
+					'wpo-wcpdf-debug',
+					WPO_WCPDF()->plugin_url() . '/assets/js/debug-script' . $suffix . '.js',
+					array( 'jquery', 'jquery-blockui', 'jquery-ui-datepicker' ),
+					WPO_WCPDF_VERSION
+				);
+
+				wp_localize_script(
+					'wpo-wcpdf-debug',
+					'wpo_wcpdf_debug',
+					array(
+						'ajaxurl'              => admin_url( 'admin-ajax.php' ),
+						'nonce'                => wp_create_nonce( 'wpo_wcpdf_debug_nonce' ),
+						'download_label'       => __( 'Download', 'woocommerce-pdf-invoices-packing-slips' ),
+						'confirm_reset'        => __( 'Are you sure you want to reset this settings? This cannot be undone.', 'woocommerce-pdf-invoices-packing-slips' ),
+						'select_document_type' => __( 'Please select a document type', 'woocommerce-pdf-invoices-packing-slips' ),
+						'danger_zone'          => array(
+							'enabled' => isset( WPO_WCPDF()->settings->debug_settings['enable_danger_zone_tools'] ) ? true : false,
+							'message' => sprintf(
+								/* translators: 1. open anchor tag, 2. close anchor tag */
+								__( '<strong>Enabled</strong>: %1$sclick here%2$s to start using the tools.', 'woocommerce-pdf-invoices-packing-slips' ),
+								'<a href="' . esc_url( add_query_arg( 'section', 'tools' ) ) . '#danger_zone">',
+								'</a>'
+							),
+						),
+					)
+				);
+
+			}
+			
+			// ubl taxes
+			if ( 'ubl' === $tab ) {
+				wp_enqueue_script(
+					'wpo-wcpdf-ubl',
+					WPO_WCPDF()->plugin_url() . '/assets/js/ubl-script' . $suffix . '.js',
+					array( 'jquery' ),
+					WPO_WCPDF_VERSION,
+					true
+				);
+				
+				wp_localize_script(
+					'wpo-wcpdf-ubl',
+					'wpo_wcpdf_ubl',
+					array(
+						'code'    => __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ),
+						'new'     => __( 'New', 'woocommerce-pdf-invoices-packing-slips' ),
+						'unsaved' => __( 'unsaved', 'woocommerce-pdf-invoices-packing-slips' ),
+						'remarks' => TaxesSettings::get_available_remarks(),
+					)
+				);
+			}
 
 		}
 
@@ -237,72 +298,6 @@ public function backend_scripts_styles ( $hook ) {
 			);
 		}
 
-		// status/debug page scripts
-		if ( isset( $_REQUEST['page'] ) && $_REQUEST['page'] == 'wpo_wcpdf_options_page' && isset( $_REQUEST['tab'] ) && 'debug' === $_REQUEST['tab'] ) {
-			wp_enqueue_style(
-				'wpo-wcpdf-jquery-ui-styles',
-				'https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.2/themes/smoothness/jquery-ui.css'
-			);
-
-			wp_enqueue_script( 'jquery-ui-datepicker' );
-
-			wp_enqueue_style(
-				'wpo-wcpdf-debug-tools-styles',
-				WPO_WCPDF()->plugin_url() . '/assets/css/debug-tools'.$suffix.'.css',
-				WPO_WCPDF_VERSION
-			);
-
-			wp_enqueue_script(
-				'wpo-wcpdf-debug',
-				WPO_WCPDF()->plugin_url() . '/assets/js/debug-script'.$suffix.'.js',
-				array( 'jquery', 'jquery-blockui', 'jquery-ui-datepicker' ),
-				WPO_WCPDF_VERSION
-			);
-
-			wp_localize_script(
-				'wpo-wcpdf-debug',
-				'wpo_wcpdf_debug',
-				array(
-					'ajaxurl'              => admin_url( 'admin-ajax.php' ),
-					'nonce'                => wp_create_nonce( 'wpo_wcpdf_debug_nonce' ),
-					'download_label'       => __( 'Download', 'woocommerce-pdf-invoices-packing-slips' ),
-					'confirm_reset'        => __( 'Are you sure you want to reset this settings? This cannot be undone.', 'woocommerce-pdf-invoices-packing-slips' ),
-					'select_document_type' => __( 'Please select a document type', 'woocommerce-pdf-invoices-packing-slips' ),
-					'danger_zone'          => array(
-						'enabled' => isset( WPO_WCPDF()->settings->debug_settings['enable_danger_zone_tools'] ) ? true : false,
-						'message' => sprintf(
-							/* translators: 1. open anchor tag, 2. close anchor tag */
-							__( '<strong>Enabled</strong>: %1$sclick here%2$s to start using the tools.', 'woocommerce-pdf-invoices-packing-slips' ),
-							'<a href="' . esc_url( add_query_arg( 'section', 'tools' ) ) . '#danger_zone">',
-							'</a>'
-						),
-					),
-				)
-			);
-
-		}
-		
-		// ubl taxes
-		if ( isset( $_REQUEST['page'] ) && $_REQUEST['page'] == 'wpo_wcpdf_options_page' && isset( $_REQUEST['tab'] ) && 'ubl' === $_REQUEST['tab'] ) {
-			wp_enqueue_script(
-				'wpo-wcpdf-ubl',
-				WPO_WCPDF()->plugin_url() . '/assets/js/ubl-script' . $suffix . '.js',
-				array( 'jquery' ),
-				WPO_WCPDF_VERSION,
-				true
-			);
-			
-			wp_localize_script(
-				'wpo-wcpdf-ubl',
-				'wpo_wcpdf_ubl',
-				array(
-					'code'    => __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ),
-					'new'     => __( 'New', 'woocommerce-pdf-invoices-packing-slips' ),
-					'unsaved' => __( 'unsaved', 'woocommerce-pdf-invoices-packing-slips' ),
-					'remarks' => TaxesSettings::get_available_remarks(),
-				)
-			);
-		}
 	}
 
 }
diff --git a/includes/Documents/BulkDocument.php b/includes/Documents/BulkDocument.php
index 5ccd0f304..5a1056a45 100644
--- a/includes/Documents/BulkDocument.php
+++ b/includes/Documents/BulkDocument.php
@@ -157,12 +157,12 @@ public function merge_documents( $html_content ) {
 	public function output_pdf( $output_mode = 'download' ) {
 		$pdf = $this->get_pdf();
 		wcpdf_pdf_headers( $this->get_filename(), $output_mode, $pdf );
-		echo $pdf;
+		echo $pdf; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		die();
 	}
 
 	public function output_html() {
-		echo $this->get_html();
+		echo $this->get_html(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		die();
 	}
 
diff --git a/includes/Documents/Invoice.php b/includes/Documents/Invoice.php
index f29366859..8539aa737 100644
--- a/includes/Documents/Invoice.php
+++ b/includes/Documents/Invoice.php
@@ -209,6 +209,8 @@ public function init_settings() {
 	 * PDF settings fields
 	 */
 	public function get_pdf_settings_fields( $option_name ) {
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+		
 		$settings_fields = array(
 			array(
 				'type'			=> 'section',
@@ -238,7 +240,7 @@ public function get_pdf_settings_fields( $option_name ) {
 					'id'			  => 'attach_to_email_ids',
 					'fields_callback' => array( $this, 'get_wc_emails' ),
 					/* translators: directory path */
-					'description'	  => !is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? '<span class="wpo-warning">' . sprintf( __( 'It looks like the temp folder (<code>%s</code>) is not writable, check the permissions for this folder! Without having write access to this folder, the plugin will not be able to email invoices.', 'woocommerce-pdf-invoices-packing-slips' ), WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ).'</span>':'',
+					'description'	  => ! $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? '<span class="wpo-warning">' . sprintf( __( 'It looks like the temp folder (<code>%s</code>) is not writable, check the permissions for this folder! Without having write access to this folder, the plugin will not be able to email invoices.', 'woocommerce-pdf-invoices-packing-slips' ), WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ).'</span>':'',
 				)
 			),
 			array(
@@ -576,6 +578,8 @@ public function get_pdf_settings_fields( $option_name ) {
 	 * UBL settings fields
 	 */
 	public function get_ubl_settings_fields( $option_name ) {
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+		
 		$settings_fields = array(
 			array(
 				'type'     => 'section',
@@ -625,7 +629,7 @@ public function get_ubl_settings_fields( $option_name ) {
 					'id'              => 'attach_to_email_ids',
 					'fields_callback' => array( $this, 'get_wc_emails' ),
 					/* translators: directory path */
-					'description'     => ! is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? '<span class="wpo-warning">' . sprintf( __( 'It looks like the temp folder (<code>%s</code>) is not writable, check the permissions for this folder! Without having write access to this folder, the plugin will not be able to email invoices.', 'woocommerce-pdf-invoices-packing-slips' ), WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ).'</span>':'',
+					'description'     => ! $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? '<span class="wpo-warning">' . sprintf( __( 'It looks like the temp folder (<code>%s</code>) is not writable, check the permissions for this folder! Without having write access to this folder, the plugin will not be able to email invoices.', 'woocommerce-pdf-invoices-packing-slips' ), WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ).'</span>':'',
 				)
 			),
 			array(
diff --git a/includes/Documents/OrderDocument.php b/includes/Documents/OrderDocument.php
index c4400c12f..1c824cb8d 100644
--- a/includes/Documents/OrderDocument.php
+++ b/includes/Documents/OrderDocument.php
@@ -137,7 +137,7 @@ public function init_settings() {
 
 	public function init_settings_data() {
 		// don't override/save settings on Preview requests
-		if ( isset( $_REQUEST['action'] ) && 'wpo_wcpdf_preview' === $_REQUEST['action'] ) {
+		if ( isset( $_REQUEST['action'] ) && 'wpo_wcpdf_preview' === $_REQUEST['action'] && isset( $_REQUEST['security'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['security'] ) ), 'wpo_wcpdf_preview' ) ) {
 			return;
 		}
 
@@ -228,12 +228,12 @@ public function save_settings( $latest = false ) {
 	}
 
 	public function initiate_number( $force_new_number = false ) {
-		$lock            = new Semaphore( "initiate_{$this->slug}_number" );
+		$semaphore       = new Semaphore( "initiate_{$this->slug}_number" );
 		$document_number = $this->exists() ? $this->get_data( 'number' ) : null;
 		$document_number = ! empty( $document_number ) && $force_new_number ? null : $document_number;
 
-		if ( $lock->lock() && empty( $document_number ) ) {
-			$lock->log( "Lock acquired for the {$this->slug} number init.", 'info' );
+		if ( $semaphore->lock() && empty( $document_number ) ) {
+			$semaphore->log( "Lock acquired for the {$this->slug} number init.", 'info' );
 
 			try {
 				// If a third-party plugin claims to generate document numbers, trigger this instead
@@ -263,17 +263,17 @@ public function initiate_number( $force_new_number = false ) {
 				}
 
 			} catch ( \Exception $e ) {
-				$lock->log( $e, 'critical' );
+				$semaphore->log( $e, 'critical' );
 			} catch ( \Error $e ) {
-				$lock->log( $e, 'critical' );
+				$semaphore->log( $e, 'critical' );
 			}
 
-			if ( $lock->release() ) {
-				$lock->log( "Lock released for the {$this->slug} number init.", 'info' );
+			if ( $semaphore->release() ) {
+				$semaphore->log( "Lock released for the {$this->slug} number init.", 'info' );
 			}
 
 		} else {
-			$lock->log( "Couldn't get the lock for the {$this->slug} number init.", 'critical' );
+			$semaphore->log( "Couldn't get the lock for the {$this->slug} number init.", 'critical' );
 		}
 
 		return $document_number;
@@ -488,12 +488,12 @@ public function regenerate( $order = null, $data = null ) {
 		
 		$note = $refund_id ? sprintf(
 			/* translators: 1. credit note title, 2. refund id */
-			__( '%1$s (refund #%2$s) was regenerated.', 'woocommerce-pdf-invoices-packing-slips' ),
+			esc_html__( '%1$s (refund #%2$s) was regenerated.', 'woocommerce-pdf-invoices-packing-slips' ),
 			ucfirst( $this->get_title() ),
 			$refund_id
 		) : sprintf(
 			/* translators: 1. document title */
-			__( '%s was regenerated', 'woocommerce-pdf-invoices-packing-slips' ),
+			esc_html__( '%s was regenerated', 'woocommerce-pdf-invoices-packing-slips' ),
 			ucfirst( $this->get_title() )
 		);
 		
@@ -586,7 +586,7 @@ public function get_number( $document_type = '', $order = null, $context = 'view
 	}
 
 	public function number( $document_type ) {
-		echo $this->get_number( $document_type, null, 'view', true );
+		echo esc_html( $this->get_number( $document_type, null, 'view', true ) );
 	}
 
 	public function get_date( $document_type = '', $order = null, $context = 'view', $formatted = false ) {
@@ -600,7 +600,7 @@ public function get_date( $document_type = '', $order = null, $context = 'view',
 	}
 
 	public function date( $document_type ) {
-		echo $this->get_date( $document_type, null, 'view', true );
+		echo esc_html( $this->get_date( $document_type, null, 'view', true ) );
 	}
 
 	public function get_notes( $document_type = '', $order = null, $context = 'view'  ) {
@@ -630,7 +630,7 @@ public function get_title() {
 	 * @return void
 	 */
 	public function title() {
-		echo $this->get_title();
+		echo esc_html( $this->get_title() );
 	}
 
 	/**
@@ -648,7 +648,7 @@ public function get_number_title() {
 	 * @return void
 	 */
 	public function number_title() {
-		echo $this->get_number_title();
+		echo esc_html( $this->get_number_title() );
 	}
 
 	/**
@@ -666,7 +666,7 @@ public function get_date_title() {
 	 * @return void
 	 */
 	public function date_title() {
-		echo $this->get_date_title();
+		echo esc_html( $this->get_date_title() );
 	}
 
 	/**
@@ -684,7 +684,7 @@ public function get_due_date_title() {
 	 * @return void
 	 */
 	public function due_date_title() {
-		echo $this->get_due_date_title();
+		echo esc_html( $this->get_due_date_title() );
 	}
 
 	/**
@@ -702,7 +702,7 @@ public function get_billing_address_title(): string {
 	 * @return void
 	 */
 	public function billing_address_title(): void {
-		echo $this->get_billing_address_title();
+		echo esc_html( $this->get_billing_address_title() );
 	}
 
 	/**
@@ -720,7 +720,7 @@ public function get_shipping_address_title(): string {
 	 * @return void
 	 */
 	public function shipping_address_title(): void {
-		echo $this->get_shipping_address_title();
+		echo esc_html( $this->get_shipping_address_title() );
 	}
 
 	/**
@@ -738,7 +738,7 @@ public function get_order_number_title(): string {
 	 * @return void
 	 */
 	public function order_number_title(): void {
-		echo $this->get_order_number_title();
+		echo esc_html( $this->get_order_number_title() );
 	}
 
 	/**
@@ -756,7 +756,7 @@ public function get_order_date_title(): string {
 	 * @return void
 	 */
 	public function order_date_title(): void {
-		echo $this->get_order_date_title();
+		echo esc_html( $this->get_order_date_title() );
 	}
 
 	/**
@@ -774,7 +774,7 @@ public function get_payment_method_title(): string {
 	 * @return void
 	 */
 	public function payment_method_title(): void {
-		echo $this->get_payment_method_title();
+		echo esc_html( $this->get_payment_method_title() );
 	}
 
 	/**
@@ -792,7 +792,7 @@ public function get_payment_date_title(): string {
 	 * @return void
 	 */
 	public function payment_date_title(): void {
-		echo $this->get_payment_date_title();
+		echo esc_html( $this->get_payment_date_title() );
 	}
 
 	/**
@@ -810,7 +810,7 @@ public function get_shipping_method_title(): string {
 	 * @return void
 	 */
 	public function shipping_method_title(): void {
-		echo $this->get_shipping_method_title();
+		echo esc_html( $this->get_shipping_method_title() );
 	}
 
 	/**
@@ -828,7 +828,7 @@ public function get_sku_title(): string {
 	 * @return void
 	 */
 	public function sku_title(): void {
-		echo $this->get_sku_title();
+		echo esc_html( $this->get_sku_title() );
 	}
 
 	/**
@@ -846,7 +846,7 @@ public function get_weight_title(): string {
 	 * @return void
 	 */
 	public function weight_title(): void {
-		echo $this->get_weight_title();
+		echo esc_html( $this->get_weight_title() );
 	}
 
 	/**
@@ -864,7 +864,7 @@ public function get_notes_title(): string {
 	 * @return void
 	 */
 	public function notes_title(): void {
-		echo $this->get_notes_title();
+		echo esc_html( $this->get_notes_title() );
 	}
 
 	/**
@@ -882,7 +882,7 @@ public function get_customer_notes_title(): string {
 	 * @return void
 	 */
 	public function customer_notes_title(): void {
-		echo $this->get_customer_notes_title();
+		echo esc_html( $this->get_customer_notes_title() );
 	}
 
 	/**
@@ -966,7 +966,46 @@ public function get_title_for( string $slug ): string {
 	 */
 	public function due_date(): void {
 		$due_date_timestamp = $this->get_due_date();
-		echo apply_filters( "wpo_wcpdf_{$this->slug}_formatted_due_date", date_i18n( wcpdf_date_format( $this, 'due_date' ), $due_date_timestamp ), $due_date_timestamp, $this );
+		$due_date           = apply_filters( "wpo_wcpdf_{$this->slug}_formatted_due_date", date_i18n( wcpdf_date_format( $this, 'due_date' ), $due_date_timestamp ), $due_date_timestamp, $this );
+		echo esc_html( $due_date );
+	}
+
+	/**
+	 * Get the language attributes for the document.
+	 *
+	 * @return string
+	 */
+	public function get_language_attributes(): string {
+		$language_attributes = apply_filters( 'wpo_wcpdf_document_language_attributes', get_language_attributes(), $this );
+		return apply_filters_deprecated( 'wpo_wcpdf_html_language_attributes', array( $language_attributes, $this->get_type(), $this ), '3.9.1', 'wpo_wcpdf_document_language_attributes' );
+	}
+
+	/**
+	 * Print the language attributes for the document.
+	 *
+	 * @return void
+	 */
+	public function language_attributes(): void {
+		echo esc_html( $this->get_language_attributes() );
+	}
+
+	/**
+	 * Get the body class for the document.
+	 *
+	 * @return string
+	 */
+	public function get_body_class(): string {
+		$body_class = apply_filters( 'wpo_wcpdf_document_body_class', $this->get_type(), $this );
+		return apply_filters_deprecated( 'wpo_wcpdf_body_class', array( $body_class, $this ), '3.9.1', 'wpo_wcpdf_document_body_class' );
+	}
+
+	/**
+	 * Print the body class for the document.
+	 *
+	 * @return void
+	 */
+	public function body_class(): void {
+		echo esc_html( $this->get_body_class() );
 	}
 
 	/*
@@ -1110,16 +1149,34 @@ public function get_number_settings() {
 	 * Output template styles
 	 */
 	public function template_styles() {
-		$css = apply_filters( 'wpo_wcpdf_template_styles_file', $this->locate_template_file( "style.css" ) );
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+		$css_file_path = apply_filters( 'wpo_wcpdf_template_styles_file', $this->locate_template_file( 'style.css' ) );
+		$css           = '';
 
-		ob_start();
-		if (file_exists($css)) {
-			include($css);
+		if ( $wp_filesystem->exists( $css_file_path ) ) {
+			ob_start();
+			include $css_file_path;
+			$css = ob_get_clean();
 		}
-		$css = ob_get_clean();
+
 		$css = apply_filters( 'wpo_wcpdf_template_styles', $css, $this );
 
-		echo $css;
+		echo esc_textarea( $css );
+	}
+
+	/**
+	 * Output custom template styles
+	 *
+	 * @return void
+	 */
+	public function template_custom_styles(): void {
+		ob_start();
+
+		do_action( 'wpo_wcpdf_custom_styles', $this->get_type(), $this );
+
+		$css = apply_filters( 'wpo_wcpdf_template_custom_styles', ob_get_clean(), $this );
+
+		echo esc_html( $css );
 	}
 
 	public function has_header_logo() {
@@ -1177,11 +1234,11 @@ public function header_logo(): void {
 				return;
 			}
 
-			$image_src   = isset( WPO_WCPDF()->settings->debug_settings['embed_images'] ) ? wpo_wcpdf_get_image_src_in_base64( $src ) : $src;
-			$img_element = sprintf( '<img src="%1$s" alt="%2$s"/>', esc_attr( $image_src ), esc_attr( $company ) );
-
-			echo apply_filters( 'wpo_wcpdf_header_logo_img_element', $img_element, $attachment_id, $this );
-
+			$img_src     = isset( WPO_WCPDF()->settings->debug_settings['embed_images'] ) ? wpo_wcpdf_get_image_src_in_base64( $src ) : $src;
+			$img_element = sprintf( '<img src="%1$s" alt="%2$s"/>', wpo_wcpdf_escape_url_path_or_base64( $img_src ), esc_attr( $company ) );
+			$img_element = apply_filters( 'wpo_wcpdf_header_logo_img_element', $img_element, $attachment_id, $this );
+			
+			echo $img_element; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		}
 	}
 
@@ -1226,7 +1283,7 @@ public function get_shop_name() {
 		return $this->get_settings_text( 'shop_name', $default, false );
 	}
 	public function shop_name() {
-		echo $this->get_shop_name();
+		echo esc_html( $this->get_shop_name() );
 	}
 
 	/**
@@ -1236,7 +1293,7 @@ public function get_shop_vat_number() {
 		return $this->get_settings_text( 'vat_number', '', false );
 	}
 	public function shop_vat_number() {
-		echo $this->get_shop_vat_number();
+		echo esc_html( $this->get_shop_vat_number() );
 	}
 
 	/**
@@ -1246,7 +1303,7 @@ public function get_shop_coc_number() {
 		return $this->get_settings_text( 'coc_number', '', false );
 	}
 	public function shop_coc_number() {
-		echo $this->get_shop_coc_number();
+		echo esc_html( $this->get_shop_coc_number() );
 	}
 
 	/**
@@ -1256,7 +1313,7 @@ public function get_shop_address() {
 		return $this->get_settings_text( 'shop_address' );
 	}
 	public function shop_address() {
-		echo $this->get_shop_address();
+		echo esc_html( $this->get_shop_address() );
 	}
 
 	/**
@@ -1275,12 +1332,12 @@ public function shop_phone_number() {
 	public function get_footer() {
 		ob_start();
 		do_action( 'wpo_wcpdf_before_footer', $this->get_type(), $this->order );
-		echo $this->get_settings_text( 'footer' );
+		echo $this->get_settings_text( 'footer' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		do_action( 'wpo_wcpdf_after_footer', $this->get_type(), $this->order );
 		return ob_get_clean();
 	}
 	public function footer() {
-		echo $this->get_footer();
+		echo wpo_wcpdf_sanitize_html_content( $this->get_footer() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 	}
 
 	/**
@@ -1291,7 +1348,7 @@ public function get_extra_1() {
 
 	}
 	public function extra_1() {
-		echo $this->get_extra_1();
+		echo wpo_wcpdf_sanitize_html_content( $this->get_extra_1() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 	}
 
 	/**
@@ -1301,7 +1358,7 @@ public function get_extra_2() {
 		return $this->get_settings_text( 'extra_2' );
 	}
 	public function extra_2() {
-		echo $this->get_extra_2();
+		echo wpo_wcpdf_sanitize_html_content( $this->get_extra_2() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 	}
 
 	/**
@@ -1311,7 +1368,7 @@ public function get_extra_3() {
 		return $this->get_settings_text( 'extra_3' );
 	}
 	public function extra_3() {
-		echo $this->get_extra_3();
+		echo wpo_wcpdf_sanitize_html_content( $this->get_extra_3() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 	}
 
 	/*
@@ -1325,9 +1382,12 @@ public function get_pdf() {
 		WPO_WCPDF()->main->maybe_reinstall_fonts();
 
 		$pdf = null;
+
 		if ( $pdf_file = apply_filters( 'wpo_wcpdf_load_pdf_file_path', null, $this ) ) {
-			$pdf = file_get_contents( $pdf_file );
+			$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+			$pdf = $wp_filesystem->get_contents( $pdf_file );
 		}
+
 		$pdf = apply_filters( 'wpo_wcpdf_pdf_data', $pdf, $this );
 		if ( !empty( $pdf ) ) {
 			return $pdf;
@@ -1413,12 +1473,12 @@ public function get_html( $args = array() ) {
 	public function output_pdf( $output_mode = 'download' ) {
 		$pdf = $this->get_pdf();
 		wcpdf_pdf_headers( $this->get_filename(), $output_mode, $pdf );
-		echo $pdf;
+		echo $pdf; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		exit();
 	}
 
 	public function output_html() {
-		echo $this->get_html();
+		echo $this->get_html(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 	}
 
 	public function preview_ubl() {
@@ -1455,10 +1515,15 @@ public function output_ubl( $contents_only = false ) {
 
 		wcpdf_ubl_headers( $quoted, $size );
 
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+
 		ob_clean();
 		flush();
-		@readfile( $full_filename );
-		@unlink( $full_filename );
+
+		if ( $wp_filesystem->exists( $full_filename ) ) {
+			echo $wp_filesystem->get_contents( $full_filename ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+			wp_delete_file( $full_filename );
+		}
 
 		exit();
 	}
@@ -1485,7 +1550,7 @@ public function get_filename( $context = 'download', $args = array() ) {
 		if ( $order_count == 1 ) {
 			$suffix = $number;
 		} else {
-			$suffix = date('Y-m-d'); // 2020-11-11
+			$suffix = gmdate('Y-m-d'); // 2020-11-11
 		}
 
 		// get filename
@@ -1548,7 +1613,9 @@ public function render_template( $file, $args = array() ) {
 	public function get_wc_emails() {
 		// only run this in the context of the settings page or setup wizard
 		// prevents WPML language mixups
-		if ( empty( $_GET['page'] ) || !in_array( $_GET['page'], array('wpo-wcpdf-setup','wpo_wcpdf_options_page') ) ) {
+		$request = stripslashes_deep( $_GET ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+
+		if ( empty( $request['page'] ) || ! in_array( $request['page'], array( 'wpo-wcpdf-setup', 'wpo_wcpdf_options_page' ) ) ) {
 			return array();
 		}
 
@@ -1729,9 +1796,9 @@ public function maybe_retire_number_store( $date, $store_base_name, $method ) {
 		$current_year_table_name = "{$default_table_name}_{$current_year}";
 
 		// first, remove last year if it already exists
-		$retired_exists = $wpdb->get_var( "SHOW TABLES LIKE '{$retired_table_name}'" ) == $retired_table_name;
-		if( $retired_exists ) {
-			$table_removed = $wpdb->query( "DROP TABLE IF EXISTS {$retired_table_name}" );
+		$retired_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $retired_table_name ) . "'" ) == $retired_table_name;
+		if ( $retired_exists ) {
+			$table_removed = $wpdb->query( "DROP TABLE IF EXISTS `" . esc_sql( $retired_table_name ) . "`" );
 
 			if( ! $table_removed ) {
 				wcpdf_log_error( sprintf( 'An error occurred while trying to remove the duplicate number store %s: %s', $retired_table_name, $wpdb->last_error ) );
@@ -1740,9 +1807,9 @@ public function maybe_retire_number_store( $date, $store_base_name, $method ) {
 		}
 
 		// rename current to last year
-		$default_exists = $wpdb->get_var( "SHOW TABLES LIKE '{$default_table_name}'" ) == $default_table_name;
-		if( $default_exists ) {
-			$table_renamed = $wpdb->query( "ALTER TABLE {$default_table_name} RENAME {$retired_table_name}" );
+		$default_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $default_table_name ) . "'" ) == $default_table_name;
+		if ( $default_exists ) {
+			$table_renamed = $wpdb->query( "ALTER TABLE `" . esc_sql( $default_table_name ) . "` RENAME `" . esc_sql( $retired_table_name ) . "`" );
 
 			if( ! $table_renamed ) {
 				wcpdf_log_error( sprintf( 'An error occurred while trying to rename the number store from %s to %s: %s', $default_table_name, $retired_table_name, $wpdb->last_error ) );
@@ -1751,9 +1818,9 @@ public function maybe_retire_number_store( $date, $store_base_name, $method ) {
 		}
 
 		// if the current year table name already exists (created earlier as a 'future' year), rename that to default
-		$current_year_exists = $wpdb->get_var( "SHOW TABLES LIKE '{$current_year_table_name}'" ) == $current_year_table_name;
-		if( $current_year_exists ) {
-			$table_renamed = $wpdb->query( "ALTER TABLE {$current_year_table_name} RENAME {$default_table_name}" );
+		$current_year_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $current_year_table_name ) . "'" ) == $current_year_table_name;
+		if ( $current_year_exists ) {
+			$table_renamed = $wpdb->query( "ALTER TABLE `" . esc_sql( $current_year_table_name ) . "` RENAME `" . esc_sql( $default_table_name ) . "`" );
 
 			if( ! $table_renamed ) {
 				wcpdf_log_error( sprintf( 'An error occurred while trying to rename the number store from %s to %s: %s', $current_year_table_name, $default_table_name, $wpdb->last_error ) );
@@ -1761,7 +1828,7 @@ public function maybe_retire_number_store( $date, $store_base_name, $method ) {
 			}
 		}
 
-		if( $was_showing_errors ) {
+		if ( $was_showing_errors ) {
 			$wpdb->show_errors();
 		}
 
@@ -1787,17 +1854,17 @@ public function get_number_store_year( $table_name ) {
 			$current_year = intval( $next_year->date_i18n( 'Y' ) );
 		}
 
-		$table_exists = $wpdb->get_var( "SHOW TABLES LIKE '{$table_name}'") == $table_name;
-		if( $table_exists ) {
+		$table_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $table_name ) . "'" ) == $table_name;
+		if ( $table_exists ) {
 			// get year for the last row
-			$year = $wpdb->get_var( "SELECT YEAR(date) FROM {$table_name} ORDER BY id DESC LIMIT 1" );
+			$year = $wpdb->get_var( "SELECT YEAR(date) FROM `" . esc_sql( $table_name ) . "` ORDER BY id DESC LIMIT 1" );
 			// default to current year if no results
-			if( ! $year ) {
+			if ( ! $year ) {
 				$year = $current_year;
 				// if we don't get a result, this could either mean there's an error,
 				// OR that the first number simply has not been created yet (=no rows)
 				// we only log when there's an actual error
-				if( ! empty( $wpdb->last_error ) ) {
+				if ( ! empty( $wpdb->last_error ) ) {
 					wcpdf_log_error( sprintf( 'An error occurred while trying to get the current year from the %s table: %s', $table_name, $wpdb->last_error ) );
 				}
 			}
@@ -1805,7 +1872,7 @@ public function get_number_store_year( $table_name ) {
 			$year = $current_year;
 		}
 
-		if( $was_showing_errors ) {
+		if ( $was_showing_errors ) {
 			$wpdb->show_errors();
 		}
 
diff --git a/includes/Documents/OrderDocumentMethods.php b/includes/Documents/OrderDocumentMethods.php
index eadc46888..5cefd398e 100644
--- a/includes/Documents/OrderDocumentMethods.php
+++ b/includes/Documents/OrderDocumentMethods.php
@@ -108,7 +108,7 @@ public function get_billing_address(): string {
 		return $address;
 	}
 	public function billing_address() {
-		echo $this->get_billing_address();
+		echo wp_kses_post( $this->get_billing_address() );
 	}
 
 	/**
@@ -139,7 +139,7 @@ public function get_billing_email() {
 		return apply_filters( 'wpo_wcpdf_billing_email', sanitize_email( $billing_email ), $this );
 	}
 	public function billing_email() {
-		echo $this->get_billing_email();
+		echo esc_html( $this->get_billing_email() );
 	}
 
 	/**
@@ -172,11 +172,11 @@ public function get_shipping_phone( $fallback_to_billing = false ) {
 	}
 
 	public function billing_phone() {
-		echo $this->get_billing_phone();
+		echo esc_html( $this->get_billing_phone() );
 	}
 
 	public function shipping_phone( $fallback_to_billing = false ) {
-		echo $this->get_shipping_phone( $fallback_to_billing );
+		echo esc_html( $this->get_shipping_phone( $fallback_to_billing ) );
 	}
 
 	/**
@@ -219,7 +219,7 @@ public function get_shipping_address(): string {
 		return $address;
 	}
 	public function shipping_address() {
-		echo $this->get_shipping_address();
+		echo wp_kses_post( $this->get_shipping_address() );
 	}
 
 	/**
@@ -246,7 +246,7 @@ public function get_custom_field( $field_name ) {
 		}
 
 		// WC3.0 fallback to properties
-		$property = str_replace( '-', '_', sanitize_title( ltrim( $field_name, '_' ) ) );
+		$property = ! empty( $field_name ) ? str_replace( '-', '_', sanitize_title( ltrim( $field_name, '_' ) ) ) : '';
 		if ( empty( $custom_field ) && is_callable( array( $this->order, "get_{$property}" ) ) ) {
 			$custom_field = $this->order->{"get_{$property}"}( 'view' );
 		}
@@ -276,21 +276,41 @@ public function custom_field( $field_name, $field_label = '', $display_empty = f
 
 		if ( ! empty( $custom_field ) || $display_empty ) {
 			$allow_tags = array(
-				'p'    => array(),
-				'span' => array(),
-				'ul'   => array(),
-				'ol'   => array(),
-				'li'   => array(),
+				'p'    => array(
+					'class' => array(),
+					'style' => array(),
+					'id'    => array(),
+				),
+				'span' => array(
+					'class' => array(),
+					'style' => array(),
+					'id'    => array(),
+				),
+				'ul'   => array(
+					'class' => array(),
+					'style' => array(),
+					'id'    => array(),
+				),
+				'ol'   => array(
+					'class' => array(),
+					'style' => array(),
+					'id'    => array(),
+				),
+				'li'   => array(
+					'class' => array(),
+					'style' => array(),
+					'id'    => array(),
+				),
 			);
 
 			if ( is_array( $custom_field ) ) {
 				$custom_field = array_map( function( $field ) use ( $allow_tags ) {
 					return wpo_wcpdf_sanitize_html_content( $field, 'custom_field', $allow_tags );
 				}, $custom_field );
-				echo $field_label . implode( '<br>', $custom_field );
+				echo wp_kses( $field_label . implode( '<br>', $custom_field ), $allow_tags );
 			} else {
 				$custom_field = wpo_wcpdf_sanitize_html_content( $custom_field, 'custom_field', $allow_tags );
-				echo $field_label . nl2br( $custom_field );
+				echo wp_kses( $field_label . nl2br( $custom_field ), $allow_tags );
 			}
 		}
 	}
@@ -388,7 +408,7 @@ public function get_product_attribute( $attribute_name, $product ) {
 		return isset($attribute) ? $attribute : false;
 	}
 	public function product_attribute( $attribute_name, $product ) {
-		echo $this->get_product_attribute( $attribute_name, $product );
+		echo esc_html( $this->get_product_attribute( $attribute_name, $product ) );
 	}
 
 	/**
@@ -450,7 +470,7 @@ public function order_notes( string $filter = 'customer', bool $include_system_n
 				$content     = apply_filters( 'wpo_wcpdf_order_note', $content, $note );
 				?>
 				<div class="<?php echo esc_attr( implode( ' ', $css_class ) ); ?>">
-					<?php echo wpo_wcpdf_sanitize_html_content( $content, 'notes' ); ?>
+					<?php echo wpo_wcpdf_sanitize_html_content( $content, 'notes' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
 				</div>
 				<?php
 			}
@@ -464,7 +484,7 @@ public function get_current_date() {
 		return apply_filters( 'wpo_wcpdf_date', date_i18n( wcpdf_date_format( $this, 'current_date' ) ) );
 	}
 	public function current_date() {
-		echo $this->get_current_date();
+		echo esc_html( $this->get_current_date() );
 	}
 
 	/**
@@ -483,7 +503,7 @@ public function get_payment_method() {
 		return apply_filters( 'wpo_wcpdf_payment_method', $payment_method, $this );
 	}
 	public function payment_method() {
-		echo $this->get_payment_method();
+		echo esc_html( $this->get_payment_method() );
 	}
 
 	/**
@@ -502,7 +522,7 @@ public function get_payment_date() {
 		return apply_filters( 'wpo_wcpdf_payment_date', $payment_date, $this );
 	}
 	public function payment_date() {
-		echo $this->get_payment_date();
+		echo esc_html( $this->get_payment_date() );
 	}
 
 	/**
@@ -513,7 +533,7 @@ public function get_shipping_method() {
 		return apply_filters( 'wpo_wcpdf_shipping_method', $shipping_method, $this );
 	}
 	public function shipping_method() {
-		echo $this->get_shipping_method();
+		echo esc_html( $this->get_shipping_method() );
 	}
 
 	/**
@@ -534,7 +554,7 @@ public function get_order_number() {
 		return apply_filters( 'wpo_wcpdf_order_number', $order_number, $this );
 	}
 	public function order_number() {
-		echo $this->get_order_number();
+		echo esc_html( $this->get_order_number() );
 	}
 
 	/**
@@ -553,7 +573,7 @@ public function get_order_date() {
 		return apply_filters( 'wpo_wcpdf_order_date', $date, $mysql_date, $this );
 	}
 	public function order_date() {
-		echo $this->get_order_date();
+		echo esc_html( $this->get_order_date() );
 	}
 
 	/**
@@ -572,6 +592,9 @@ public function get_order_items(): array {
 
 				// Set the item_id
 				$data['item_id'] = $item_id;
+				
+				// Set the item row class
+				$data['row_class'] = apply_filters( 'wpo_wcpdf_item_row_class', 'item-' . $item_id, $this->get_type(), $this->order, $item_id );
 
 				// Set the id
 				$data['product_id']   = $item['product_id'];
@@ -863,7 +886,7 @@ public function get_thumbnail ( $product ) {
 		}
 
 		$contextless_site_url  = ! empty( $site_url ) ? str_replace( array( 'http://', 'https://' ), '', $site_url ) : $site_url;
-		$thumbnail_path        = ! empty( $contextless_site_url ) ? str_replace( $contextless_site_url, trailingslashit( $forwardslash_basepath ), $contextless_thumbnail_url ) : $contextless_site_url;
+		$thumbnail_path        = ! empty( $contextless_thumbnail_url ) ? str_replace( $contextless_site_url, trailingslashit( $forwardslash_basepath ), $contextless_thumbnail_url ) : $contextless_site_url;
 
 		// fallback if thumbnail file doesn't exist
 		if (apply_filters('wpo_wcpdf_use_path', true) && !file_exists($thumbnail_path)) {
@@ -917,7 +940,7 @@ public function get_woocommerce_totals() {
 			$label = $total['label'];
 			$colon = strrpos( $label, ':' );
 
-			if ( false !== $colon ) {
+			if ( ! empty( $colon ) ) {
 				$label = substr_replace( $label, '', $colon, 1 );
 			}
 
@@ -947,7 +970,11 @@ public function get_woocommerce_totals() {
 						$tax_string_array[] = sprintf( '%s %s', wc_price( $this->order->get_total_tax(), array( 'currency' => $this->order->get_currency() ) ), WC()->countries->tax_or_vat() );
 					}
 					if ( ! empty( $tax_string_array ) ) {
-						$tax_string = ' ' . sprintf( __( '(includes %s)', 'woocommerce' ), implode( ', ', $tax_string_array ) );
+						$tax_string = ' ' . sprintf(
+							/* translators: %s: tax information */
+							__( '(includes %s)', 'woocommerce-pdf-invoices-packing-slips' ),
+							implode( ', ', $tax_string_array )
+						);
 					}
 				}
 
@@ -984,7 +1011,7 @@ public function get_order_subtotal( $tax = 'excl', $discount = 'incl' ) { // set
 	}
 	public function order_subtotal( $tax = 'excl', $discount = 'incl' ) {
 		$subtotal = $this->get_order_subtotal( $tax, $discount );
-		echo $subtotal['value'];
+		echo esc_html( $subtotal['value'] );
 	}
 
 	/**
@@ -1009,7 +1036,7 @@ public function get_order_shipping( $tax = 'excl' ) { // set $tax to 'incl' to i
 	}
 	public function order_shipping( $tax = 'excl' ) {
 		$shipping = $this->get_order_shipping( $tax );
-		echo $shipping['value'];
+		echo esc_html( $shipping['value'] );
 	}
 
 	/**
@@ -1043,7 +1070,7 @@ public function get_order_discount( $type = 'total', $tax = 'incl' ) {
 	}
 	public function order_discount( $type = 'total', $tax = 'incl' ) {
 		$discount = $this->get_order_discount( $type, $tax );
-		echo $discount['value'];
+		echo esc_html( $discount['value'] );
 	}
 
 	/**
@@ -1114,7 +1141,7 @@ public function get_order_grand_total( $tax = 'incl' ) {
 	}
 	public function order_grand_total( $tax = 'incl' ) {
 		$grand_total = $this->get_order_grand_total( $tax );
-		echo $grand_total['value'];
+		echo esc_html( $grand_total['value'] );
 	}
 
 
@@ -1151,7 +1178,7 @@ public function shipping_notes(): void {
 		$shipping_notes = $this->get_shipping_notes();
 
 		if ( ! empty( $shipping_notes ) ) {
-			echo wpo_wcpdf_sanitize_html_content( $shipping_notes, 'notes' );
+			echo wpo_wcpdf_sanitize_html_content( $shipping_notes, 'notes' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		}
 	}
 
@@ -1265,14 +1292,8 @@ public function get_document_notes(): string {
 	public function document_notes(): void {
 		$document_notes = $this->get_document_notes();
 
-		if ( empty( $document_notes ) ) {
-			return;
-		}
-
-		if ( $document_notes === strip_tags( $document_notes ) ) {
-			echo nl2br( $document_notes );
-		} else {
-			echo $document_notes;
+		if ( ! empty( $document_notes ) ) {
+			echo wpo_wcpdf_sanitize_html_content( $document_notes, 'notes' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		}
 	}
 
@@ -1307,7 +1328,7 @@ public function get_display_date_label( $date_string ) {
 		}
 
 	}
-	
+
 	/**
 	 * Get the invoice number title,
 	 * this allows other documents to use
@@ -1328,9 +1349,9 @@ public function get_invoice_number_title() {
 	 * @return void
 	 */
 	public function invoice_number_title() {
-		echo $this->get_invoice_number_title();
+		echo esc_html( $this->get_invoice_number_title() );
 	}
-	
+
 	/**
 	 * Get the title for the refund reason,
 	 * used by the Credit Note document.
@@ -1341,16 +1362,16 @@ public function invoice_number_title() {
 	public function get_refund_reason_title(): string {
 		return apply_filters( 'wpo_wcpdf_refund_reason_title', __( 'Reason for refund:', 'woocommerce-pdf-invoices-packing-slips' ), $this );
 	}
-	
+
 	/**
 	 * Display the title for the refund reason,
 	 * used by the Credit Note document.
 	 * (Later we can move this to the Pro extension.)
-	 * 
+	 *
 	 * @return void
 	 */
 	public function refund_reason_title(): void {
-		echo $this->get_refund_reason_title();
+		echo esc_html( $this->get_refund_reason_title() );
 	}
 
 }
diff --git a/includes/Documents/PackingSlip.php b/includes/Documents/PackingSlip.php
index 8cc6bd9d0..72f1adec9 100644
--- a/includes/Documents/PackingSlip.php
+++ b/includes/Documents/PackingSlip.php
@@ -179,7 +179,7 @@ public function init_settings() {
 			ob_start();
 			?>
 			<div class="notice notice-info inline">
-				<p><a href="https://wpovernight.com/downloads/woocommerce-pdf-invoices-packing-slips-professional/" target="_blank"><?php _e( 'Upgrade to our Professional extension to attach packing slips to any email!', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+				<p><a href="https://wpovernight.com/downloads/woocommerce-pdf-invoices-packing-slips-professional/" target="_blank"><?php esc_html_e( 'Upgrade to our Professional extension to attach packing slips to any email!', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
 			</div>
 			<?php
 			$html = ob_get_clean();
diff --git a/includes/Documents/SequentialNumberStore.php b/includes/Documents/SequentialNumberStore.php
index 4c214ee72..4f3e64a0a 100644
--- a/includes/Documents/SequentialNumberStore.php
+++ b/includes/Documents/SequentialNumberStore.php
@@ -59,9 +59,9 @@ public function init() {
 		} else {
 			// check calculated_number column if using 'calculate' method
 			if ( $this->method == 'calculate' ) {
-				$column_exists = $this->wpdb->get_var("SHOW COLUMNS FROM `{$this->table_name}` LIKE 'calculated_number'");
+				$column_exists = $this->wpdb->get_var( "SHOW COLUMNS FROM `" . esc_sql( $this->table_name ) . "` LIKE 'calculated_number'" );
 				if ( empty( $column_exists ) ) {
-					$this->wpdb->query("ALTER TABLE {$this->table_name} ADD calculated_number int (16)");
+					$this->wpdb->query( "ALTER TABLE `" . esc_sql( $this->table_name ) . "` ADD `calculated_number` INT(16)" );
 				}
 			}
 			return; // no further business
@@ -95,7 +95,7 @@ public function init() {
 	 */
 	public function increment( $order_id = 0, $date = null ) {
 		if ( empty( $date ) ) {
-			$date = get_date_from_gmt( date( 'Y-m-d H:i:s' ) );
+			$date = get_date_from_gmt( gmdate( 'Y-m-d H:i:s' ) );
 		}
 
 		do_action( 'wpo_wcpdf_before_sequential_number_increment', $this, $order_id, $date );
@@ -128,10 +128,11 @@ public function get_next() {
 				$this->wpdb->query( "SET SESSION information_schema_stats_expiry = 0" );
 			}
 			// get next auto_increment value
-			$table_status = $this->wpdb->get_row("SHOW TABLE STATUS LIKE '{$this->table_name}'");
+			$table_status = $this->wpdb->get_row( "SHOW TABLE STATUS LIKE '" . esc_sql( $this->table_name ) . "'" );
 			$next         = $table_status->Auto_increment;
 		} elseif ( $this->method == 'calculate' ) {
-			$last_row = $this->wpdb->get_row( "SELECT * FROM {$this->table_name} WHERE id = ( SELECT MAX(id) from {$this->table_name} )" );
+			$last_row = $this->wpdb->get_row( "SELECT * FROM `" . esc_sql( $this->table_name ) . "` WHERE id = ( SELECT MAX(id) FROM `" . esc_sql( $this->table_name ) . "` )" );
+
 			if ( empty( $last_row ) ) {
 				$next = 1;
 			} elseif ( ! empty( $last_row->calculated_number ) ) {
@@ -147,18 +148,21 @@ public function get_next() {
 	 * Set the number that will be used on the next increment
 	 */
 	public function set_next( $number = 1 ) {
+		$table_name = $this->table_name;
+		$wpdb       = $this->wpdb;
+		
 		// delete all rows
-		$delete = $this->wpdb->query("TRUNCATE TABLE {$this->table_name}");
+		$delete = $wpdb->query( "TRUNCATE TABLE `" . esc_sql( $table_name ) . "`" );
 
 		// set auto_increment
 		if ( $number > 1 ) {
 			// if AUTO_INCREMENT is not 1, we need to make sure we have a 'highest value' in case of server restarts
 			// https://serverfault.com/questions/228690/mysql-auto-increment-fields-resets-by-itself
 			$highest_number = (int) $number - 1;
-			$this->wpdb->query( $this->wpdb->prepare( "ALTER TABLE {$this->table_name} AUTO_INCREMENT=%d;", $highest_number ) );
+			$wpdb->query( $wpdb->prepare( "ALTER TABLE `" . esc_sql( $table_name ) . "` AUTO_INCREMENT=%d;", $highest_number ) );
 			$data = array(
 				'order_id' => 0,
-				'date'     => get_date_from_gmt( date( 'Y-m-d H:i:s' ) ),
+				'date'     => get_date_from_gmt( gmdate( 'Y-m-d H:i:s' ) ),
 			);
 
 			if ( $this->method == 'calculate' ) {
@@ -166,31 +170,26 @@ public function set_next( $number = 1 ) {
 			}
 
 			// after this insert, AUTO_INCREMENT will be equal to $number
-			$this->wpdb->insert( $this->table_name, $data );
+			$wpdb->insert( $table_name, $data );
 		} else {
 			// simple scenario, no need to insert any rows
-			$this->wpdb->query( $this->wpdb->prepare( "ALTER TABLE {$this->table_name} AUTO_INCREMENT=%d;", $number ) );
+			$wpdb->query( $wpdb->prepare( "ALTER TABLE `" . esc_sql( $table_name ) . "` AUTO_INCREMENT=%d;", $number ) );
 		}
 	}
 
 	public function get_last_date( $format = 'Y-m-d H:i:s' ) {
-		$row  = $this->wpdb->get_row( "SELECT * FROM {$this->table_name} WHERE id = ( SELECT MAX(id) from {$this->table_name} )" );
+		$row  = $this->wpdb->get_row( "SELECT * FROM `" . esc_sql( $this->table_name ) . "` WHERE id = ( SELECT MAX(id) FROM `" . esc_sql( $this->table_name ) . "` )" );
 		$date = isset( $row->date ) ? $row->date : 'now';
-		$formatted_date = date( $format, strtotime( $date ) );
-
-		return $formatted_date;
+		
+		return gmdate( $format, strtotime( $date ) );
 	}
 
 	/**
+	 * Check if the number store table exists
 	 * @return bool
 	 */
 	public function store_name_exists() {
-		// check if table exists
-		if ( $this->wpdb->get_var("SHOW TABLES LIKE '{$this->table_name}'") == $this->table_name ) {
-			return true;
-		} else {
-			return false;
-		}
+		return $this->wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $this->table_name ) . "'" ) === $this->table_name;
 	}
 
 }
diff --git a/includes/FontSynchronizer.php b/includes/FontSynchronizer.php
index b10e003d2..0fbfd0f76 100644
--- a/includes/FontSynchronizer.php
+++ b/includes/FontSynchronizer.php
@@ -48,10 +48,11 @@ public function __construct() {
 	 * @return void
 	 */
 	public function sync( $destination, $merge_with_local = true ) {
-		$destination = trailingslashit( wp_normalize_path( $destination ) );
-
-		$plugin_fonts = $this->get_plugin_fonts();
-		$dompdf_fonts = $this->get_dompdf_fonts();
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+		$destination   = trailingslashit( wp_normalize_path( $destination ) );
+		$plugin_fonts  = $this->get_plugin_fonts();
+		$dompdf_fonts  = $this->get_dompdf_fonts();
+		
 		if ( $merge_with_local ) {
 			$local_fonts = $this->get_local_fonts( $destination );
 		} else {
@@ -78,9 +79,9 @@ public function sync( $destination, $merge_with_local = true ) {
 		// normalize one last time
 		$local_fonts = $this->normalize_font_paths( $local_fonts );
 		// rebuild font cache file
-		$cacheData   = json_encode( $local_fonts, JSON_PRETTY_PRINT );
+		$cacheData   = wp_json_encode( $local_fonts, JSON_PRETTY_PRINT );
 		// write file with merged cache data
-		file_put_contents( $destination . $this->font_cache_filename, $cacheData );
+		$wp_filesystem->put_contents( $destination . $this->font_cache_filename, $cacheData, FS_CHMOD_FILE );
 	}
 
 	/**
@@ -100,7 +101,7 @@ public function delete_font_files( $filenames ) {
 			foreach ( $extensions as $extension ) {
 				$file = $filename . $extension;
 				if ( file_exists( $file ) ) {
-					@unlink( $file );
+					wp_delete_file( $file );
 				}
 			}
 		}
@@ -142,13 +143,14 @@ public function get_local_fonts( $path ) {
 		$rootDir           = $this->dompdf->getOptions()->getRootDir();
 		$cache_file        = trailingslashit( $path ) . $this->font_cache_filename;
 		$legacy_cache_file = trailingslashit( $path ) . 'dompdf_font_family_cache.php'; // Dompdf <2.0
+		$wp_filesystem     = wpo_wcpdf_get_wp_filesystem();
 
-		if ( is_readable( $cache_file ) ) {
-			$json_data = file_get_contents( $cache_file );
+		if ( $wp_filesystem->is_readable( $cache_file ) ) {
+			$json_data = $wp_filesystem->get_contents( $cache_file );
 			$font_data = json_decode( $json_data, true );
-		} elseif ( is_readable( $legacy_cache_file ) ) {
+		} elseif ( $wp_filesystem->is_readable( $legacy_cache_file ) ) {
 			$font_data = include $legacy_cache_file;
-			@unlink( $legacy_cache_file );
+			wp_delete_file( $legacy_cache_file );
 		} else {
 			$font_data = array();
 		}
diff --git a/includes/Frontend.php b/includes/Frontend.php
index a62d4c85e..4b30acc60 100644
--- a/includes/Frontend.php
+++ b/includes/Frontend.php
@@ -78,11 +78,14 @@ public function open_my_account_pdf_link_on_new_tab() {
 		if ( function_exists( 'is_account_page' ) && is_account_page() ) {
 			if ( $general_settings = get_option( 'wpo_wcpdf_settings_general' ) ) {
 				if ( isset( $general_settings['download_display'] ) && $general_settings['download_display'] == 'display' ) {
-					$suffix = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
-
-					if ( function_exists( 'file_get_contents' ) && $script = file_get_contents( WPO_WCPDF()->plugin_path() . '/assets/js/my-account-link'.$suffix.'.js' ) ) {
-
-						if ( WPO_WCPDF()->endpoint->pretty_links_enabled() ) {
+					$suffix        = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
+					$file_path     = WPO_WCPDF()->plugin_path() . '/assets/js/my-account-link' . $suffix . '.js';
+					$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+
+					if ( $wp_filesystem->exists( $file_path ) ) {
+						$script = $wp_filesystem->get_contents( $file_path );
+						
+						if ( $script && WPO_WCPDF()->endpoint->pretty_links_enabled() ) {
 							$script = str_replace( 'generate_wpo_wcpdf', WPO_WCPDF()->endpoint->get_identifier(), $script );
 						}
 
diff --git a/includes/Install.php b/includes/Install.php
index b63646a7f..98c088357 100644
--- a/includes/Install.php
+++ b/includes/Install.php
@@ -381,8 +381,8 @@ protected function upgrade( $installed_version ) {
 
 		// 2.11.2: remove the obsolete .dist font cache file and mustRead.html from local fonts folder
 		if ( version_compare( $installed_version, '2.11.2', '<' ) ) {
-			@unlink( trailingslashit( $font_path ) . 'dompdf_font_family_cache.dist.php' );
-			@unlink( trailingslashit( $font_path ) . 'mustRead.html' );
+			wp_delete_file( trailingslashit( $font_path ) . 'dompdf_font_family_cache.dist.php' );
+			wp_delete_file( trailingslashit( $font_path ) . 'mustRead.html' );
 		}
 
 		// 2.12.2-dev-1: change 'date' database table default value to '1000-01-01 00:00:00'
@@ -390,25 +390,32 @@ protected function upgrade( $installed_version ) {
 			global $wpdb;
 			$documents = WPO_WCPDF()->documents->get_documents( 'all' );
 			foreach ( $documents as $document ) {
-				$store_name = "{$document->slug}_number";
-				$method     = WPO_WCPDF()->settings->get_sequential_number_store_method();
-				$table_name = apply_filters( "wpo_wcpdf_number_store_table_name", "{$wpdb->prefix}wcpdf_{$store_name}", $store_name, $method );
-				if ( $wpdb->get_var( "SHOW TABLES LIKE '{$table_name}'" ) != $table_name ) {
+				$store_name        = "{$document->slug}_number";
+				$method            = WPO_WCPDF()->settings->get_sequential_number_store_method();
+				$table_name        = apply_filters( 'wpo_wcpdf_number_store_table_name', sanitize_key( "{$wpdb->prefix}wcpdf_{$store_name}" ), $store_name, $method );
+				$table_name_exists = $wpdb->get_var( $wpdb->prepare( "SHOW TABLES LIKE %s", esc_sql( $table_name ) ) ) === $table_name;
+
+				if ( ! $table_name_exists ) {
 					continue;
 				}
+
 				if ( is_callable( array( $document, 'get_sequential_number_store' ) ) ) {
 					$number_store = $document->get_sequential_number_store();
+
 					if ( ! empty( $number_store ) ) {
-						$column_name = 'date';
-						$query       = $wpdb->query( "ALTER TABLE {$number_store->table_name} ALTER {$column_name} SET DEFAULT '1000-01-01 00:00:00'" );
-						if ( $query ) {
+						$column_name      = 'date';
+						$table_name_safe  = sanitize_key( $number_store->table_name );
+						$column_name_safe = sanitize_key( $column_name );					
+						$query_result     = $wpdb->query( $wpdb->prepare( "ALTER TABLE `" . esc_sql( $table_name_safe ) . "` ALTER `" . esc_sql( $column_name_safe ) . "` SET DEFAULT %s", '1000-01-01 00:00:00' ) );
+
+						if ( $query_result ) {
 							wcpdf_log_error(
-								"Default value changed for 'date' column to '1000-01-01 00:00:00' on database table: {$number_store->table_name}",
+								"Default value changed for 'date' column to '1000-01-01 00:00:00' on database table: {$table_name_safe}",
 								'info'
 							);
 						} else {
 							wcpdf_log_error(
-								"An error occurred! The default value for 'date' column couldn't be changed to '1000-01-01 00:00:00' on database table: {$number_store->table_name}",
+								"An error occurred! The default value for 'date' column couldn't be changed to '1000-01-01 00:00:00' on database table: {$table_name_safe}",
 								'critical'
 							);
 						}
diff --git a/includes/Main.php b/includes/Main.php
index d2c56c3d5..c2a93a899 100644
--- a/includes/Main.php
+++ b/includes/Main.php
@@ -141,11 +141,11 @@ public function attach_document_to_email( $attachments, $email_id, $order, $emai
 		}
 
 		$attach_to_document_types = $this->get_documents_for_email( $email_id, $order );
-		$lock                     = new Semaphore( "attach_doc_to_email_{$email_id}_from_order_{$order_id}" );
+		$semaphore                = new Semaphore( "attach_doc_to_email_{$email_id}_from_order_{$order_id}" );
 
-		if ( $lock->lock() ) {
+		if ( $semaphore->lock() ) {
 
-			$lock->log( sprintf( 'Lock acquired for attach document to email for order ID# %s.', $order_id ), 'info' );
+			$semaphore->log( sprintf( 'Lock acquired for attach document to email for order ID# %s.', $order_id ), 'info' );
 
 			foreach ( $attach_to_document_types as $output_format => $document_types ) {
 				foreach ( $document_types as $document_type ) {
@@ -198,12 +198,12 @@ public function attach_document_to_email( $attachments, $email_id, $order, $emai
 				}
 			}
 
-			if ( $lock->release() ) {
-				$lock->log( sprintf( 'Lock released for attach document to email for order ID# %s.', $order_id ), 'info' );
+			if ( $semaphore->release() ) {
+				$semaphore->log( sprintf( 'Lock released for attach document to email for order ID# %s.', $order_id ), 'info' );
 			}
 
 		} else {
-			$lock->log( sprintf( 'Couldn\'t get the lock for attach document to email for order ID# %s.', $order_id ), 'critical' );
+			$semaphore->log( sprintf( 'Couldn\'t get the lock for attach document to email for order ID# %s.', $order_id ), 'critical' );
 		}
 
 		remove_filter( 'wcpdf_disable_deprecation_notices', '__return_true' );
@@ -212,42 +212,67 @@ public function attach_document_to_email( $attachments, $email_id, $order, $emai
 	}
 
 	public function get_document_pdf_attachment( $document, $tmp_path ) {
-		$filename  = $document->get_filename();
-		$pdf_path  = $tmp_path . $filename;
-		$lock_file = apply_filters( 'wpo_wcpdf_lock_attachment_file', true );
-
-		// if this file already exists in the temp path, we'll reuse it if it's not older than 60 seconds
-		$max_reuse_age = apply_filters( 'wpo_wcpdf_reuse_attachment_age', 60 );
-		if ( file_exists( $pdf_path ) && $max_reuse_age > 0 ) {
-			// get last modification date
-			if ( $filemtime = filemtime( $pdf_path ) ) {
-				$time_difference = time() - $filemtime;
-				if ( $time_difference < $max_reuse_age ) {
-					// check if file is still being written to
-					if ( $lock_file && $this->wait_for_file_lock( $pdf_path ) === false ) {
-						return $pdf_path;
-					} else {
-						// make sure this gets logged, but don't abort process
-						wcpdf_log_error( "Attachment file locked (reusing: {$pdf_path})", 'critical' );
-					}
+		$wp_filesystem    = wpo_wcpdf_get_wp_filesystem();
+		$filename         = $document->get_filename();
+		$pdf_path         = $tmp_path . $filename;
+		$document_type    = $document->get_type();
+		$order_id         = isset( $document->order ) ? $document->order->get_id() : 0;
+		$lock_file        = apply_filters( 'wpo_wcpdf_lock_attachment_file', true );
+		$reuse_attachment = apply_filters( 'wpo_wcpdf_reuse_document_attachment', true, $document );
+		$max_reuse_age    = apply_filters( 'wpo_wcpdf_reuse_attachment_age', 60 );
+		$lock_acquired    = false;
+	
+		try {
+			// Check if the file can be reused
+			if ( $wp_filesystem->exists( $pdf_path ) && $reuse_attachment && $max_reuse_age > 0 ) {
+				$filemtime = filemtime( $pdf_path );
+				if ( $filemtime && ( time() - $filemtime < $max_reuse_age ) ) {
+					return $pdf_path;
 				}
 			}
+	
+			// Get PDF data and set up the Semaphore
+			$pdf_data  = $document->get_pdf();
+			$semaphore = new Semaphore( "get_{$document_type}_document_pdf_attachment_for_order_{$order_id}", $max_reuse_age );
+	
+			// Attempt to acquire the lock if needed
+			if ( $lock_file ) {
+				$lock_acquired = $semaphore->lock();
+			}
+			
+			$write_file = ( $lock_file && $lock_acquired ) || ! $lock_file;
+			
+			// Write the file
+			if ( $write_file ) {
+				$file_written = $wp_filesystem->put_contents( $pdf_path, $pdf_data, FS_CHMOD_FILE );
+				$semaphore->log( "PDF attachment written to {$pdf_path}", 'info' );
+			} else {
+				$semaphore->log( "PDF attachment not written to {$pdf_path} because the lock was not acquired", 'info' );
+			}
+	
+			// Log if the lock was not acquired
+			if ( $lock_file && ! $lock_acquired ) {
+				$semaphore->log( "Couldn't get the lock for the PDF attachment", 'critical' );
+			}
+		} catch ( \Exception $e ) {
+			wcpdf_log_error( "Exception occurred: " . $e->getMessage(), 'critical' );
+			return false;
+		} finally {
+			// Release the lock if it was acquired
+			if ( $lock_acquired ) {
+				$semaphore->release();
+				$semaphore->log( 'Lock released for the PDF attachment.', 'info' );
+			}
 		}
-
-		// get pdf data & store
-		$pdf_data = $document->get_pdf();
-
-		if ( $lock_file ) {
-			file_put_contents ( $pdf_path, $pdf_data, LOCK_EX );
-		} else {
-			file_put_contents ( $pdf_path, $pdf_data );
-		}
-
-		// wait for file lock
-		if ( $lock_file && $this->wait_for_file_lock( $pdf_path ) === true ) {
-			wcpdf_log_error( "Attachment file locked ({$pdf_path})", 'critical' );
+	
+		// Check if the file was written successfully
+		if ( ! $file_written ) {
+			$message = "Couldn't write the PDF attachment to {$pdf_path}";
+			$semaphore->log( $message, 'critical' );
+			wcpdf_log_error( $message, 'critical' );
+			return false;
 		}
-
+	
 		return $pdf_path;
 	}
 
@@ -266,34 +291,6 @@ public function get_document_ubl_attachment( $document, $tmp_path ) {
 		return $full_filename;
 	}
 
-	public function file_is_locked( $fp ) {
-		if (!flock($fp, LOCK_EX|LOCK_NB, $wouldblock)) {
-			if ($wouldblock) {
-				return true; // file is locked
-			} else {
-				return true; // can't lock for whatever reason (could be locked in Windows + PHP5.3)
-			}
-		} else {
-			flock($fp,LOCK_UN); // release lock
-			return false; // not locked
-		}
-	}
-
-	public function wait_for_file_lock( $path ) {
-		$fp = fopen($path, 'r+');
-		if ( $locked = $this->file_is_locked( $fp ) ) {
-			// optional delay (ms) to double check if the write process is finished
-			$delay = intval( apply_filters( 'wpo_wcpdf_attachment_locked_file_delay', 250 ) );
-			if ( $delay > 0 ) {
-				usleep( $delay * 1000 );
-				$locked = $this->file_is_locked( $fp );
-			}
-		}
-		fclose($fp);
-
-		return $locked;
-	}
-
 	public function get_documents_for_email( $email_id, $order ) {
 		$documents        = WPO_WCPDF()->documents->get_documents( 'enabled', 'any' );
 		$attach_documents = array();
@@ -343,26 +340,29 @@ public function get_documents_for_email( $email_id, $order ) {
 	public function generate_document_ajax() {
 		$access_type  = WPO_WCPDF()->endpoint->get_document_link_access_type();
 		$redirect_url = WPO_WCPDF()->endpoint->get_document_denied_frontend_redirect_url();
+		$request      = stripslashes_deep( $_REQUEST );
 
 		// handle bulk actions access key (_wpnonce) and legacy access key (order_key)
-		if ( empty( $_REQUEST['access_key'] ) ) {
+		if ( empty( $request['access_key'] ) ) {
 			foreach ( array( '_wpnonce', 'order_key' ) as $legacy_key ) {
-				if ( ! empty( $_REQUEST[ $legacy_key ] ) ) {
-					$_REQUEST['access_key'] = sanitize_text_field( $_REQUEST[ $legacy_key ] );
+				if ( ! empty( $request[ $legacy_key ] ) ) {
+					$request['access_key'] = sanitize_text_field( $request[ $legacy_key ] );
 				}
 			}
 		}
 
-		$valid_nonce = ! empty( $_REQUEST['access_key'] ) && ! empty( $_REQUEST['action'] ) && wp_verify_nonce( $_REQUEST['access_key'], $_REQUEST['action'] );
+		$access_key  = isset( $request['access_key'] ) ? sanitize_text_field( $request['access_key'] ) : '';
+		$action      = isset( $request['action'] ) ? sanitize_text_field( $request['action'] ) : '';
+		$valid_nonce = ! empty( $access_key ) && ! empty( $action ) && wp_verify_nonce( $access_key, $action );
 
 		// check if we have the access key set
-		if ( empty( $_REQUEST['access_key'] ) ) {
+		if ( empty( $access_key ) ) {
 			$message = esc_attr__( 'You do not have sufficient permissions to access this page. Reason: empty access key', 'woocommerce-pdf-invoices-packing-slips' );
 			wcpdf_safe_redirect_or_die( $redirect_url, $message );
 		}
 
 		// check if we have the action
-		if ( empty( $_REQUEST['action'] ) ) {
+		if ( empty( $action) ) {
 			$message = esc_attr__( 'You do not have sufficient permissions to access this page. Reason: empty action', 'woocommerce-pdf-invoices-packing-slips' );
 			wcpdf_safe_redirect_or_die( $redirect_url, $message );
 		}
@@ -374,27 +374,27 @@ public function generate_document_ajax() {
 		}
 
 		// Check if all parameters are set
-		if ( empty( $_REQUEST['document_type'] ) && ! empty( $_REQUEST['template_type'] ) ) {
-			$_REQUEST['document_type'] = $_REQUEST['template_type'];
+		if ( empty( $request['document_type'] ) && ! empty( $request['template_type'] ) ) {
+			$request['document_type'] = sanitize_text_field( $request['template_type'] );
 		}
 
-		if ( empty( $_REQUEST['order_ids'] ) ) {
+		if ( empty( $request['order_ids'] ) ) {
 			$message = esc_attr__( "You haven't selected any orders", 'woocommerce-pdf-invoices-packing-slips' );
 			wcpdf_safe_redirect_or_die( null, $message );
 		}
 
-		if ( empty( $_REQUEST['document_type'] ) ) {
+		if ( empty( $request['document_type'] ) ) {
 			$message = esc_attr__( 'Some of the export parameters are missing.', 'woocommerce-pdf-invoices-packing-slips' );
 			wcpdf_safe_redirect_or_die( null, $message );
 		}
 
 		// debug enabled by URL
-		if ( isset( $_REQUEST['debug'] ) && ! ( is_user_logged_in() || isset( $_REQUEST['my-account'] ) ) ) {
+		if ( isset( $request['debug'] ) && ! ( is_user_logged_in() || isset( $request['my-account'] ) ) ) {
 			$this->enable_debug();
 		}
 
-		$document_type = sanitize_text_field( $_REQUEST['document_type'] );
-		$order_ids     = (array) array_map( 'absint', explode( 'x', $_REQUEST['order_ids'] ) );
+		$document_type = sanitize_text_field( $request['document_type'] );
+		$order_ids     = isset( $request['order_ids'] ) ? array_map( 'absint', explode( 'x', sanitize_text_field( $request['order_ids'] ) ) ) : array();
 		$order         = false;
 
 		// single order
@@ -451,7 +451,7 @@ public function generate_document_ajax() {
 				}
 
 				if ( ! $full_permission ) {
-					if ( ! isset( $_REQUEST['my-account'] ) && ! isset( $_REQUEST['shortcode'] ) ) {
+					if ( ! isset( $request['my-account'] ) && ! isset( $request['shortcode'] ) ) {
 						$allowed = false;
 						break;
 					}
@@ -465,7 +465,7 @@ public function generate_document_ajax() {
 				break;
 			case 'full':
 				// check if we have a valid access key only when it's not from bulk actions
-				if ( ! isset( $_REQUEST['bulk'] ) && $order && ! hash_equals( $order->get_order_key(), $_REQUEST['access_key'] ) ) {
+				if ( ! isset( $request['bulk'] ) && $order && ! hash_equals( $order->get_order_key(), $access_key ) ) {
 					$allowed = false;
 					break;
 				}
@@ -482,22 +482,22 @@ public function generate_document_ajax() {
 		// if we got here, we're safe to go!
 		try {
 			// log document creation to order notes
-			if ( count( $order_ids ) > 1 && isset( $_REQUEST['bulk'] ) ) {
-				add_action( 'wpo_wcpdf_init_document', function( $document ) {
+			if ( count( $order_ids ) > 1 && isset( $request['bulk'] ) ) {
+				add_action( 'wpo_wcpdf_init_document', function( $document ) use ( $request ) {
 					$this->log_document_creation_to_order_notes( $document, 'bulk' );
-					$this->log_document_creation_trigger_to_order_meta( $document, 'bulk' );
+					$this->log_document_creation_trigger_to_order_meta( $document, 'bulk', false, $request );
 					$this->mark_document_printed( $document, 'bulk' );
 				} );
-			} elseif ( isset( $_REQUEST['my-account'] ) ) {
-				add_action( 'wpo_wcpdf_init_document', function( $document ) {
+			} elseif ( isset( $request['my-account'] ) ) {
+				add_action( 'wpo_wcpdf_init_document', function( $document ) use ( $request ) {
 					$this->log_document_creation_to_order_notes( $document, 'my_account' );
-					$this->log_document_creation_trigger_to_order_meta( $document, 'my_account' );
+					$this->log_document_creation_trigger_to_order_meta( $document, 'my_account', false, $request );
 					$this->mark_document_printed( $document, 'my_account' );
 				} );
 			} else {
-				add_action( 'wpo_wcpdf_init_document', function( $document ) {
+				add_action( 'wpo_wcpdf_init_document', function( $document ) use ( $request ) {
 					$this->log_document_creation_to_order_notes( $document, 'single' );
-					$this->log_document_creation_trigger_to_order_meta( $document, 'single' );
+					$this->log_document_creation_trigger_to_order_meta( $document, 'single', false, $request );
 					$this->mark_document_printed( $document, 'single' );
 				} );
 			}
@@ -508,7 +508,7 @@ public function generate_document_ajax() {
 			if ( $document ) {
 				do_action( 'wpo_wcpdf_document_created_manually', $document, $order_ids ); // note that $order_ids is filtered and may not be the same as the order IDs used for the document (which can be fetched from the document object itself with $document->order_ids)
 
-				$output_format = WPO_WCPDF()->settings->get_output_format( $document );
+				$output_format = WPO_WCPDF()->settings->get_output_format( $document, $request );
 
 				switch ( $output_format ) {
 					case 'ubl':
@@ -571,7 +571,7 @@ private function load_template_functions() {
 	/**
 	 * Return tmp path for different plugin processes
 	 */
-	public function get_tmp_path ( $type = '' ) {
+	public function get_tmp_path( $type = '' ) {
 		$tmp_base = $this->get_tmp_base();
 
 		// don't continue if we don't have an upload dir
@@ -607,9 +607,11 @@ public function get_tmp_path ( $type = '' ) {
 				break;
 		}
 
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+
 		// double check for existence, in case tmp_base was installed, but subfolder not created
-		if ( ! is_dir( $tmp_path ) ) {
-			$dir = mkdir( $tmp_path );
+		if ( ! $wp_filesystem->is_dir( $tmp_path ) ) {
+			$dir = $wp_filesystem->mkdir( $tmp_path );
 
 			if ( ! $dir ) {
 				update_option( 'wpo_wcpdf_no_dir_error', $tmp_path );
@@ -738,7 +740,7 @@ public function maybe_reinstall_fonts( $force = false ) {
 				$exclude_files = array( 'index.php', '.htaccess' );
 				foreach ( $files as $file ) {
 					if ( is_file( $file ) && ! in_array( basename( $file ), $exclude_files ) ) {
-						unlink( $file );
+						wp_delete_file( $file );
 					}
 				}
 			} else {
@@ -756,11 +758,11 @@ public function maybe_reinstall_fonts( $force = false ) {
 	/**
 	 * Generate random string
 	 */
-	public function generate_random_string () {
-		if ( function_exists( 'random_bytes' ) ) { // PHP7+
-			$code = bin2hex(random_bytes(16));
+	public function generate_random_string() {
+		if ( function_exists( 'random_bytes' ) ) {
+			$code = bin2hex( random_bytes( 16 ) );
 		} else {
-			$code = md5(uniqid(rand(), true));
+			$code = md5( uniqid( wp_rand(), true ) );
 		}
 		// create option
 		update_option( 'wpo_wcpdf_random_string', $code );
@@ -781,18 +783,18 @@ public function get_random_string () {
 	/**
 	 * Install/create plugin tmp folders
 	 */
-	public function init_tmp () {
+	public function init_tmp() {
 		// generate random string if don't exist
 		if( ! $this->get_random_string() ) {
 			$this->generate_random_string();
 		}
 
-		// get tmp base
-		$tmp_base = $this->get_tmp_base();
+		$tmp_base      = $this->get_tmp_base(); // get tmp base
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
 
 		// create plugin base temp folder
-		if ( ! is_dir( $tmp_base ) ) {
-			$dir = mkdir( $tmp_base );
+		if ( ! $wp_filesystem->is_dir( $tmp_base ) ) {
+			$dir = $wp_filesystem->mkdir( $tmp_base );
 
 			// don't continue if we don't have an upload dir
 			if ( ! $dir ) {
@@ -809,8 +811,8 @@ public function init_tmp () {
 		// create subfolders & protect
 		foreach ( $this->subfolders as $subfolder ) {
 			$path = $tmp_base . $subfolder . '/';
-			if ( ! is_dir( $path ) ) {
-				$dir = mkdir( $path );
+			if ( ! $wp_filesystem->is_dir( $path ) ) {
+				$dir = $wp_filesystem->mkdir( $path );
 
 				// check if we have dir
 				if ( ! $dir ) {
@@ -830,8 +832,8 @@ public function init_tmp () {
 			}
 
 			// create .htaccess file and empty index.php to protect in case an open webfolder is used!
-			file_put_contents( $path . '.htaccess', 'deny from all' );
-			touch( $path . 'index.php' );
+			$wp_filesystem->put_contents( $path . '.htaccess', 'deny from all', FS_CHMOD_FILE );
+			$wp_filesystem->put_contents( $path . 'index.php', '', FS_CHMOD_FILE );
 		}
 	}
 
@@ -846,8 +848,16 @@ public function no_dir_notice() {
 					ob_start();
 					?>
 					<div class="error">
-					<?php /* translators: 1. plugin name, 2. directory path */ ?>
-						<p><?php printf( esc_html__( 'The %1$s directory %2$s couldn\'t be created or is not writable!', 'woocommerce-pdf-invoices-packing-slips' ), '<strong>PDF Invoices & Packing Slips for WooCommerce</strong>' ,'<code>' . $path . '</code>' ); ?></p>
+						<p>
+							<?php
+								printf(
+									/* translators: 1. plugin name, 2. directory path */
+									wp_kses_post( 'The %1$s directory %2$s couldn\'t be created or is not writable!', 'woocommerce-pdf-invoices-packing-slips' ),
+									'<strong>PDF Invoices & Packing Slips for WooCommerce</strong>',
+									'<code>' . wpo_wcpdf_escape_url_path_or_base64( $path ) . '</code>' // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+								);
+							?>
+						</p>
 						<p><?php esc_html_e( 'Please check your directories write permissions or contact your hosting service provider.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 						<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_no_dir_notice', 'true' ), 'hide_no_dir_notice_nonce' ) ); ?>"><?php esc_html_e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
 					</div>
@@ -857,7 +867,7 @@ public function no_dir_notice() {
 					// save option to hide notice
 					if ( isset( $_REQUEST['wpo_wcpdf_hide_no_dir_notice'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 						// validate nonce
-						if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'hide_no_dir_notice_nonce' ) ) {
+						if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'hide_no_dir_notice_nonce' ) ) {
 							wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_hide_no_dir_notice' );
 							wp_redirect( 'admin.php?page=wpo_wcpdf_options_page' );
 							exit;
@@ -884,8 +894,10 @@ public function copy_directory( $old_path, $new_path ) {
 			return;
 		}
 
-		if ( ! is_dir( $new_path ) ) {
-			$dir = mkdir( $new_path );
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+
+		if ( ! $wp_filesystem->is_dir( $new_path ) ) {
+			$dir = $wp_filesystem->mkdir( $new_path );
 
 			// check if we have dir
 			if ( ! $dir ) {
@@ -899,17 +911,6 @@ public function copy_directory( $old_path, $new_path ) {
 			return false;
 		}
 
-		global $wp_filesystem;
-
-		if ( ! function_exists( 'WP_Filesystem' ) ) {
-			require_once( ABSPATH . 'wp-admin/includes/file.php' );
-		}
-
-		if ( ! WP_Filesystem() ) {
-			wcpdf_log_error( "WP_Filesystem couldn't be initiated! Unable to copy directory contents.", 'critical' );
-			return;
-		}
-
 		// we have the directories, let's try to copy
 		try {
 			$result = copy_dir( $old_path, $new_path );
@@ -1141,7 +1142,8 @@ public function schedule_temporary_files_cleanup() {
 	 *
 	 * @return array  Output message
 	 */
-	public function temporary_files_cleanup( $delete_timestamp = 0 ) {
+	public function temporary_files_cleanup( int $delete_timestamp = 0 ): array {
+		$wp_filesystem    = wpo_wcpdf_get_wp_filesystem();
 		$delete_before    = ! empty( $delete_timestamp ) ? intval( $delete_timestamp ) : time();
 		$paths_to_cleanup = apply_filters( 'wpo_wcpdf_cleanup_tmp_paths', array(
 			$this->get_tmp_path( 'attachments' ),
@@ -1152,49 +1154,76 @@ public function temporary_files_cleanup( $delete_timestamp = 0 ) {
 			'.htaccess',
 			'log.htm',
 		) );
-		$folders_level    = apply_filters( 'wpo_wcpdf_cleanup_folders_level', 3 );
+		apply_filters_deprecated( 'wpo_wcpdf_cleanup_folders_level', array( 3 ), '3.9.1', '', 'This filter is no longer necessary.' );
 		$files            = array();
 		$success          = 0;
 		$error            = 0;
 		$output           = array();
-
+		
+		// Gather all files from the paths
 		foreach ( $paths_to_cleanup as $path ) {
-			if ( ! function_exists( 'list_files' ) ) {
-				include_once( ABSPATH.'wp-admin/includes/file.php' );
-			}
-			if ( $listed_files = list_files( $path, $folders_level ) ) {
-				$files = array_merge( $files, $listed_files );
-			}
-		}
-
-		if ( ! empty( $files ) ) {
-			foreach ( $files as $file ) {
-				$basename = wp_basename( $file );
-				if ( ! in_array( $basename, $excluded_files ) && file_exists( $file ) && ! is_dir( $file ) ) {
-					$file_timestamp = filemtime( $file );
-
-					// delete file
-					if ( $file_timestamp < $delete_before ) {
-						if ( unlink( $file ) ) {
-							$success++;
-						} else {
-							$error++;
+			if ( $wp_filesystem->is_dir( $path ) ) {
+				$listed_files = $wp_filesystem->dirlist( $path, true, true );
+				
+				if ( $listed_files ) {
+					foreach ( $listed_files as $fileinfo ) {
+						$file_path = trailingslashit( $path ) . $fileinfo['name'];
+						$basename  = wp_basename( $file_path );
+
+						// Exclude specific files before adding to list
+						if ( ! in_array( $basename, $excluded_files ) && $wp_filesystem->exists( $file_path ) && ! $wp_filesystem->is_dir( $file_path ) ) {
+							$files[] = $file_path;
 						}
 					}
 				}
 			}
+		}
+		
+		// No files to delete
+		if ( empty( $files ) ) {
+			$output['success'] = esc_html__( 'Nothing to delete!', 'woocommerce-pdf-invoices-packing-slips' );
+			return $output;
+		}
+		
+		// Process and delete files
+		foreach ( $files as $file ) {
+			$file_timestamp = $wp_filesystem->mtime( $file );
 
-			if ( $error > 0 ) {
-				/* translators: 1,2. file count  */
-				$message           = sprintf( esc_html__( 'Unable to delete %1$d files! (deleted %2$d)', 'woocommerce-pdf-invoices-packing-slips' ), $error, $success );
-				$output['error']   = $message;
-			} else {
-				/* translators: file count */
-				$message           = sprintf( esc_html__( 'Successfully deleted %d files!', 'woocommerce-pdf-invoices-packing-slips' ), $success );
-				$output['success'] = $message;
+			// Delete file if it's older than the specified timestamp
+			if ( $file_timestamp < $delete_before ) {
+				if ( $wp_filesystem->delete( $file ) ) {
+					$success++;
+				} else {
+					$error++;
+				}
 			}
+		}
+
+		if ( $error > 0 ) {
+			$message_error = sprintf(
+				/* translators: %1$d is the number of files that couldn't be deleted, %2$d is the number of successfully deleted files */
+				_n(
+					'Unable to delete %1$d file! (deleted %2$d)',
+					'Unable to delete %1$d files! (deleted %2$d)',
+					$error,
+					'woocommerce-pdf-invoices-packing-slips'
+				),
+				$error,
+				$success
+			);
+			$output['error'] = $message_error;
 		} else {
-			$output['success'] = esc_html__( 'Nothing to delete!', 'woocommerce-pdf-invoices-packing-slips' );
+			$message_success = sprintf(
+				/* translators: %d is the number of files successfully deleted */
+				_n(
+					'Successfully deleted %d file!',
+					'Successfully deleted %d files!',
+					$success,
+					'woocommerce-pdf-invoices-packing-slips'
+				),
+				$success
+			);
+			$output['success'] = $message_success;
 		}
 
 		return $output;
@@ -1223,7 +1252,7 @@ public function remove_order_personal_data( $order ) {
 		foreach ( $number_stores as $store_name ) {
 			$order_id = $order->get_id();
 			$table_name = apply_filters( "wpo_wcpdf_number_store_table_name", "{$wpdb->prefix}wcpdf_{$store_name}", $store_name, 'auto_increment' ); // i.e. wp_wcpdf_invoice_number
-			$wpdb->query( $wpdb->prepare( "UPDATE $table_name SET order_id = 0 WHERE order_id = %s", $order_id ) );
+			$wpdb->query( $wpdb->prepare( "UPDATE " . esc_sql( $table_name ) . " SET order_id = 0 WHERE order_id = %s", $order_id ) );
 		}
 	}
 
@@ -1391,11 +1420,11 @@ public function log_to_order_notes( $note, $document ) {
 				continue;
 			}
 			if ( is_callable( array( $order, 'add_order_note' ) ) ) { // order
-				$order->add_order_note( strip_tags( $note ) );
+				$order->add_order_note( wp_strip_all_tags( $note ) );
 			} elseif ( $document->is_refund( $order ) ) {            // refund order
 				$parent_order = $document->get_refund_parent( $order );
 				if ( ! empty( $parent_order ) && is_callable( array( $parent_order, 'add_order_note' ) ) ) {
-					$parent_order->add_order_note( strip_tags( $note ) );
+					$parent_order->add_order_note( wp_strip_all_tags( $note ) );
 				}
 			}
 		}
@@ -1404,20 +1433,21 @@ public function log_to_order_notes( $note, $document ) {
 	/**
 	 * Logs to the order meta
 	 *
-	 * @param object  $document
-	 * @param string  $trigger
-	 * @param boolean $force
+	 * @param object     $document
+	 * @param string     $trigger
+	 * @param boolean    $force
+	 * @param array|null $request
 	 * @return void
 	 */
-	public function log_document_creation_trigger_to_order_meta( $document, $trigger, $force = false ) {
+	public function log_document_creation_trigger_to_order_meta( $document, $trigger, $force = false, $request = null ) {
 		if ( $trigger == 'bulk' && property_exists( $document, 'order_ids' ) && ! empty( $document->order_ids ) ) { // bulk document
 			$order_ids = $document->order_ids;
-		} elseif ( ! is_null( $document->order ) && is_callable( [ $document->order, 'get_id' ] ) ) {
-			$order_ids = [ $document->order->get_id() ];
-		} elseif ( isset( $_REQUEST['order_id'] ) ) {
-			$order_ids = [ absint( $_REQUEST['order_id'] ) ];
+		} elseif ( ! is_null( $document->order ) && is_callable( array( $document->order, 'get_id' ) ) ) {
+			$order_ids = array( $document->order->get_id() );
+		} elseif ( isset( $request['order_id'] ) ) {
+			$order_ids = array( absint( $request['order_id'] ) );
 		} else {
-			$order_ids = [];
+			$order_ids = array();
 		}
 
 		if ( ! empty( $order_ids ) ) {
@@ -1557,8 +1587,13 @@ public function document_printed_ajax() {
 		}
 
 		if ( $error > 0 ) {
-			/* translators: 1. document type, 2. mark/unmark */
-			wp_die( sprintf( esc_html__( 'Document of type %1$s for the selected order could not be %2$s as printed.', 'woocommerce-pdf-invoices-packing-slips' ), esc_attr( $data['document_type'] ), $event_type ) );
+			wp_die(
+				sprintf(
+					/* translators: 1. document type, 2. mark/unmark */
+					esc_html__( 'Document of type %1$s for the selected order could not be marked as printed.', 'woocommerce-pdf-invoices-packing-slips' ),
+					esc_attr( $data['document_type'] )
+				)
+			);
 		}
 	}
 
@@ -1624,12 +1659,12 @@ public function get_document_printed_data( $document ) {
 	}
 
 	/**
-	 * Enable PHP error output for administrators.
+	 * Enable error logging for administrators.
 	 */
 	public function enable_debug() {
 		if ( \WPO_WCPDF()->settings->user_can_manage_settings() ) {
-			error_reporting( E_ALL );
-			ini_set( 'display_errors', 1 );
+			error_reporting( E_ALL );       // phpcs:ignore WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting
+			ini_set( 'display_errors', 1 ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged
 		}
 	}
 
@@ -1723,8 +1758,8 @@ function_exists( 'WPO_WCPDF_Templates' ) &&
 
 		if ( ! empty( $due_date ) ) {
 			echo '<tr class="due-date">
-				<th>', $due_date_title, '</th>
-				<td>', $due_date, '</td>
+				<th>', esc_html( $due_date_title ), '</th>
+				<td>', esc_html( $due_date ), '</td>
 			</tr>';
 		}
 	}
diff --git a/includes/Makers/UBLMaker.php b/includes/Makers/UBLMaker.php
index ced993853..c2e00163e 100644
--- a/includes/Makers/UBLMaker.php
+++ b/includes/Makers/UBLMaker.php
@@ -15,8 +15,9 @@ class UBLMaker {
 	protected $tmp_base;
 
 	public function write( $filename, $contents ) {
+		$wp_filesystem  = wpo_wcpdf_get_wp_filesystem();
 		$full_file_name = $this->get_file_path() . $filename;
-		$status         = file_put_contents( $full_file_name, $contents );
+		$status         = $wp_filesystem->put_contents( $full_file_name, $contents, FS_CHMOD_FILE );
 
 		if ( false === $status ) {
 			throw new FileWriteException( 'Error writing UBL file' );
diff --git a/includes/Semaphore.php b/includes/Semaphore.php
index 0fc2e5d04..7a0282e46 100644
--- a/includes/Semaphore.php
+++ b/includes/Semaphore.php
@@ -97,25 +97,25 @@ public function __construct( string $name, int $locked_for = 300, int $retries =
 	 */
 	private function ensure_database_initialised(): int {
 		global $wpdb;
-
-		$sql = $wpdb->prepare( "SELECT COUNT(*) FROM {$wpdb->options} WHERE option_name = %s", $this->option_name );
-
-		if ( 1 === (int) $wpdb->get_var( $sql ) ) {
+	
+		// Check if the lock option already exists
+		$existing_option = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$wpdb->options} WHERE option_name = %s", $this->option_name ) );
+	
+		if ( 1 === (int) $existing_option ) {
 			$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') already existed in the database', 'debug' );
 			return 1;
 		}
-
-		$sql = $wpdb->prepare( "INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES(%s, '0', 'no');", $this->option_name );
-
-		$rows_affected = $wpdb->query( $sql );
-
+	
+		// Insert the lock option with a default value of 0
+		$rows_affected = $wpdb->query( $wpdb->prepare( "INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, '0', 'no')", $this->option_name ) );
+	
 		if ( $rows_affected > 0 ) {
 			$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') was created in the database', 'debug' );
+			return 2;
 		} else {
-			$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') failed to be created in the database (could already exist)', 'notice' );
+			$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') failed to be created in the database', 'notice' );
+			return 0;
 		}
-
-		return ( $rows_affected > 0 ) ? 2 : 0;
 	}
 
 	/**
@@ -135,10 +135,9 @@ public function lock( int $retries = 0 ): bool {
 		$time_now      = time();
 		$retries       = $retries > 0 ? $retries : $this->retries;
 		$acquire_until = $time_now + $this->locked_for;
+		$query         = $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d", $acquire_until, $this->option_name, $time_now ) );
 
-		$sql = $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d", $acquire_until, $this->option_name, $time_now );
-
-		if ( 1 === $wpdb->query( $sql ) ) {
+		if ( 1 === $query ) {
 			$this->log( 'Lock (' . $this->option_name . ', ' . $wpdb->options . ') acquired', 'info' );
 			$this->acquired = true;
 			return true;
@@ -150,13 +149,17 @@ public function lock( int $retries = 0 ): bool {
 		}
 
 		do {
+			$query = $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d", $acquire_until, $this->option_name, $time_now ) );
+			
 			// Now that the row has been created, try again
-			if ( 1 === $wpdb->query( $sql ) ) {
+			if ( 1 === $query ) {
 				$this->log( 'Lock (' . $this->option_name . ', ' . $wpdb->options . ') acquired after initialising the database', 'info' );
 				$this->acquired = true;
 				return true;
 			}
+			
 			$retries--;
+			
 			if ( $retries >= 0 ) {
 				$this->log( 'Lock (' . $this->option_name . ', ' . $wpdb->options . ') not yet acquired; sleeping', 'debug' );
 				sleep( 1 );
@@ -185,11 +188,10 @@ public function release(): bool {
 		}
 
 		global $wpdb;
-		$sql = $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = '0' WHERE option_name = %s", $this->option_name );
-
+		
 		$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') released', 'info' );
 
-		$result = (int) $wpdb->query( $sql ) === 1;
+		$result = $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = '0' WHERE option_name = %s", $this->option_name ) ) === 1;
 
 		$this->acquired = false;
 
diff --git a/includes/Settings.php b/includes/Settings.php
index ed783d9e4..c922a14ab 100644
--- a/includes/Settings.php
+++ b/includes/Settings.php
@@ -74,7 +74,7 @@ public function __construct() {
 		add_action( "update_option_wpo_wcpdf_settings_debug", array( $this, 'debug_settings_updated' ), 10, 3 );
 		add_action( 'init', array( $this, 'maybe_delete_flush_rewrite_rules_transient' ) );
 		// migrate old template paths to template IDs before loading settings page
-		add_action( 'wpo_wcpdf_settings_output_general', array( $this, 'maybe_migrate_template_paths' ), 9, 1 );
+		add_action( 'wpo_wcpdf_settings_output_general', array( $this, 'maybe_migrate_template_paths' ), 9, 2 );
 
 		// AJAX preview
 		add_action( 'wp_ajax_wpo_wcpdf_preview', array( $this, 'ajax_preview' ) );
@@ -106,7 +106,7 @@ public function menu() {
 	 */
 	public function add_settings_link( $links ) {
 		$action_links = array(
-			'settings' => '<a href="admin.php?page=wpo_wcpdf_options_page">'. esc_html__( 'Settings', 'woocommerce' ) . '</a>',
+			'settings' => '<a href="admin.php?page=wpo_wcpdf_options_page">'. esc_html__( 'Settings', 'woocommerce-pdf-invoices-packing-slips' ) . '</a>',
 		);
 
 		return array_merge( $action_links, $links );
@@ -186,12 +186,11 @@ public function settings_page() {
 			'preview_states' => 1,
 		);
 
-		$settings_tabs  = $this->maybe_disable_preview_on_settings_tabs( $settings_tabs ); // disable preview on debug setting
-		$default_tab    = apply_filters( 'wpo_wcpdf_settings_tabs_default', ! empty( $settings_tabs['general'] ) ? 'general' : key( $settings_tabs ) );
-		$active_tab     = isset( $_GET[ 'tab' ] ) ? sanitize_text_field( $_GET[ 'tab' ] ) : $default_tab;
-		$active_section = isset( $_GET[ 'section' ] ) ? sanitize_text_field( $_GET[ 'section' ] ) : '';
+		$settings_tabs = $this->maybe_disable_preview_on_settings_tabs( $settings_tabs ); // disable preview on debug setting
+		$default_tab   = apply_filters( 'wpo_wcpdf_settings_tabs_default', ! empty( $settings_tabs['general'] ) ? 'general' : key( $settings_tabs ) );
+		$nonce         = wp_create_nonce( 'wp_wcpdf_settings_page_nonce' );
 
-		include( WPO_WCPDF()->plugin_path() . '/views/settings-page.php' );
+		include WPO_WCPDF()->plugin_path() . '/views/settings-page.php';
 	}
 
 	public function maybe_disable_preview_on_settings_tabs( $settings_tabs ) {
@@ -220,14 +219,14 @@ public function ajax_preview() {
 
 			// get document type
 			if ( ! empty( $_POST['document_type'] ) ) {
-				$document_type = sanitize_text_field( $_POST['document_type'] );
+				$document_type = sanitize_text_field( wp_unslash( $_POST['document_type'] ) );
 			} else {
 				$document_type = 'invoice';
 			}
 
 			// get order ID
 			if ( ! empty( $_POST['order_id'] ) ) {
-				$order_id = sanitize_text_field( $_POST['order_id'] );
+				$order_id = sanitize_text_field( wp_unslash( $_POST['order_id'] ) );
 
 				if ( $document_type == 'credit-note' ) {
 					// get last refund ID of the order if available
@@ -264,7 +263,7 @@ public function ajax_preview() {
 				// process settings data
 				if ( ! empty( $_POST['data'] ) ) {
 					// parse form data
-					parse_str( $_POST['data'], $form_data );
+					parse_str( $_POST['data'], $form_data ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 					$form_data = stripslashes_deep( $form_data );
 
 					foreach ( $form_data as $option_key => $form_settings ) {
@@ -310,7 +309,7 @@ public function ajax_preview() {
 					}
 
 					// preview
-					$output_format = ( ! empty( $_REQUEST['output_format'] ) && $_REQUEST['output_format'] != 'pdf' && in_array( $_REQUEST['output_format'], $document->output_formats ) ) ? esc_attr( $_REQUEST['output_format'] ) : 'pdf';
+					$output_format = ( ! empty( $_REQUEST['output_format'] ) && $_REQUEST['output_format'] != 'pdf' && in_array( $_REQUEST['output_format'], $document->output_formats ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['output_format'] ) ) : 'pdf';
 					switch ( $output_format ) {
 						default:
 						case 'pdf':
@@ -367,8 +366,8 @@ public function preview_order_search() {
 			}
 
 			if ( ! empty( $_POST['search'] ) && ! empty( $_POST['document_type'] ) ) {
-				$search        = sanitize_text_field( $_POST['search'] );
-				$document_type = sanitize_text_field( $_POST['document_type'] );
+				$search        = sanitize_text_field( wp_unslash( $_POST['search'] ) );
+				$document_type = sanitize_text_field( wp_unslash( $_POST['document_type'] ) );
 				$results       = array();
 
 				// we have an order ID
@@ -522,15 +521,15 @@ public function get_document_settings( $document_type, $output_format = 'pdf' )
 		}
 	}
 
-	public function get_output_format( $document = null ) {
+	public function get_output_format( $document = null, $request = null ) {
 		$output_format = 'pdf'; // default
 
-		if ( isset( $this->debug_settings['html_output'] ) || ( isset( $_REQUEST['output'] ) && 'html' === $_REQUEST['output'] ) ) {
+		if ( isset( $this->debug_settings['html_output'] ) || ( isset( $request['output'] ) && 'html' === $request['output'] ) ) {
 			$output_format = 'html';
-		} elseif ( isset( $_REQUEST['output'] ) && ! empty( $_REQUEST['output'] ) && ! empty( $document ) && in_array( $_REQUEST['output'], $document->output_formats ) ) {
-			$document_settings = $this->get_document_settings( $document->get_type(), esc_attr( $_REQUEST['output'] ) );
+		} elseif ( isset( $request['output'] ) && ! empty( $request['output'] ) && ! empty( $document ) && in_array( $request['output'], $document->output_formats ) ) {
+			$document_settings = $this->get_document_settings( $document->get_type(), esc_attr( $request['output'] ) );
 			if ( isset( $document_settings['enabled'] ) ) {
-				$output_format = esc_attr( $_REQUEST['output'] );
+				$output_format = esc_attr( $request['output'] );
 			}
 		}
 
@@ -705,15 +704,24 @@ public function maybe_delete_flush_rewrite_rules_transient() {
 	}
 
 	public function get_relative_template_path( $absolute_path ) {
+		if ( empty( $absolute_path ) ) {
+			return '';
+		}
+		
 		if ( defined( 'WP_CONTENT_DIR' ) && ! empty( WP_CONTENT_DIR ) && false !== strpos( WP_CONTENT_DIR, ABSPATH ) ) {
 			$base_path = wp_normalize_path( ABSPATH );
 		} else {
 			$base_path = wp_normalize_path( WP_CONTENT_DIR );
 		}
+		
 		return str_replace( $base_path, '', wp_normalize_path( $absolute_path ) );
 	}
 
-	public function maybe_migrate_template_paths( $settings_section = null ) {
+	public function maybe_migrate_template_paths( $settings_section = null, $nonce = null ) {
+		if ( ! wp_verify_nonce( $nonce, 'wp_wcpdf_settings_page_nonce' ) ) {
+			return;
+		}
+		
 		// bail if no template is selected yet (fresh install)
 		if ( empty( $this->general_settings['template_path'] ) ) {
 			return;
@@ -753,7 +761,10 @@ public function maybe_migrate_template_paths( $settings_section = null ) {
 	}
 
 	public function set_number_store() {
-		check_ajax_referer( "wpo_wcpdf_next_{$_POST['store']}", 'security' );
+		$store = ! empty( $_POST['store'] ) ? sanitize_text_field( wp_unslash( $_POST['store'] ) ) : '';
+		
+		check_ajax_referer( "wpo_wcpdf_next_{$store}", 'security' );
+		
 		// check permissions
 		if ( ! $this->user_can_manage_settings() ) {
 			die();
@@ -762,9 +773,9 @@ public function set_number_store() {
 		$number = ! empty( $_POST['number'] ) ? (int) $_POST['number'] : 0;
 		if ( $number > 0 ) {
 			$number_store_method = $this->get_sequential_number_store_method();
-			$number_store = new SequentialNumberStore( $_POST['store'], $number_store_method );
+			$number_store = new SequentialNumberStore( $store, $number_store_method );
 			$number_store->set_next( $number );
-			echo wp_kses_post( "next number ({$_POST['store']}) set to {$number}" );
+			echo wp_kses_post( "next number ({$store}) set to {$number}" );
 		}
 		die();
 	}
@@ -794,7 +805,7 @@ public function schedule_yearly_reset_numbers() {
 
 		$next_year = strval( intval( current_time( 'Y' ) ) + 1 );
 		$datetime  = new \WC_DateTime( "{$next_year}-01-01 00:00:01", new \DateTimeZone( wc_timezone_string() ) );
-		$lock      = new Semaphore( 'schedule_yearly_reset_numbers' );
+		$semaphore = new Semaphore( 'schedule_yearly_reset_numbers' );
 		$hook      = 'wpo_wcpdf_schedule_yearly_reset_numbers';
 
 		// checks if there are pending actions
@@ -806,9 +817,9 @@ public function schedule_yearly_reset_numbers() {
 		// if no concurrent actions sets the action
 		if ( $scheduled_actions < 1 ) {
 
-			if ( $lock->lock() ) {
+			if ( $semaphore->lock() ) {
 
-				$lock->log( 'Lock acquired for yearly reset numbers schedule.', 'info' );
+				$semaphore->log( 'Lock acquired for yearly reset numbers schedule.', 'info' );
 
 				try {
 					$action_id = as_schedule_single_action( $datetime->getTimestamp(), $hook );
@@ -824,17 +835,17 @@ public function schedule_yearly_reset_numbers() {
 						);
 					}
 				} catch ( \Exception $e ) {
-					$lock->log( $e, 'critical' );
+					$semaphore->log( $e, 'critical' );
 				} catch ( \Error $e ) {
-					$lock->log( $e, 'critical' );
+					$semaphore->log( $e, 'critical' );
 				}
 
-				if ( $lock->release() ) {
-					$lock->log( 'Lock released for yearly reset numbers schedule.', 'info' );
+				if ( $semaphore->release() ) {
+					$semaphore->log( 'Lock released for yearly reset numbers schedule.', 'info' );
 				}
 
 			} else {
-				$lock->log( 'Couldn\'t get the lock for yearly reset numbers schedule.', 'critical' );
+				$semaphore->log( 'Couldn\'t get the lock for yearly reset numbers schedule.', 'critical' );
 			}
 
 		} else {
@@ -853,11 +864,11 @@ public function schedule_yearly_reset_numbers() {
 	}
 
 	public function yearly_reset_numbers() {
-		$lock = new Semaphore( 'yearly_reset_numbers' );
+		$semaphore = new Semaphore( 'yearly_reset_numbers' );
 
-		if ( $lock->lock() ) {
+		if ( $semaphore->lock() ) {
 
-			$lock->log( 'Lock acquired for yearly reset numbers.', 'info' );
+			$semaphore->log( 'Lock acquired for yearly reset numbers.', 'info' );
 
 			try {
 				// reset numbers
@@ -886,17 +897,17 @@ public function yearly_reset_numbers() {
 					}
 				}
 			} catch ( \Exception $e ) {
-				$lock->log( $e, 'critical' );
+				$semaphore->log( $e, 'critical' );
 			} catch ( \Error $e ) {
-				$lock->log( $e, 'critical' );
+				$semaphore->log( $e, 'critical' );
 			}
 
-			if ( $lock->release() ) {
-				$lock->log( 'Lock release for yearly reset numbers.', 'info' );
+			if ( $semaphore->release() ) {
+				$semaphore->log( 'Lock release for yearly reset numbers.', 'info' );
 			}
 
 		} else {
-			$lock->log( 'Couldn\'t get the lock for yearly reset numbers.', 'critical' );
+			$semaphore->log( 'Couldn\'t get the lock for yearly reset numbers.', 'critical' );
 		}
 
 		// reschedule the action for the next year
@@ -947,14 +958,17 @@ public function yearly_reset_action_is_scheduled() {
 
 	public function get_media_upload_setting_html() {
 		check_ajax_referer( 'wpo_wcpdf_get_media_upload_setting_html', 'security' );
+		
+		$request = stripslashes_deep( $_POST );
+		
 		// check permissions
 		if ( ! $this->user_can_manage_settings() ) {
 			wp_send_json_error();
 		}
 
 		// get previous (default) args and preset current
-		$args = $_POST['args'];
-		$args['current'] = absint( $_POST['attachment_id'] );
+		$args            = isset( $request['args'] ) ? $request['args'] : array();
+		$args['current'] = isset( $request['attachment_id'] ) ? absint( $request['attachment_id'] ) : 0;
 
 		if ( isset( $args['translatable'] ) ) {
 			$args['translatable'] = wc_string_to_bool( $args['translatable'] );
diff --git a/includes/Settings/SettingsCallbacks.php b/includes/Settings/SettingsCallbacks.php
index 92fa2f714..c582ed256 100644
--- a/includes/Settings/SettingsCallbacks.php
+++ b/includes/Settings/SettingsCallbacks.php
@@ -78,7 +78,7 @@ public function checkbox( $args ) {
 
 		// print store empty input if true
 		if( $store_unchecked ) {
-			printf( '<input type="hidden" name="%s[wpo_wcpdf_setting_store_empty][]" value="%s"/>', $option_name, esc_attr( $id ) );
+			printf( '<input type="hidden" name="%s[wpo_wcpdf_setting_store_empty][]" value="%s"/>', esc_attr( $option_name ), esc_attr( $id ) );
 		}
 
 		// output description.
@@ -108,7 +108,7 @@ public function text_input( $args ) {
 		}
 
 		$size = ! empty( $size ) ? sprintf( 'size="%s"', esc_attr( $size ) ) : '';
-		printf( '<input type="%1$s" id="%2$s" name="%3$s" value="%4$s" %5$s placeholder="%6$s" %7$s/>', esc_attr( $type ), esc_attr( $id ), esc_attr( $setting_name ), esc_attr( $current ), $size, esc_attr( $placeholder ), ! empty( $disabled ) ? 'disabled="disabled"' : '' );
+		printf( '<input type="%1$s" id="%2$s" name="%3$s" value="%4$s" %5$s placeholder="%6$s" %7$s/>', esc_attr( $type ), esc_attr( $id ), esc_attr( $setting_name ), esc_attr( $current ), esc_attr( $size ), esc_attr( $placeholder ), ! empty( $disabled ) ? 'disabled="disabled"' : '' );
 
 		// output description.
 		if ( ! empty( $description ) ) {
@@ -137,7 +137,7 @@ public function url_input( $args ) {
 		}
 
 		$size = ! empty( $size ) ? sprintf( 'size="%s"', esc_attr( $size ) ) : '';
-		printf( '<input type="%1$s" id="%2$s" name="%3$s" value="%4$s" %5$s placeholder="%6$s" %7$s/>', esc_attr( $type ), esc_attr( $id ), esc_attr( $setting_name ), sanitize_url( $current ), $size, esc_attr( $placeholder ), ! empty( $disabled ) ? 'disabled="disabled"' : '' );
+		printf( '<input type="%1$s" id="%2$s" name="%3$s" value="%4$s" %5$s placeholder="%6$s" %7$s/>', esc_attr( $type ), esc_attr( $id ), esc_attr( $setting_name ), esc_attr( $current ), esc_attr( $size ), esc_attr( $placeholder ), ! empty( $disabled ) ? 'disabled="disabled"' : '' );
 
 		// output description.
 		if ( ! empty( $description ) ) {
@@ -198,22 +198,36 @@ public function checkbox_text_input( $args ) {
 
 		// get text input for insertion in wrapper
 		$input_args = array(
-			'id'			=> $args['text_input_id'],
-			'default'		=> isset( $args['text_input_default'] ) ? (string) $args['text_input_default'] : NULL,
-			'size'			=> isset( $args['text_input_size'] ) ? $args['text_input_size'] : NULL,
-		)  + $args;
+			'id'      => $args['text_input_id'],
+			'default' => isset( $args['text_input_default'] ) ? (string) $args['text_input_default'] : null,
+			'size'    => isset( $args['text_input_size'] ) ? $args['text_input_size'] : null,
+		) + $args;
 		unset( $input_args['current'] );
 		unset( $input_args['setting_name'] );
 
 		ob_start();
 		$this->text_input( $input_args );
 		$text_input = ob_get_clean();
+		
+		$allowed_html = array(
+			'input' => array(
+				'type'        => true,
+				'name'        => true,
+				'id'          => true,
+				'value'       => true,
+				'class'       => true,
+				'placeholder' => true,
+				'disabled'    => true,
+				'checked'     => true,
+				'size'        => true,
+			),
+		);
 
-		if (! empty( $text_input_wrap ) ) {
-			printf( "{$checkbox} {$text_input_wrap}", $text_input);
-		} else {
-			echo "{$checkbox} {$text_input}";
+		if ( ! empty( $text_input_wrap ) ) {
+			$text_input = sprintf( $text_input_wrap, $text_input );
 		}
+		
+		echo wp_kses( "{$checkbox} {$text_input}", $allowed_html );
 
 		// output description.
 		if ( ! empty( $description ) ) {
@@ -325,7 +339,7 @@ public function select( $args ) {
 			jQuery(document).ready(function($) {
 				function check_<?php echo esc_attr( $id ); ?>_custom() {
 					var custom = $('#<?php echo esc_attr( $id ); ?>').val();
-					if (custom == '<?php echo $custom_option; ?>') {
+					if ( custom == '<?php echo esc_attr( $custom_option ); ?>' ) {
 						$( '.<?php echo esc_attr( $id ); ?>_custom').show();
 					} else {
 						$( '.<?php echo esc_attr( $id ); ?>_custom').hide();
@@ -407,7 +421,7 @@ public function multiple_text_input( $args ) {
 
 			// field description.
 			if ( ! empty( $field_description ) ) {
-				echo '<td>' . wc_help_tip( $field_description, true ) . '</td>';
+				echo '<td>' . wp_kses_post( wc_help_tip( $field_description, true ) ) . '</td>';
 			} else {
 				echo '<td></td>';
 			}
@@ -494,7 +508,7 @@ public function media_upload( $args ) {
 				printf(
 					'<div class="attachment-resolution"><p class="description">%s: %sdpi</p></div>',
 					esc_html__( 'Image resolution', 'woocommerce-pdf-invoices-packing-slips' ),
-					$attachment_resolution
+					esc_html( $attachment_resolution )
 				);
 
 				// warn the user if the image is unnecessarily large
@@ -509,7 +523,7 @@ public function media_upload( $args ) {
 			printf('<span class="button wpo_remove_image_button" data-input_id="%1$s">%2$s</span> ', esc_attr( $id ), esc_attr( $remove_button_text ) );
 		}
 
-		printf( '<input id="%1$s" name="%2$s" type="hidden" value="%3$s" data-settings_callback_args="%4$s" data-ajax_nonce="%5$s" class="media-upload-id"/>', esc_attr( $id ), esc_attr( $setting_name ), esc_attr( $current ), esc_attr( json_encode( $args ) ), wp_create_nonce( "wpo_wcpdf_get_media_upload_setting_html" ) );
+		printf( '<input id="%1$s" name="%2$s" type="hidden" value="%3$s" data-settings_callback_args="%4$s" data-ajax_nonce="%5$s" class="media-upload-id"/>', esc_attr( $id ), esc_attr( $setting_name ), esc_attr( $current ), esc_attr( wp_json_encode( $args ) ), esc_attr( wp_create_nonce( 'wpo_wcpdf_get_media_upload_setting_html' ) ) );
 
 		printf( '<span class="button wpo_upload_image_button %4$s" data-uploader_title="%1$s" data-uploader_button_text="%2$s" data-remove_button_text="%3$s" data-input_id="%4$s">%2$s</span>', esc_attr( $uploader_title ), esc_attr( $uploader_button_text ), esc_attr( $remove_button_text ), esc_attr( $id ) );
 
diff --git a/includes/Settings/SettingsDebug.php b/includes/Settings/SettingsDebug.php
index 6d286f030..54694b552 100644
--- a/includes/Settings/SettingsDebug.php
+++ b/includes/Settings/SettingsDebug.php
@@ -25,13 +25,17 @@ public function __construct() {
 		// Show a notice if the plugin requirements are not met.
 		add_action( 'admin_init', array( $this, 'handle_server_requirement_notice' ) );
 		add_action( 'admin_init', array( $this, 'init_settings' ) );
-		add_action( 'wpo_wcpdf_settings_output_debug', array( $this, 'output' ), 10, 1 );
+		add_action( 'wpo_wcpdf_settings_output_debug', array( $this, 'output' ), 10, 2 );
 
 		add_action( 'wp_ajax_wpo_wcpdf_debug_tools', array( $this, 'ajax_process_settings_debug_tools' ) );
 		add_action( 'wp_ajax_wpo_wcpdf_danger_zone_tools', array( $this, 'ajax_process_danger_zone_tools' ) );
 	}
 
-	public function output( $active_section ) {
+	public function output( $active_section, $nonce ) {
+		if ( ! wp_verify_nonce( $nonce, 'wp_wcpdf_settings_page_nonce' ) ) {
+			return;
+		}
+
 		$active_section = ! empty( $active_section ) ? $active_section : 'settings';
 		$sections       = $this->get_settings_sections();
 
@@ -41,7 +45,7 @@ public function output( $active_section ) {
 				<?php
 					foreach ( $sections as $section => $title ) {
 						$active = ( $section === $active_section ) ? 'nav-tab-active' : '';
-						printf( '<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>', esc_url( add_query_arg( 'section', $section ) ), esc_attr( $section ), $active, esc_html( $title ) );
+						printf( '<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>', esc_url( add_query_arg( 'section', $section ) ), esc_attr( $section ), esc_attr( $active ), esc_html( $title ) );
 					}
 				?>
 			</h2>
@@ -59,7 +63,7 @@ public function output( $active_section ) {
 				$this->display_tools();
 				break;
 			case 'numbers':
-				$this->display_numbers();
+				$this->display_numbers( $nonce );
 				break;
 			default:
 				do_action( 'wpo_wcpdf_settings_debug_section_output', $active_section );
@@ -95,15 +99,20 @@ public function display_tools(): void {
 		include WPO_WCPDF()->plugin_path() . '/views/advanced-tools.php';
 	}
 
-	public function display_numbers() {
+	public function display_numbers( $nonce ) {
+		if ( ! wp_verify_nonce( $nonce, 'wp_wcpdf_settings_page_nonce' ) ) {
+			return;
+		}
+
 		global $wpdb;
 
+		$_GET['_wpnonce']               = $nonce;
 		$number_store_tables            = $this->get_number_store_tables();
 		$invoice_number_store_doc_types = $this->get_additional_invoice_number_store_document_types();
 		$store_name                     = 'invoice_number';
 
 		if ( isset( $_GET['table_name'] ) ) {
-			$selected_table_name = esc_attr( $_GET['table_name'] );
+			$selected_table_name = sanitize_text_field( wp_unslash( $_GET['table_name'] ) );
 		} else {
 			$_GET['table_name'] = $selected_table_name = apply_filters( 'wpo_wcpdf_number_store_table_name', "{$wpdb->prefix}wcpdf_{$store_name}", $store_name, null ); // i.e. wp_wcpdf_invoice_number or wp_wcpdf_invoice_number_2021
 		}
@@ -112,12 +121,16 @@ public function display_numbers() {
 			$_GET['table_name'] = $selected_table_name = null;
 		}
 
-		$document_type = $this->get_document_type_from_store_table_name( esc_attr( $_GET['table_name'] ) );
+		$document_type = $this->get_document_type_from_store_table_name( sanitize_text_field( wp_unslash( $_GET['table_name'] ) ) );
 
 		$list_table = new NumberStoreListTable();
 		$list_table->prepare_items();
 
-		include( WPO_WCPDF()->plugin_path() . '/views/advanced-numbers.php' );
+		$list_table_name = sanitize_text_field( wp_unslash( $_GET['table_name'] ) );
+		$search_value    = isset( $_REQUEST['s'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) : '';
+		$disable_reset   = empty( $search_value ) ? 'disabled' : '';
+
+		include WPO_WCPDF()->plugin_path() . '/views/advanced-numbers.php';
 	}
 
 	public function get_number_store_tables() {
@@ -347,19 +360,23 @@ private function export_settings( $data ) {
 			}
 		}
 
-		$filename = apply_filters( 'wpo_wcpdf_export_settings_filename', sprintf( "{$type}-settings-export_%s.json", date( 'Y-m-d_H-i-s' ) ), $type );
+		$filename = apply_filters( 'wpo_wcpdf_export_settings_filename', sprintf( "{$type}-settings-export_%s.json", gmdate( 'Y-m-d_H-i-s' ) ), $type );
 
 		wp_send_json_success( compact( 'filename', 'settings' ) );
 	}
 
 	private function import_settings( $data ) {
+		check_ajax_referer( 'wpo_wcpdf_debug_nonce', 'nonce' );
+
 		extract( $data );
 
 		$file_data = [];
 
 		if ( ! empty( $_FILES['file']['tmp_name'] ) && ! empty( $_FILES['file']['name'] ) ) {
-			$json_data = file_get_contents( $_FILES['file']['tmp_name'], $_FILES['file']['name'] );
-			if ( false === $json_data ) {
+			$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+			$json_data     = $wp_filesystem->get_contents( $_FILES['file']['tmp_name'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+
+			if ( ! $json_data ) {
 				$message = __( 'Failed to get contents from JSON file!', 'woocommerce-pdf-invoices-packing-slips' );
 				wcpdf_log_error( $message );
 				wp_send_json_error( compact( 'message' ) );
@@ -560,7 +577,7 @@ public function ajax_process_danger_zone_tools() {
 		if ( in_array( $date_type, $wc_date_types ) ) {
 			$date_arg      = $date_type;
 		} elseif ( 'document_date' === $date_type ) {
-			$document_slug = str_replace( '-', '_', $document_type );
+			$document_slug = ! empty( $document_type ) ? str_replace( '-', '_', $document_type ) : '';
 			$date_arg      = "wcpdf_{$document_slug}_date";
 		} else {
 			$date_arg      = '';
@@ -934,16 +951,16 @@ public function document_link_access_type_table() {
 		?>
 		<table id="document-link-access-type">
 			<tr>
-				<td class="option"><strong><?php _e( 'Logged in', 'woocommerce-pdf-invoices-packing-slips' ); ?></strong></td>
-				<td><?php _e( "Document can be accessed by logged in users only.", 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+				<td class="option"><strong><?php esc_html_e( 'Logged in', 'woocommerce-pdf-invoices-packing-slips' ); ?></strong></td>
+				<td><?php esc_html_e( 'Document can be accessed by logged in users only.', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
 			</tr>
 			<tr>
-				<td class="option"><strong><?php _e( 'Guest', 'woocommerce-pdf-invoices-packing-slips' ); ?></strong></td>
-				<td><?php _e( 'Document can be accessed by logged in and guest users.', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+				<td class="option"><strong><?php esc_html_e( 'Guest', 'woocommerce-pdf-invoices-packing-slips' ); ?></strong></td>
+				<td><?php esc_html_e( 'Document can be accessed by logged in and guest users.', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
 			</tr>
 			<tr>
-				<td class="option"><strong><?php _e( 'Full', 'woocommerce-pdf-invoices-packing-slips' ); ?></strong></td>
-				<td><?php _e( 'Document can be accessed by everyone with the link.', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+				<td class="option"><strong><?php esc_html_e( 'Full', 'woocommerce-pdf-invoices-packing-slips' ); ?></strong></td>
+				<td><?php esc_html_e( 'Document can be accessed by everyone with the link.', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
 			</tr>
 		</table>
 		<?php
diff --git a/includes/Settings/SettingsDocuments.php b/includes/Settings/SettingsDocuments.php
index d77a1361c..c299f21f3 100644
--- a/includes/Settings/SettingsDocuments.php
+++ b/includes/Settings/SettingsDocuments.php
@@ -20,7 +20,7 @@ public static function instance() {
 
 	public function __construct()	{
 		add_action( 'admin_init', array( $this, 'init_settings' ) );
-		add_action( 'wpo_wcpdf_settings_output_documents', array( $this, 'output' ), 10, 1 );
+		add_action( 'wpo_wcpdf_settings_output_documents', array( $this, 'output' ), 10, 2 );
 	}
 
 	public function init_settings() {
@@ -32,7 +32,11 @@ public function init_settings() {
 		}
 	}
 
-	public function output( $section ) {
+	public function output( $section, $nonce ) {
+		if ( ! wp_verify_nonce( $nonce, 'wp_wcpdf_settings_page_nonce' ) ) {
+			return;
+		}
+		
 		$section          = ! empty( $section ) ? $section : 'invoice';
 		$documents        = WPO_WCPDF()->documents->get_documents( 'all' );
 		$output_format    = 'pdf';
@@ -59,7 +63,7 @@ public function output( $section ) {
 				<?php
 				foreach ( $documents as $document ) {
 					if( $document->get_type() != $section ) {
-						$title = strip_tags( $document->get_title() );
+						$title = wp_strip_all_tags( $document->get_title() );
 						if ( empty( trim( $title ) ) ) {
 							$title = '['.__( 'untitled', 'woocommerce-pdf-invoices-packing-slips' ).']';
 						}
@@ -100,7 +104,7 @@ public function output( $section ) {
 								// if ( 'ubl' === $document_output_format ) {
 								// 	$tab_title .= ' <sup class="wcpdf_beta">beta</sup>';
 								// }
-								printf( '<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>', esc_url( add_query_arg( 'output_format', $document_output_format ) ), esc_attr( $document_output_format ), $active, $tab_title );
+								printf( '<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>', esc_url( add_query_arg( 'output_format', $document_output_format ) ), esc_attr( $document_output_format ), esc_attr( $active ), wp_kses_post( $tab_title ) );
 							}
 						?>
 					</h2>
diff --git a/includes/Settings/SettingsGeneral.php b/includes/Settings/SettingsGeneral.php
index da9bab033..5f3e5fd40 100644
--- a/includes/Settings/SettingsGeneral.php
+++ b/includes/Settings/SettingsGeneral.php
@@ -22,11 +22,15 @@ public static function instance() {
 
 	public function __construct()	{
 		add_action( 'admin_init', array( $this, 'init_settings' ) );
-		add_action( 'wpo_wcpdf_settings_output_general', array( $this, 'output' ), 10, 1 );
+		add_action( 'wpo_wcpdf_settings_output_general', array( $this, 'output' ), 10, 2 );
 		add_action( 'wpo_wcpdf_before_settings', array( $this, 'attachment_settings_hint' ), 10, 2 );
 	}
 
-	public function output( $section ) {
+	public function output( $section, $nonce ) {
+		if ( ! wp_verify_nonce( $nonce, 'wp_wcpdf_settings_page_nonce' ) ) {
+			return;
+		}
+		
 		settings_fields( $this->option_name );
 		do_settings_sections( $this->option_name );
 
@@ -303,7 +307,7 @@ public function attachment_settings_hint( $active_tab, $active_section ) {
 		// save or check option to hide attachments settings hint
 		if ( isset( $_REQUEST['wpo_wcpdf_hide_attachments_hint'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 			// validate nonce
-			if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'hide_attachments_hint_nonce' ) ) {
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'hide_attachments_hint_nonce' ) ) {
 				wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_hide_attachments_hint' );
 				$hide_hint = false;
 			} else {
@@ -377,7 +381,7 @@ public function find_templates() {
 
 		$template_paths = apply_filters( 'wpo_wcpdf_template_paths', $template_paths );
 
-		if ( defined( 'WP_CONTENT_DIR' ) && ! empty( WP_CONTENT_DIR ) && false !== strpos( WP_CONTENT_DIR, ABSPATH ) ) {
+		if ( defined( 'WP_CONTENT_DIR' ) && ! empty( WP_CONTENT_DIR ) && ! empty( ABSPATH ) && false !== strpos( WP_CONTENT_DIR, ABSPATH ) ) {
 			$forwardslash_basepath = str_replace( '\\', '/', ABSPATH );
 		} else {
 			$forwardslash_basepath = str_replace( '\\', '/', WP_CONTENT_DIR );
@@ -391,18 +395,19 @@ public function find_templates() {
 					continue;
 				}
 				// we're stripping abspath to make the plugin settings more portable
-				$forwardslash_dir = str_replace( '\\', '/', $dir );
-				$installed_templates[ str_replace( $forwardslash_basepath, '', $forwardslash_dir ) ] = basename( $dir );
+				$forwardslash_dir                      = str_replace( '\\', '/', $dir );
+				$relative_path                         = ! empty( $forwardslash_dir ) ? str_replace( $forwardslash_basepath, '', $forwardslash_dir ) : '';
+				$installed_templates[ $relative_path ] = basename( $dir );
 			}
 		}
 
 		// remove parent doubles
 		$installed_templates = array_unique( $installed_templates );
 
-		if ( empty( $installed_templates ) ) {
+		if ( empty( $installed_templates ) && ! empty( $template_paths['default'] ) ) {
 			// fallback to Simple template for servers with glob() disabled
 			$simple_template_path = str_replace( ABSPATH, '', $template_paths['default'] . 'Simple' );
-			$installed_templates[$simple_template_path] = 'Simple';
+			$installed_templates[ $simple_template_path ] = 'Simple';
 		}
 
 		return apply_filters( 'wpo_wcpdf_templates', $installed_templates );
diff --git a/includes/Settings/SettingsUbl.php b/includes/Settings/SettingsUbl.php
index 0e5ecead4..dd7a463d5 100644
--- a/includes/Settings/SettingsUbl.php
+++ b/includes/Settings/SettingsUbl.php
@@ -28,7 +28,7 @@ function __construct()	{
 		];
 
 		add_action( 'admin_init', array( $this, 'init_tax_settings' ) );
-		add_action( 'wpo_wcpdf_settings_output_ubl', array( $this, 'output' ), 10, 1 );
+		add_action( 'wpo_wcpdf_settings_output_ubl', array( $this, 'output' ), 10, 2 );
 
 		add_action( 'woocommerce_order_after_calculate_totals', array( $this, 'save_taxes_on_order_totals' ), 10, 2 );
 		add_action( 'woocommerce_checkout_order_processed', array( $this, 'save_taxes_on_checkout' ), 10, 3 );
@@ -37,7 +37,11 @@ function __construct()	{
 		add_action( 'admin_notices', array( $this, 'vat_coc_required_for_ubl_invoice') );
 	}
 
-	public function output( $active_section ) {
+	public function output( $active_section, $nonce ) {
+		if ( ! wp_verify_nonce( $nonce, 'wp_wcpdf_settings_page_nonce' ) ) {
+			return;
+		}
+		
 		$active_section = ! empty( $active_section ) ? $active_section : 'taxes';
 		?>
 		<div class="wcpdf_ubl_settings_sections">
@@ -46,12 +50,12 @@ public function output( $active_section ) {
 				<?php
 					foreach ( $this->sections as $section => $title ) {
 						$active = ( $section == $active_section ) ? 'nav-tab-active' : '';
-						printf( '<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>', esc_url( add_query_arg( 'section', $section ) ), esc_attr( $section ), $active, esc_html( $title ) );
+						printf( '<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>', esc_url( add_query_arg( 'section', $section ) ), esc_attr( $section ), esc_attr( $active ), esc_html( $title ) );
 					}
 				?>
 			</h2>
 			<?php else : ?>
-			<h3><?php echo $this->sections[ $active_section ]; ?></h3>
+			<h3><?php echo esc_html( $this->sections[ $active_section ] ); ?></h3>
 			<?php endif; ?>
 		</div>
 		<?php
@@ -112,7 +116,7 @@ public function vat_coc_required_for_ubl_invoice() {
 				'<a href="' . esc_url( admin_url( 'admin.php?page=wpo_wcpdf_options_page&tab=ubl' ) ) . '">' . __( 'UBL settings', 'woocommerce-pdf-invoices-packing-slips' ) . '</a>'
 			);
 
-			echo '<div class="notice notice-warning"><p>' . $message . '</p></div>';
+			echo '<div class="notice notice-warning"><p>' . wp_kses_post( $message ) . '</p></div>';
 		}
 	}
 
diff --git a/includes/Settings/SettingsUpgrade.php b/includes/Settings/SettingsUpgrade.php
index 9b97796a0..1c4047901 100644
--- a/includes/Settings/SettingsUpgrade.php
+++ b/includes/Settings/SettingsUpgrade.php
@@ -35,7 +35,7 @@ public function extensions_license_cache_notice( $tab, $active_section ) {
 				'<a href="' . esc_url( admin_url( 'admin.php?page=wpo_wcpdf_options_page&tab=debug&section=tools' ) ) . '">',
 				'</a>'
 			);
-			printf( '<div class="notice inline notice-warning"><p>%s</p></div>', $message );
+			printf( '<div class="notice inline notice-warning"><p>%s</p></div>', wp_kses_post( $message ) );
 		}
 	}
 
diff --git a/includes/SetupWizard.php b/includes/SetupWizard.php
index b47615fdc..73d394480 100644
--- a/includes/SetupWizard.php
+++ b/includes/SetupWizard.php
@@ -29,7 +29,6 @@ public function __construct() {
 			add_action( 'admin_menu', array( $this, 'admin_menus' ) );
 			add_action( 'admin_init', array( $this, 'setup_wizard' ) );
 		}
-
 	}
 
 	/**
@@ -43,9 +42,10 @@ public function admin_menus() {
 	 * Show the setup wizard.
 	 */
 	public function setup_wizard() {
-		$suffix = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
+		$suffix  = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
+		$request = stripslashes_deep( $_REQUEST ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 
-		if ( empty( $_GET['page'] ) || 'wpo-wcpdf-setup' !== $_GET['page'] ) {
+		if ( empty( $request['page'] ) || 'wpo-wcpdf-setup' !== $request['page'] ) {
 			return;
 		}
 
@@ -83,7 +83,7 @@ public function setup_wizard() {
 				'view'	=> WPO_WCPDF()->plugin_path() . '/views/setup-wizard/good-to-go.php',
 			),
 		);
-		$this->step = isset( $_GET['step'] ) ? sanitize_key( $_GET['step'] ) : current( array_keys( $this->steps ) );
+		$this->step = isset( $request['step'] ) ? sanitize_text_field( $request['step'] ) : current( array_keys( $this->steps ) );
 
 		wp_enqueue_style(
 			'wpo-wcpdf-setup',
@@ -115,7 +115,7 @@ public function setup_wizard() {
 			);
 		}
 
-		if ( ! empty( $_POST['save_step'] ) ) {
+		if ( ! empty( $request['save_step'] ) ) {
 			$this->save_step();
 		}
 
@@ -232,16 +232,20 @@ public function get_step( $delta ) {
 	}
 
 	public function save_step() {
+		$request = stripslashes_deep( $_POST ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		
 		if ( isset( $this->steps[ $this->step ]['handler'] ) ) {
 			check_admin_referer( 'wpo-wcpdf-setup' );
 			// for doing more than just saving an option value
 			call_user_func( $this->steps[ $this->step ]['handler'] );
 		} else {
 			$user_id = get_current_user_id();
-			$hidden = get_user_meta( $user_id, 'manageedit-shop_ordercolumnshidden', true );
-			if ( ! empty( $_POST['wcpdf_settings'] ) && is_array( $_POST['wcpdf_settings'] ) ) {
+			$hidden  = get_user_meta( $user_id, 'manageedit-shop_ordercolumnshidden', true );
+			
+			if ( ! empty( $request['wcpdf_settings'] ) && is_array( $request['wcpdf_settings'] ) ) {
 				check_admin_referer( 'wpo-wcpdf-setup' );
-				foreach ( $_POST['wcpdf_settings'] as $option => $settings ) {
+				
+				foreach ( $request['wcpdf_settings'] as $option => $settings ) {
 					// sanitize posted settings
 					foreach ( $settings as $key => $value ) {
 						if ( $key == 'shop_address' && function_exists( 'sanitize_textarea_field' ) ) {
@@ -262,8 +266,8 @@ public function save_step() {
 					$new_settings = $settings + $current_settings;
 					update_option( $option, $new_settings );
 				}
-			} elseif ( $_POST['wpo_wcpdf_step'] == 'show-action-buttons' ) {
-				if ( ! empty( $_POST['wc_show_action_buttons'] ) ) {
+			} elseif ( ! empty( $request['wpo_wcpdf_step'] ) && 'show-action-buttons' === $request['wpo_wcpdf_step'] ) {
+				if ( ! empty( $request['wc_show_action_buttons'] ) ) {
 					$hidden = array_filter( $hidden, function( $setting ){ return $setting !== 'wc_actions'; } );
 					update_user_meta( $user_id, 'manageedit-shop_ordercolumnshidden', $hidden );
 				} else {
diff --git a/includes/Tables/NumberStoreListTable.php b/includes/Tables/NumberStoreListTable.php
index a39dbf65f..8922bf5f3 100644
--- a/includes/Tables/NumberStoreListTable.php
+++ b/includes/Tables/NumberStoreListTable.php
@@ -124,8 +124,10 @@ public function get_columns() {
 			'order_status'      => __( 'Order Status', 'woocommerce-pdf-invoices-packing-slips' ),
 		);
 
-		$table_name    = isset( $_GET['table_name'] ) ? sanitize_text_field( $_GET['table_name'] ) : null;
-		$document_type = WPO_WCPDF()->settings->debug->get_document_type_from_store_table_name( $table_name );
+		if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'wp_wcpdf_settings_page_nonce' ) ) {
+			$table_name    = isset( $_GET['table_name'] ) ? sanitize_text_field( wp_unslash( $_GET['table_name'] ) ) : null;
+			$document_type = WPO_WCPDF()->settings->debug->get_document_type_from_store_table_name( $table_name );
+		}
 
 		if ( empty( $document_type ) || 'invoice' !== $document_type ) {
 			unset( $columns['type'] );
@@ -191,6 +193,10 @@ public function get_search( $request ) {
 	 */
 	public function get_numbers() {
 		global $wpdb;
+		
+		if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'wp_wcpdf_settings_page_nonce' ) ) {
+			return array();
+		}
 
 		$request                        = stripslashes_deep( $_GET );
 		$results                        = array();
@@ -218,12 +224,16 @@ public function get_numbers() {
 
 		if ( ! empty( $table_name ) ) {
 			if ( $search ) {
-				$query = $wpdb->prepare( "SELECT * FROM {$table_name} WHERE `id` = %d OR `order_id` = %d ORDER BY {$orderby} {$order}", $search, $search );
+				$results = $wpdb->get_results( 
+					$wpdb->prepare(
+						"SELECT * FROM `" . esc_sql( $table_name ) . "` WHERE `id` = %d OR `order_id` = %d ORDER BY " . esc_sql( $orderby ) . " " . esc_sql( $order ), 
+						$search, 
+						$search 
+					) 
+				);										
 			} else {
-				$query = "SELECT * FROM {$table_name} ORDER BY {$orderby} {$order}";
+				$results = $wpdb->get_results( "SELECT * FROM `" . esc_sql( $table_name ) . "` ORDER BY `" . esc_sql( $orderby ) . "` " . esc_sql( $order ) );
 			}
-
-			$results = $wpdb->get_results( $query );
 		}
 
 		// add document title or 'Deleted'
diff --git a/languages/strings.php b/languages/strings.php
index 7b9e0405e..af3765f26 100644
--- a/languages/strings.php
+++ b/languages/strings.php
@@ -1,12 +1,13 @@
 <?php
-exit;
-__( 'VAT', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'Tax rate', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'Payment date', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'Payment Date:', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'Payment method', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'Shipping method', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'Send email', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'Description', 'woocommerce-pdf-invoices-packing-slips' );
-__( 'SKU', 'woocommerce-pdf-invoices-packing-slips' );
-
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+esc_html__( 'VAT', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'Tax rate', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'Payment date', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'Payment Date:', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'Payment method', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'Shipping method', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'Send email', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'Description', 'woocommerce-pdf-invoices-packing-slips' );
+esc_html__( 'SKU', 'woocommerce-pdf-invoices-packing-slips' );
diff --git a/readme.txt b/readme.txt
index 2e76eac9c..06633119a 100644
--- a/readme.txt
+++ b/readme.txt
@@ -5,7 +5,7 @@ Tags: woocommerce, pdf, ubl, invoices, packing slips
 Requires at least: 4.4
 Tested up to: 6.7
 Requires PHP: 7.4
-Stable tag: 3.9.6
+Stable tag: 4.0.0-beta-1
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -122,7 +122,7 @@ There's a setting on the Advanced tab of the settings page that allows you to to
 - New: Support for UBL Tax Category Reason
 - Tweak: Replace UBL code to get the customer VAT number with new function
 - Tweak: Update UBL format selector description
-- Tweak: Allow `0` days for the due date 
+- Tweak: Allow `0` days for the due date
 - Tweak: Apply `wpo_wcpdf_settings_fields_documents_{$this->type}_pdf` before checking the emptiness of the `$settings_fields`
 - Fix: Logo height setting can break document layout on Simple template
 - Fix: Setting categories not applied to disabled documents
diff --git a/templates/Simple/html-document-wrapper.php b/templates/Simple/html-document-wrapper.php
index 19b703a5b..363fc7471 100644
--- a/templates/Simple/html-document-wrapper.php
+++ b/templates/Simple/html-document-wrapper.php
@@ -1,13 +1,13 @@
 <?php if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly ?>
 <!DOCTYPE html>
-<html <?php echo apply_filters( 'wpo_wcpdf_html_language_attributes', get_language_attributes(), $this->get_type(), $this ); ?>>
+<html <?php $this->language_attributes(); ?>>
 <head>
 	<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
 	<title><?php $this->title(); ?></title>
 	<style type="text/css"><?php $this->template_styles(); ?></style>
-	<style type="text/css"><?php do_action( 'wpo_wcpdf_custom_styles', $this->get_type(), $this ); ?></style>
+	<style type="text/css"><?php $this->template_custom_styles(); ?></style>
 </head>
-<body class="<?php echo apply_filters( 'wpo_wcpdf_body_class', $this->get_type(), $this ); ?>">
-<?php echo $content; ?>
+<body class="<?php $this->body_class(); ?>">
+<?php echo $content; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
 </body>
 </html>
diff --git a/templates/Simple/invoice.php b/templates/Simple/invoice.php
index 0c9d5b569..30421368a 100644
--- a/templates/Simple/invoice.php
+++ b/templates/Simple/invoice.php
@@ -107,34 +107,34 @@
 		<tr>
 			<?php
 				foreach ( $headers as $column_class => $column_title ) {
-					printf( '<th class="%s">%s</th>', $column_class, $column_title );
+					printf( '<th class="%s">%s</th>', esc_attr( $column_class ), esc_html( $column_title ) );
 				}
 			?>
 		</tr>
 	</thead>
 	<tbody>
 		<?php foreach ( $this->get_order_items() as $item_id => $item ) : ?>
-			<tr class="<?php echo apply_filters( 'wpo_wcpdf_item_row_class', 'item-' . $item_id, esc_attr( $this->get_type() ), $this->order, $item_id ); ?>">
+			<tr class="<?php echo esc_html( $item['row_class'] ); ?>">
 				<td class="product">
-					<p class="item-name"><?php echo $item['name']; ?></p>
+					<p class="item-name"><?php echo esc_html( $item['name'] ); ?></p>
 					<?php do_action( 'wpo_wcpdf_before_item_meta', $this->get_type(), $item, $this->order ); ?>
-					<div class="item-meta meta">
+					<div class="item-meta">
 						<?php if ( ! empty( $item['sku'] ) ) : ?>
 							<p class="sku"><span class="label"><?php $this->sku_title(); ?></span> <?php echo esc_attr( $item['sku'] ); ?></p>
 						<?php endif; ?>
 						<?php if ( ! empty( $item['weight'] ) ) : ?>
 							<p class="weight"><span class="label"><?php $this->weight_title(); ?></span> <?php echo esc_attr( $item['weight'] ); ?><?php echo esc_attr( get_option( 'woocommerce_weight_unit' ) ); ?></p>
 						<?php endif; ?>
-						<!-- .wc-item-meta -->
+						<!-- ul.wc-item-meta -->
 						<?php if ( ! empty( $item['meta'] ) ) : ?>
-							<?php echo $item['meta']; ?>
+							<?php echo wp_kses_post( $item['meta'] ); ?>
 						<?php endif; ?>
-						<!-- / .wc-item-meta -->
+						<!-- / ul.wc-item-meta -->
 					</div>
 					<?php do_action( 'wpo_wcpdf_after_item_meta', $this->get_type(), $item, $this->order ); ?>
 				</td>
-				<td class="quantity"><?php echo $item['quantity']; ?></td>
-				<td class="price"><?php echo $item['order_price']; ?></td>
+				<td class="quantity"><?php echo esc_html( $item['quantity'] ); ?></td>
+				<td class="price"><?php echo esc_html( $item['order_price'] ); ?></td>
 			</tr>
 		<?php endforeach; ?>
 	</tbody>
@@ -166,8 +166,8 @@
 					<tfoot>
 						<?php foreach ( $this->get_woocommerce_totals() as $key => $total ) : ?>
 							<tr class="<?php echo esc_attr( $key ); ?>">
-								<th class="description"><?php echo $total['label']; ?></th>
-								<td class="price"><span class="totals-price"><?php echo $total['value']; ?></span></td>
+								<th class="description"><?php echo esc_html( $total['label'] ); ?></th>
+								<td class="price"><span class="totals-price"><?php echo esc_html( $total['value'] ); ?></span></td>
 							</tr>
 						<?php endforeach; ?>
 					</tfoot>
diff --git a/templates/Simple/packing-slip.php b/templates/Simple/packing-slip.php
index 23ca2fe14..03a01c040 100644
--- a/templates/Simple/packing-slip.php
+++ b/templates/Simple/packing-slip.php
@@ -89,33 +89,33 @@
 		<tr>
 			<?php
 				foreach ( $headers as $column_class => $column_title ) {
-					printf( '<th class="%s"><span>%s</span></th>', $column_class, $column_title );
+					printf( '<th class="%s">%s</th>', esc_attr( $column_class ), esc_html( $column_title ) );
 				}
 			?>
 		</tr>
 	</thead>
 	<tbody>
 		<?php foreach ( $this->get_order_items() as $item_id => $item ) : ?>
-			<tr class="<?php echo apply_filters( 'wpo_wcpdf_item_row_class', 'item-' . $item_id, esc_attr( $this->get_type() ), $this->order, $item_id ); ?>">
+			<tr class="<?php echo esc_html( $item['row_class'] ); ?>">
 				<td class="product">
-					<p class="item-name"><?php echo $item['name']; ?></p>
+					<p class="item-name"><?php echo esc_html( $item['name'] ); ?></p>
 					<?php do_action( 'wpo_wcpdf_before_item_meta', $this->get_type(), $item, $this->order ); ?>
-					<div class="item-meta meta">
+					<div class="item-meta">
 						<?php if ( ! empty( $item['sku'] ) ) : ?>
 							<p class="sku"><span class="label"><?php $this->sku_title(); ?></span> <?php echo esc_attr( $item['sku'] ); ?></p>
 						<?php endif; ?>
 						<?php if ( ! empty( $item['weight'] ) ) : ?>
 							<p class="weight"><span class="label"><?php $this->weight_title(); ?></span> <?php echo esc_attr( $item['weight'] ); ?><?php echo esc_attr( get_option( 'woocommerce_weight_unit' ) ); ?></p>
 						<?php endif; ?>
-						<!-- .wc-item-meta -->
+						<!-- ul.wc-item-meta -->
 						<?php if ( ! empty( $item['meta'] ) ) : ?>
-							<?php echo $item['meta']; ?>
+							<?php echo wp_kses_post( $item['meta'] ); ?>
 						<?php endif; ?>
-						<!-- / .wc-item-meta -->
+						<!-- / ul.wc-item-meta -->
 					</div>
 					<?php do_action( 'wpo_wcpdf_after_item_meta', $this->get_type(), $item, $this->order ); ?>
 				</td>
-				<td class="quantity"><?php echo $item['quantity']; ?></td>
+				<td class="quantity"><?php echo esc_html( $item['quantity'] ); ?></td>
 			</tr>
 		<?php endforeach; ?>
 	</tbody>
diff --git a/templates/Simple/style.css b/templates/Simple/style.css
index 61bed1c52..f7f23046c 100644
--- a/templates/Simple/style.css
+++ b/templates/Simple/style.css
@@ -45,7 +45,7 @@ ul {
 }
 
 li {
-	margin: 0;
+	margin-bottom: 0.75em;
 }
 
 p {
@@ -174,7 +174,7 @@ td.order-data table th {
 table.order-details,
 table.notes-totals {
 	width: 100%;
-	margin-bottom: 0;
+	margin-bottom: 8mm;
 	page-break-before: avoid;
 }
 
@@ -225,9 +225,8 @@ table.notes-totals {
 }
 
 /* item meta formatting */
-.item-meta,
-.meta {
-	margin: 4px 0 0 0;
+.item-meta {
+	margin: 8px 0 0 0;
 	font-size: 7pt;
 	line-height: 7pt;
 	overflow-wrap: anywhere;
@@ -238,6 +237,11 @@ table.notes-totals {
 	margin: 0;
 }
 
+.wc-item-meta li {
+	margin-top: 4px;
+	margin-left: 0;
+}
+
 .wc-item-meta li p,
 .wc-item-meta li dd {
 	display: inline;
@@ -245,9 +249,9 @@ table.notes-totals {
 
 .wc-item-meta p,
 .wc-item-meta dd,
-.item-meta p,
-.meta p {
-	margin: 0;
+.item-meta p {
+	margin-top: 4px;
+	margin-left: 0;
 }
 
 /* Notes & Totals */
@@ -259,7 +263,7 @@ table.notes-totals {
 
 table.totals {
 	width: 100%;
-	margin-top: 0;
+	margin-top: 5mm;
 	table-layout: fixed;
 }
 
@@ -270,12 +274,6 @@ table.totals td {
 	border-bottom: 1px solid #ccc;
 }
 
-table.totals tr:nth-child(1) th,
-table.totals tr:nth-child(1) td {
-	border-top: 0;
-	border-bottom: 0;
-}
-
 table.totals th.description,
 table.totals td.price {
 	width: 50%;
diff --git a/ubl/Settings/TaxesSettings.php b/ubl/Settings/TaxesSettings.php
index 096ac6ca2..454fb03b8 100644
--- a/ubl/Settings/TaxesSettings.php
+++ b/ubl/Settings/TaxesSettings.php
@@ -21,7 +21,7 @@ public function output() {
 
 		$rates                       = \WC_Tax::get_tax_rate_classes();
 		$formatted_rates             = array();
-		$formatted_rates['standard'] = __( 'Standard', 'woocommerce' );
+		$formatted_rates['standard'] = __( 'Standard', 'woocommerce-pdf-invoices-packing-slips' );
 
 		foreach ( $rates as $rate ) {
 			if ( empty( $rate->slug ) ) {
@@ -39,22 +39,35 @@ public function output() {
 
 	public function output_table_for_tax_class( $slug, $name ) {
 		global $wpdb;
-		$results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}woocommerce_tax_rates WHERE tax_rate_class = %s;", ( $slug == 'standard' ) ? '' : $slug ) );
+		$results      = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}woocommerce_tax_rates WHERE tax_rate_class = %s;", ( $slug == 'standard' ) ? '' : $slug ) );
+		$allowed_html = array(
+			'select' => array(
+				'name'         => true,
+				'id'           => true,
+				'class'        => true,
+				'style'        => true,
+				'data-current' => true
+			),
+			'option' => array(
+				'value'        => true,
+				'selected'     => true,
+			)
+		);
 		?>
 
 		<h4><?php echo $name; ?></h4>
 		<table class="widefat striped">
 			<thead>
 				<tr>
-					<th><?php _e( 'Country code', 'woocommerce' ); ?></th>
-					<th><?php _e( 'State code', 'woocommerce' ); ?></th>
-					<th><?php _e( 'Postcode / ZIP', 'woocommerce' ); ?></th>
-					<th><?php _e( 'City', 'woocommerce' ); ?></th>
-					<th><?php _e( 'Rate', 'woocommerce' ); ?></th>
-					<th><a href="https://service.unece.org/trade/untdid/d00a/tred/tred5153.htm" target="_blank"><?php _e( 'Tax Scheme', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></th>
-					<th><a href="https://unece.org/fileadmin/DAM/trade/untdid/d16b/tred/tred5305.htm" target="_blank"><?php _e( 'Tax Category', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></th>
-					<th width="10%"><a href="https://docs.peppol.eu/poacc/billing/3.0/codelist/vatex/" target="_blank"><?php _e( 'Reason', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></th>
-					<th width="15%"><?php _e( 'Remarks', 'woocommerce-pdf-invoices-packing-slips' ); ?></th>
+					<th><?php esc_html_e( 'Country code', 'woocommerce-pdf-invoices-packing-slips' ); ?></th>
+					<th><?php esc_html_e( 'State code', 'woocommerce-pdf-invoices-packing-slips' ); ?></th>
+					<th><?php esc_html_e( 'Postcode / ZIP', 'woocommerce-pdf-invoices-packing-slips' ); ?></th>
+					<th><?php esc_html_e( 'City', 'woocommerce-pdf-invoices-packing-slips' ); ?></th>
+					<th><?php esc_html_e( 'Rate', 'woocommerce-pdf-invoices-packing-slips' ); ?></th>
+					<th><a href="https://service.unece.org/trade/untdid/d00a/tred/tred5153.htm" target="_blank"><?php esc_html_e( 'Tax Scheme', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></th>
+					<th><a href="https://unece.org/fileadmin/DAM/trade/untdid/d16b/tred/tred5305.htm" target="_blank"><?php esc_html_e( 'Tax Category', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></th>
+					<th width="10%"><a href="https://docs.peppol.eu/poacc/billing/3.0/codelist/vatex/" target="_blank"><?php esc_html_e( 'Reason', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></th>
+					<th width="15%"><?php esc_html_e( 'Remarks', 'woocommerce-pdf-invoices-packing-slips' ); ?></th>
 				</tr>
 			</thead>
 			<tbody id="rates">
@@ -98,29 +111,32 @@ public function output_table_for_tax_class( $slug, $name ) {
 							$reason_code      = ( 'default' === $reason ) ? $reason_default : $reason;
 							
 							echo '<tr>';
-							echo '<td>' . $country . '</td>';
-							echo '<td>' . $state . '</td>';
-							echo '<td>' . $postcode . '</td>';
-							echo '<td>' . $city . '</td>';
-							echo '<td>' . wc_round_tax_total( $result->tax_rate ) . '%</td>';
+							echo '<td>' . esc_html( $country ) . '</td>';
+							echo '<td>' . esc_html( $state ) . '</td>';
+							echo '<td>' . esc_html( $postcode ) . '</td>';
+							echo '<td>' . esc_html( $city ) . '</td>';
+							echo '<td>' . esc_html( wc_round_tax_total( $result->tax_rate ) ) . '%</td>';
 							echo '<td>';
-							echo $this->get_select_for( 'scheme', 'rate', $result->tax_rate_id, $scheme );
-							echo '<div class="current" style="margin-top:6px;">' . __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . $scheme_code . '</code></div>';
+							$select_for_scheme = $this->get_select_for( 'scheme', 'rate', $result->tax_rate_id, $scheme );
+							echo wp_kses( $select_for_scheme, $allowed_html );
+							echo '<div class="current" style="margin-top:6px;">' . esc_html__( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . esc_html( $scheme_code ) . '</code></div>';
 							echo '</td>';
 							echo '<td>';
-							echo $this->get_select_for( 'category', 'rate', $result->tax_rate_id, $category );
-							echo '<div class="current" style="margin-top:6px;">' . __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . $category_code . '</code></div>';
+							$select_for_category = $this->get_select_for( 'category', 'rate', $result->tax_rate_id, $category );
+							echo wp_kses( $select_for_category, $allowed_html );
+							echo '<div class="current" style="margin-top:6px;">' . esc_html__( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . esc_html( $category_code ) . '</code></div>';
 							echo '</td>';
 							echo '<td>';
-							echo $this->get_select_for( 'reason', 'rate', $result->tax_rate_id, $reason );
-							echo '<div class="current" style="margin-top:6px;">' . __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . $reason_code . '</code></div>';
+							$select_for_reason = $this->get_select_for( 'reason', 'rate', $result->tax_rate_id, $reason );
+							echo wp_kses( $select_for_reason, $allowed_html );
+							echo '<div class="current" style="margin-top:6px;">' . esc_html__( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . esc_html( $reason_code ) . '</code></div>';
 							echo '</td>';
 							echo '<td class="remark">';
 							
 							foreach ( self::get_available_remarks() as $field => $remarks ) {
 								foreach ( array( 'scheme', 'category', 'reason' ) as $f ) {
 									if ( isset( $remarks[ ${$f} ] ) ) {
-										echo '<p><code>' . ${$f} . '</code>: ' . $remarks[ ${$f} ] . '</p>';
+										echo '<p><code>' . esc_html( ${$f} ) . '</code>: ' . esc_html( $remarks[ ${$f} ] ) . '</p>';
 									}
 								}
 							}
@@ -129,13 +145,13 @@ public function output_table_for_tax_class( $slug, $name ) {
 							echo '</tr>';
 						}
 					} else {
-						echo '<tr><td colspan="9">' . __( 'No taxes found for this class.', 'woocommerce-pdf-invoices-packing-slips' ) . '</td></tr>';
+						echo '<tr><td colspan="9">' . esc_html__( 'No taxes found for this class.', 'woocommerce-pdf-invoices-packing-slips' ) . '</td></tr>';
 					}
 				?>
 			</tbody>
 			<tfoot>
 				<tr>
-					<th colspan="5" style="text-align: right;"><?php _e( 'Tax class default', 'woocommerce-pdf-invoices-packing-slips' ); ?>:</th>
+					<th colspan="5" style="text-align: right;"><?php esc_html_e( 'Tax class default', 'woocommerce-pdf-invoices-packing-slips' ); ?>:</th>
 					<?php
 						$scheme   = isset( $this->settings['class'][ $slug ]['scheme'] )   ? $this->settings['class'][ $slug ]['scheme']   : 'default';
 						$category = isset( $this->settings['class'][ $slug ]['category'] ) ? $this->settings['class'][ $slug ]['category'] : 'default';
@@ -143,20 +159,23 @@ public function output_table_for_tax_class( $slug, $name ) {
 					?>
 					<th>
 						<?php
-							echo $this->get_select_for( 'scheme', 'class', $slug, $scheme );
-							echo '<div class="current" style="margin-top:6px;">' . __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . $scheme . '</code></div>';
+							$select_for_scheme = $this->get_select_for( 'scheme', 'class', $slug, $scheme );
+							echo wp_kses( $select_for_scheme, $allowed_html );
+							echo '<div class="current" style="margin-top:6px;">' . esc_html__( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . esc_html( $scheme ) . '</code></div>';
 						?>
 					</th>
 					<th>
 						<?php
-							echo $this->get_select_for( 'category', 'class', $slug, $category );
-							echo '<div class="current" style="margin-top:6px;">' . __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . $category . '</code></div>';
+							$select_for_category = $this->get_select_for( 'category', 'class', $slug, $category );
+							echo wp_kses( $select_for_category, $allowed_html );
+							echo '<div class="current" style="margin-top:6px;">' . esc_html__( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . esc_html( $category ) . '</code></div>';
 						?>
 					</th>
 					<th>
 						<?php
-							echo $this->get_select_for( 'reason', 'class', $slug, $reason );
-							echo '<div class="current" style="margin-top:6px;">' . __( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . $reason . '</code></div>';
+							$select_for_reason = $this->get_select_for( 'reason', 'class', $slug, $reason );
+							echo wp_kses( $select_for_reason, $allowed_html );
+							echo '<div class="current" style="margin-top:6px;">' . esc_html__( 'Code', 'woocommerce-pdf-invoices-packing-slips' ) . ': <code>' . esc_html( $reason ) . '</code></div>';
 						?>
 					</th>
 					<th class="remark">
@@ -164,7 +183,7 @@ public function output_table_for_tax_class( $slug, $name ) {
 							foreach ( self::get_available_remarks() as $field => $remarks ) {
 								foreach ( array( 'scheme', 'category', 'reason' ) as $f ) {
 									if ( isset( $remarks[ ${$f} ] ) ) {
-										echo '<p><code>' . ${$f} . '</code>: ' . $remarks[ ${$f} ] . '</p>';
+										echo '<p><code>' . esc_html( ${$f} ) . '</code>: ' . esc_html( $remarks[ ${$f} ] ) . '</p>';
 									}
 								}
 							}
diff --git a/views/advanced-numbers.php b/views/advanced-numbers.php
index 45b657866..9d577c710 100644
--- a/views/advanced-numbers.php
+++ b/views/advanced-numbers.php
@@ -8,7 +8,7 @@
 	<ul>
 		<?php
 			foreach ( $number_store_tables as $table_name => $title ) {
-				if ( isset( $_GET['table_name'] ) && $table_name !== $_GET['table_name'] ) {
+				if ( isset( $list_table_name ) && $table_name !== $list_table_name ) {
 					if ( empty( trim( $title ) ) ) {
 						$title = '[' . __( 'untitled', 'woocommerce-pdf-invoices-packing-slips' ) . ']';
 					}
@@ -19,29 +19,28 @@
 	</ul>
 	<?php if ( ! empty( $document_type ) && 'invoice' !== $document_type && in_array( $document_type, $invoice_number_store_doc_types ) ) : ?>
 		<div class="notice notice-warning inline">
-			<p><?php _e( 'This document is currently using the main invoice number sequence.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<p><?php esc_html_e( 'This document is currently using the main invoice number sequence.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 		</div>
 	<?php elseif ( ! empty( $selected_table_name ) && ! empty( $number_store_tables[ $selected_table_name ] ) ) : ?>
 		<p>
 			<?php
 				printf(
 					/* translators: chose table title */
-					__( 'Below is a list of all the document numbers generated since the last reset (which happens when you set the <strong>next %s number</strong> value in the settings).', 'woocommerce-pdf-invoices-packing-slips' ),
-					$choose_table_title
+					wp_kses_post( 'Below is a list of all the document numbers generated since the last reset (which happens when you set the <strong>next %s number</strong> value in the settings).', 'woocommerce-pdf-invoices-packing-slips' ),
+					esc_html( $choose_table_title )
 				);
 			?>
 		</p>
-		<p><?php _e( 'Numbers may have been assigned to orders before this.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+		<p><?php esc_html_e( 'Numbers may have been assigned to orders before this.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 		<div class="number-search" style="text-align:right;">
-			<input type="number" id="number_search_input" name="number_search_input" min="1" max="4294967295" value="<?php echo isset( $_REQUEST['s'] ) ? esc_attr( $_REQUEST['s'] ) : ''; ?>">
-			<a href="#" class="button button-primary number-search-button"><?php _e( 'Search number', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
-			<?php $disabled = ( isset( $_REQUEST['s'] ) && ! empty( $_REQUEST['s'] ) ) ? '' : 'disabled'; ?>
-			<a href="<?php echo esc_url( remove_query_arg( 's' ) ); ?>" class="button button-secondary" <?php echo $disabled; ?>><?php _e( 'Reset', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
+			<input type="number" id="number_search_input" name="number_search_input" min="1" max="4294967295" value="<?php echo esc_attr( $search_value ); ?>">
+			<a href="#" class="button button-primary number-search-button"><?php esc_html_e( 'Search number', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
+			<a href="<?php echo esc_url( remove_query_arg( 's' ) ); ?>" class="button button-secondary" <?php echo esc_attr( $disable_reset ); ?>><?php esc_html_e( 'Reset', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
 		</div>
 		<?php $list_table->display(); ?>
 	<?php else : ?>
 		<div class="notice notice-info inline">
-			<p><?php _e( 'Please select a number store!', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<p><?php esc_html_e( 'Please select a number store!', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 		</div>
 	<?php endif; ?>
 </div>
diff --git a/views/advanced-status.php b/views/advanced-status.php
index 479b23b31..7bfbc289c 100644
--- a/views/advanced-status.php
+++ b/views/advanced-status.php
@@ -79,8 +79,8 @@
 		?>
 		<tr>
 			<td class="title"><?php echo esc_html( $document->get_title() ); ?></td>
-			<td style="<?= $is_enabled ? 'background-color:#68de7c; color:black;' : 'background-color:#ffabaf; color:black;' ?>"><?php echo wp_kses_post( $is_enabled === true ? esc_html__( 'Yes', 'woocommerce-pdf-invoices-packing-slips' ) : esc_html__( 'No', 'woocommerce-pdf-invoices-packing-slips' ) ); ?></td>
-			<td style="<?= $is_reset_enabled ? 'background-color:#68de7c; color:black;' : 'background-color:#ffabaf; color:black;' ?>"><?php echo wp_kses_post( $is_reset_enabled === true ? esc_html__( 'Yes', 'woocommerce-pdf-invoices-packing-slips' ) : esc_html__( 'No', 'woocommerce-pdf-invoices-packing-slips' ) ); ?></td>
+			<td style="<?php echo $is_enabled ? 'background-color:#68de7c; color:black;' : 'background-color:#ffabaf; color:black;' ?>"><?php echo wp_kses_post( $is_enabled === true ? esc_html__( 'Yes', 'woocommerce-pdf-invoices-packing-slips' ) : esc_html__( 'No', 'woocommerce-pdf-invoices-packing-slips' ) ); ?></td>
+			<td style="<?php echo $is_reset_enabled ? 'background-color:#68de7c; color:black;' : 'background-color:#ffabaf; color:black;' ?>"><?php echo wp_kses_post( $is_reset_enabled === true ? esc_html__( 'Yes', 'woocommerce-pdf-invoices-packing-slips' ) : esc_html__( 'No', 'woocommerce-pdf-invoices-packing-slips' ) ); ?></td>
 		</tr>
 	</tbody>
 	<?php endforeach; ?>
@@ -100,12 +100,12 @@
 				if ( ! empty( $scheduled_actions ) ) {
 					$total_actions = count( $scheduled_actions );
 					if ( $total_actions === 1 ) {
-						$action      = reset( $scheduled_actions );
-						$action_date = is_callable( array( $action->get_schedule(), 'get_date' ) ) ? $action->get_schedule()->get_date() : $action->get_schedule()->get_next( as_get_datetime_object() );
-						/* translators: action date */
+						$action                 = reset( $scheduled_actions );
+						$action_date            = is_callable( array( $action->get_schedule(), 'get_date' ) ) ? $action->get_schedule()->get_date() : $action->get_schedule()->get_next( as_get_datetime_object() );
 						$yearly_reset['value']  = sprintf(
-							__( 'Scheduled to: %s' ), date( wcpdf_date_format( null, 'yearly_reset_schedule' ),
-							$action_date->getTimeStamp() )
+							/* translators: %s action date */
+							__( 'Scheduled to: %s', 'woocommerce-pdf-invoices-packing-slips' ),
+							gmdate( wcpdf_date_format( null, 'yearly_reset_schedule' ), $action_date->getTimestamp() )
 						);
 						$yearly_reset['result'] = true;
 					} else {
@@ -155,6 +155,8 @@
 </table>
 
 <?php
+	$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+
 	$status = array(
 		'ok'     => __( 'Writable', 'woocommerce-pdf-invoices-packing-slips' ),
 		'failed' => __( 'Not writable', 'woocommerce-pdf-invoices-packing-slips' ),
@@ -164,26 +166,26 @@
 		'WCPDF_TEMP_DIR' => array (
 			'description'    => __( 'Central temporary plugin folder', 'woocommerce-pdf-invoices-packing-slips' ),
 			'value'          => WPO_WCPDF()->main->get_tmp_path(),
-			'status'         => is_writable( WPO_WCPDF()->main->get_tmp_path() ) ? 'ok' : 'failed',
-			'status_message' => is_writable( WPO_WCPDF()->main->get_tmp_path() ) ? $status['ok'] : $status['failed'],
+			'status'         => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path() ) ? 'ok' : 'failed',
+			'status_message' => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path() ) ? $status['ok'] : $status['failed'],
 		),
 		'WCPDF_ATTACHMENT_DIR' => array (
 			'description'    => __( 'Temporary attachments folder', 'woocommerce-pdf-invoices-packing-slips' ),
 			'value'          => trailingslashit( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ),
-			'status'         => is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? 'ok' : 'failed',
-			'status_message' => is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? $status['ok'] : $status['failed'],
+			'status'         => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? 'ok' : 'failed',
+			'status_message' => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'attachments' ) ) ? $status['ok'] : $status['failed'],
 		),
 		'DOMPDF_TEMP_DIR' => array (
 			'description'    => __( 'Temporary DOMPDF folder', 'woocommerce-pdf-invoices-packing-slips' ),
-			'value'          => trailingslashit(WPO_WCPDF()->main->get_tmp_path( 'dompdf' )),
-			'status'         => is_writable(WPO_WCPDF()->main->get_tmp_path( 'dompdf' )) ? 'ok' : 'failed',
-			'status_message' => is_writable(WPO_WCPDF()->main->get_tmp_path( 'dompdf' )) ? $status['ok'] : $status['failed'],
+			'value'          => trailingslashit( WPO_WCPDF()->main->get_tmp_path( 'dompdf' ) ),
+			'status'         => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'dompdf' ) ) ? 'ok' : 'failed',
+			'status_message' => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'dompdf' ) ) ? $status['ok'] : $status['failed'],
 		),
 		'DOMPDF_FONT_DIR' => array (
 			'description'    => __( 'DOMPDF fonts folder (needs to be writable for custom/remote fonts)', 'woocommerce-pdf-invoices-packing-slips' ),
-			'value'          => trailingslashit(WPO_WCPDF()->main->get_tmp_path( 'fonts' )),
-			'status'         => is_writable(WPO_WCPDF()->main->get_tmp_path( 'fonts' )) ? 'ok' : 'failed',
-			'status_message' => is_writable(WPO_WCPDF()->main->get_tmp_path( 'fonts' )) ? $status['ok'] : $status['failed'],
+			'value'          => trailingslashit( WPO_WCPDF()->main->get_tmp_path( 'fonts' ) ),
+			'status'         => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'fonts' ) ) ? 'ok' : 'failed',
+			'status_message' => $wp_filesystem->is_writable( WPO_WCPDF()->main->get_tmp_path( 'fonts' ) ) ? $status['ok'] : $status['failed'],
 		),
 	), $status );
 
@@ -214,7 +216,7 @@
 		?>
 		<tr>
 			<td><?php echo wp_kses_post( $permission['description'] ); ?></td>
-			<td><?php echo ! empty( $permission['value'] ) ? str_replace( array('/','\\' ), array('/<wbr>','\\<wbr>' ), wp_kses_post( $permission['value'] ) ) : ''; ?></td>
+			<td><?php echo ! empty( $permission['value'] ) ? wp_kses_post( str_replace( array( '/', '\\' ), array( '/<wbr>', '\\<wbr>' ), $permission['value'] ) ) : ''; ?></td>
 			<td style="background-color:<?php echo esc_attr( $background ); ?>; color:<?php echo esc_attr( $color ); ?>"><?php echo wp_kses_post( $permission['status_message'] ); ?></td>
 		</tr>
 		<?php } ?>
@@ -223,10 +225,11 @@
 		<tr>
 			<td colspan="3">
 				<?php
-					/* translators: 1,2. directory paths, 3. UPLOADS, 4. wpo_wcpdf_tmp_path, 5. attachments, 6. dompdf, 7. fonts */
-					printf( esc_attr__( 'The central temp folder is %1$s. By default, this folder is created in the WordPress uploads folder (%2$s), which can be defined by setting %3$s in wp-config.php. Alternatively, you can control the specific folder for PDF invoices by using the %4$s filter. Make sure this folder is writable and that the subfolders %5$s, %6$s and %7$s are present (these will be created by the plugin if the central temp folder is writable).', 'woocommerce-pdf-invoices-packing-slips' ),
-						'<code>'.WPO_WCPDF()->main->get_tmp_path().'</code>',
-						'<code>'.$upload_base.'</code>',
+					printf(
+						/* translators: 1,2. directory paths, 3. UPLOADS, 4. wpo_wcpdf_tmp_path, 5. attachments, 6. dompdf, 7. fonts */
+						esc_html__( 'The central temp folder is %1$s. By default, this folder is created in the WordPress uploads folder (%2$s), which can be defined by setting %3$s in wp-config.php. Alternatively, you can control the specific folder for PDF invoices by using the %4$s filter. Make sure this folder is writable and that the subfolders %5$s, %6$s and %7$s are present (these will be created by the plugin if the central temp folder is writable).', 'woocommerce-pdf-invoices-packing-slips' ),
+						'<code>' . wpo_wcpdf_escape_url_path_or_base64( WPO_WCPDF()->main->get_tmp_path() ) . '</code>', // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+						'<code>' . wpo_wcpdf_escape_url_path_or_base64( $upload_base ) . '</code>', // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 						'<code>UPLOADS</code>',
 						'<code>wpo_wcpdf_tmp_path</code>',
 						'<code>attachments</code>',
@@ -239,9 +242,10 @@
 		<tr>
 			<td colspan="3">
 				<?php
-					/* translators: directory path */
-					printf( esc_attr__('If the temporary folders were not automatically created by the plugin, verify that all the font files (from %s) are copied to the fonts folder. Normally, this is fully automated, but if your server has strict security settings, this automated copying may have been prohibited. In that case, you also need to make sure these folders get synchronized on plugin updates!', 'woocommerce-pdf-invoices-packing-slips' ),
-						'<code>'.WPO_WCPDF()->plugin_path() . "/vendor/dompdf/dompdf/lib/fonts/".'</code>'
+					printf(
+						/* translators: directory path */
+						esc_html__( 'If the temporary folders were not automatically created by the plugin, verify that all the font files (from %s) are copied to the fonts folder. Normally, this is fully automated, but if your server has strict security settings, this automated copying may have been prohibited. In that case, you also need to make sure these folders get synchronized on plugin updates!', 'woocommerce-pdf-invoices-packing-slips' ),
+						'<code>' . wpo_wcpdf_escape_url_path_or_base64( WPO_WCPDF()->plugin_path() . '/vendor/dompdf/dompdf/lib/fonts/' ) . '</code>' // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 					);
 				?>
 			</td>
diff --git a/views/advanced-tools.php b/views/advanced-tools.php
index eac648bfa..98ed4f0d9 100644
--- a/views/advanced-tools.php
+++ b/views/advanced-tools.php
@@ -5,11 +5,11 @@
 		<?php do_action( 'wpo_wcpdf_before_debug_tools', $this ); ?>
 		<!-- generate_random_string -->
 		<div class="tool">
-			<h4><?php _e( 'Generate random temporary directory', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'For security reasons, it is preferable to use a random name for the temporary directory.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Generate random temporary directory', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'For security reasons, it is preferable to use a random name for the temporary directory.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post">
 				<input type="hidden" name="debug_tool" value="generate_random_string">
-				<input type="submit" class="button button-secondary submit" value="<?php _e( 'Generate temporary directory', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+				<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Generate temporary directory', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
 				</fieldset>
@@ -18,11 +18,11 @@
 		<!-- /generate_random_string -->
 		<!-- install_fonts -->
 		<div class="tool">
-			<h4><?php _e( 'Reinstall plugin fonts', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'If you are experiencing issues with rendering fonts there might have been an issue during installation or upgrade.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Reinstall plugin fonts', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'If you are experiencing issues with rendering fonts there might have been an issue during installation or upgrade.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post">
 				<input type="hidden" name="debug_tool" value="install_fonts">
-				<input type="submit" class="button button-secondary submit" value="<?php _e( 'Reinstall fonts', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+				<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Reinstall fonts', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
 				</fieldset>
@@ -32,11 +32,11 @@
 		<!-- reschedule_yearly_reset -->
 		<?php if ( ! WPO_WCPDF()->settings->yearly_reset_action_is_scheduled() ) : ?>
 		<div class="tool">
-			<h4><?php _e( 'Reschedule the yearly reset of the numbering system', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( "You seem to have the yearly reset enabled for one of your documents but the action that performs this isn't scheduled yet.", 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Reschedule the yearly reset of the numbering system', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( "You seem to have the yearly reset enabled for one of your documents but the action that performs this isn't scheduled yet.", 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post" id="reschedule_yearly_reset">
 				<input type="hidden" name="debug_tool" value="reschedule_yearly_reset">
-				<input type="submit" class="button button-secondary submit" value="<?php _e( 'Reschedule yearly reset', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+				<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Reschedule yearly reset', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
 				</fieldset>
@@ -46,11 +46,11 @@
 		<!-- /reschedule_yearly_reset -->
 		<!-- clear_tmp -->
 		<div class="tool">
-			<h4><?php _e( 'Remove temporary files', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'Clean up the PDF files stored in the temporary folder (used for email attachments).', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Remove temporary files', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'Clean up the PDF files stored in the temporary folder (used for email attachments).', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post" id="clear_tmp">
 				<input type="hidden" name="debug_tool" value="clear_tmp">
-				<input type="submit" class="button button-secondary submit" value="<?php _e( 'Remove temporary files', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+				<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Remove temporary files', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
 				</fieldset>
@@ -59,11 +59,11 @@
 		<!-- /clear_tmp -->
 		<!-- clear_released_semaphore_locks -->
 		<div class="tool">
-			<h4><?php _e( 'Remove released semaphore locks', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'Clean up the released semaphore locks from the database. These locks prevent simultaneous document generation requests, ensuring correct document numbering. Once released, they are safe to remove.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Remove released semaphore locks', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'Clean up the released semaphore locks from the database. These locks prevent simultaneous document generation requests, ensuring correct document numbering. Once released, they are safe to remove.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post" id="clear_released_semaphore_locks">
 				<input type="hidden" name="debug_tool" value="clear_released_semaphore_locks">
-				<input type="submit" class="button button-secondary submit" value="<?php _e( 'Remove released locks', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+				<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Remove released locks', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
 				</fieldset>
@@ -72,23 +72,23 @@
 			<?php if ( $released_semaphore_locks > 0 ) : ?>
 				<div class="notice notice-warning inline">
 					<p>
-						<?php
-							printf(
-								/* translators: 1: number of released semaphore locks */
-								_n(
-									'There is %s released semaphore lock in the database.',
-									'There are %s released semaphore locks in the database.',
-									$released_semaphore_locks,
-									'woocommerce-pdf-invoices-packing-slips'
-								),
-								'<strong>' . $released_semaphore_locks . '</strong>'
-							);
-						?>
+					<?php
+						printf(
+							/* translators: 1: number of released semaphore locks */
+							esc_html( _n(
+								'There is %s released semaphore lock in the database.',
+								'There are %s released semaphore locks in the database.',
+								$released_semaphore_locks,
+								'woocommerce-pdf-invoices-packing-slips'
+							) ),
+							'<strong>' . esc_html( $released_semaphore_locks ) . '</strong>'
+						);
+					?>
 					</p>
 				</div>
 			<?php else : ?>
 				<div class="notice notice-success inline">
-					<p><?php _e( 'There are no released semaphore locks in the database.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+					<p><?php esc_html_e( 'There are no released semaphore locks in the database.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 				</div>
 			<?php endif; ?>
 			<?php $cleanup_action = \WPO\IPS\Semaphore::get_cleanup_action();  ?>
@@ -102,8 +102,8 @@
 
 							printf(
 								/* translators: 1: next run date */
-								__( 'The next cleanup action is scheduled to run on %s.', 'woocommerce-pdf-invoices-packing-slips' ),
-								'<strong>' . $next_run_date->format( 'Y-m-d H:i:s' ) . '</strong>'
+								esc_html__( 'The next cleanup action is scheduled to run on %s.', 'woocommerce-pdf-invoices-packing-slips' ),
+								'<strong>' . esc_html( $next_run_date->format( 'Y-m-d H:i:s' ) ) . '</strong>'
 							);
 						?>
 					</p>
@@ -117,11 +117,11 @@
 			if ( $released_legacy_semaphore_locks > 0 ) :
 		?>
 		<div class="tool">
-			<h4><?php _e( 'Remove released legacy semaphore locks', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'Clean up the released legacy semaphore locks from the database.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Remove released legacy semaphore locks', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'Clean up the released legacy semaphore locks from the database.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post" id="clear_released_legacy_semaphore_locks">
 				<input type="hidden" name="debug_tool" value="clear_released_legacy_semaphore_locks">
-				<input type="submit" class="button button-secondary submit" value="<?php _e( 'Remove released legacy locks', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+				<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Remove released legacy locks', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
 				</fieldset>
@@ -131,13 +131,13 @@
 					<?php
 						printf(
 							/* translators: 1: number of released legacy semaphore locks */
-							_n(
+							esc_html( _n(
 								'There is %s released legacy semaphore lock in the database.',
 								'There are %s released legacy semaphore locks in the database.',
 								$released_legacy_semaphore_locks,
 								'woocommerce-pdf-invoices-packing-slips'
-							),
-							'<strong>' . $released_legacy_semaphore_locks . '</strong>'
+							) ),
+							'<strong>' . esc_html( $released_legacy_semaphore_locks ) . '</strong>'
 						);
 					?>
 				</p>
@@ -147,15 +147,15 @@
 		<!-- /clear_released_legacy_semaphore_locks -->
 		<!-- run_wizard -->
 		<div class="tool">
-			<h4><?php _e( 'Run the Setup Wizard', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'Set up your basic invoice workflow via our Wizard.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Run the Setup Wizard', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'Set up your basic invoice workflow via our Wizard.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<a href="<?php echo esc_url( admin_url( 'admin.php?page=wpo-wcpdf-setup' ) ); ?>" class="button"><?php esc_html_e( 'Run the Setup Wizard', 'woocommerce-pdf-invoices-packing-slips' ); ?></a>
 		</div>
 		<!-- /run_wizard -->
 		<!-- export_settings -->
 		<div class="tool">
-			<h4><?php _e( 'Export Settings', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'Download plugin settings in JSON format to easily export your current setup.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Export Settings', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'Download plugin settings in JSON format to easily export your current setup.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post">
 				<input type="hidden" name="debug_tool" value="export_settings">
 				<fieldset>
@@ -163,12 +163,12 @@
 						<?php
 							foreach ( $this->get_setting_types() as $type => $name ) {
 								?>
-								<option value="<?php echo $type; ?>"><?php echo $name; ?></option>
+								<option value="<?php echo esc_attr( $type ); ?>"><?php echo esc_html( $name ); ?></option>
 								<?php
 							}
 						?>
 					</select>
-					<input type="submit" class="button button-secondary submit" value="<?php _e( 'Export', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+					<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Export', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				</fieldset>
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
@@ -178,13 +178,13 @@
 		<!-- /export_settings -->
 		<!-- import_settings -->
 		<div class="tool">
-			<h4><?php _e( 'Import Settings', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'Import plugin settings in JSON format.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Import Settings', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'Import plugin settings in JSON format.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post" enctype="multipart/form-data">
 				<input type="hidden" name="debug_tool" value="import_settings">
 				<fieldset>
 					<input type="file" name="file" accept="application/json" required>
-					<input type="submit" class="button button-secondary submit" value="<?php _e( 'Import', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+					<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Import', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				</fieldset>
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
@@ -194,8 +194,8 @@
 		<!-- /import_settings -->
 		<!-- reset_settings -->
 		<div class="tool">
-			<h4><?php _e( 'Reset Settings', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-			<p><?php _e( 'This will clear all your selected settings data. Please do a backup first using the export tool above.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+			<h4><?php esc_html_e( 'Reset Settings', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+			<p><?php esc_html_e( 'This will clear all your selected settings data. Please do a backup first using the export tool above.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 			<form method="post">
 				<input type="hidden" name="debug_tool" value="reset_settings">
 				<fieldset>
@@ -203,12 +203,12 @@
 						<?php
 							foreach ( $this->get_setting_types() as $type => $name ) {
 								?>
-								<option value="<?php echo $type; ?>"><?php echo $name; ?></option>
+								<option value="<?php echo esc_attr( $type ); ?>"><?php echo esc_html( $name ); ?></option>
 								<?php
 							}
 						?>
 					</select>
-					<input type="submit" class="button button-secondary submit" value="<?php _e( 'Reset', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+					<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Reset', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 				</fieldset>
 				<fieldset>
 					<div class="notice inline" style="display:none;"><p></p></div>
@@ -219,11 +219,11 @@
 		<?php if ( WPO_WCPDF()->settings->upgrade->are_any_extensions_installed() ) : ?>
 			<!-- clear_extensions_license_cache -->
 			<div class="tool">
-				<h4><?php _e( 'Clear extensions license caching', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-				<p><?php _e( 'This will clear all extensions\' license caching. This could be required to update the license status in the Upgrade tab or for new Cloud Storage activations (Professional extension).', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+				<h4><?php esc_html_e( 'Clear extensions license caching', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+				<p><?php esc_html_e( 'This will clear all extensions\' license caching. This could be required to update the license status in the Upgrade tab or for new Cloud Storage activations (Professional extension).', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 				<form method="post">
 					<input type="hidden" name="debug_tool" value="clear_extensions_license_cache">
-					<input type="submit" class="button button-secondary submit" value="<?php _e( 'Clear licenses cache', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+					<input type="submit" class="button button-secondary submit" value="<?php esc_html_e( 'Clear licenses cache', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 					<fieldset>
 						<div class="notice inline" style="display:none;"><p></p></div>
 					</fieldset>
@@ -248,18 +248,18 @@
 		<div id="danger_zone" class="wrapper">
 			<div class="tool">
 				<div class="notice notice-warning inline">
-					<p><?php _e( '<strong>DANGER ZONE:</strong> Create a backup before using these tools, the actions they perform are irreversible!', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+					<p><?php echo wp_kses_post( '<strong>DANGER ZONE:</strong> Create a backup before using these tools, the actions they perform are irreversible!', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 				</div>
 			</div>
 			<!-- renumber_documents -->
 			<div class="tool">
-				<h4><?php _e( 'Renumber existing documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-				<p><?php _e( 'This tool will renumber existing documents within the selected order date range, while keeping the assigned document date.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+				<h4><?php esc_html_e( 'Renumber existing documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+				<p><?php esc_html_e( 'This tool will renumber existing documents within the selected order date range, while keeping the assigned document date.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 				<p>
 					<?php
 						printf(
 							/* translators: step-by-step instructions */
-							__( 'Set the <strong>next document number</strong> setting %s to the number you want to use for the first document. ', 'woocommerce-pdf-invoices-packing-slips' ),
+							wp_kses_post( 'Set the <strong>next document number</strong> setting %s to the number you want to use for the first document. ', 'woocommerce-pdf-invoices-packing-slips' ),
 							'<code>WooCommerce > PDF Invoices > Documents > Select document</code>'
 						);
 					?>
@@ -267,40 +267,40 @@
 				<form method="post">
 					<table>
 						<tr>
-							<td><?php _e( 'Document type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><?php esc_html_e( 'Document type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
 							<td>
 								<select id="renumber-document-type" name="renumber-document-type">
-									<option value=""><?php _e( 'Select', 'woocommerce-pdf-invoices-packing-slips' ); ?>...</option>
+									<option value=""><?php esc_html_e( 'Select', 'woocommerce-pdf-invoices-packing-slips' ); ?>...</option>
 									<?php foreach ( $documents as $document ) : ?>
-										<option value="<?php echo $document->get_type(); ?>"><?php echo $document->get_title(); ?></option>
+										<option value="<?php echo esc_attr( $document->get_type() ); ?>"><?php echo esc_html( $document->get_title() ); ?></option>
 									<?php endforeach; ?>
 								</select>
 							</td>
 						</tr>
 						<tr>
-							<td><?php _e( 'Date type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><?php esc_html_e( 'Date type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
 							<td>
 								<select id="renumber-date-type" name="renumber-date-type">
 									<?php
 										foreach ( $date_types as $key => $label ) {
-											printf( '<option value="%s">%s</option>', $key, $label );
+											printf( '<option value="%s">%s</option>', esc_attr( $key ), esc_html( $label ) );
 										}
 									?>
 								</select>
 							</td>
 						</tr>
 						<tr>
-							<td><?php _e( 'From:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
-							<td><input type="text" id="renumber-date-from" name="renumber-date-from" value="<?php echo date( 'Y-m-d' ); ?>" size="10"><span class="add-info"><?php _e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
+							<td><?php esc_html_e( 'From:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><input type="text" id="renumber-date-from" name="renumber-date-from" value="<?php echo esc_html( gmdate( 'Y-m-d' ) ); ?>" size="10"><span class="add-info"><?php esc_html_e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
 						</tr>
 						<tr>
-							<td><?php _e( 'To:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
-							<td><input type="text" id="renumber-date-to" name="renumber-date-to" value="<?php echo date( 'Y-m-d' ); ?>" size="10"><span class="add-info"><?php _e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
+							<td><?php esc_html_e( 'To:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><input type="text" id="renumber-date-to" name="renumber-date-to" value="<?php echo esc_html( gmdate( 'Y-m-d' ) ); ?>" size="10"><span class="add-info"><?php esc_html_e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
 						</tr>
 						<tr>
 							<td>&nbsp;</td>
 							<td>
-								<button class="button button-large number-tools-btn" id="renumber-documents-btn"><?php _e( 'Renumber documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></button>
+								<button class="button button-large number-tools-btn" id="renumber-documents-btn"><?php esc_html_e( 'Renumber documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></button>
 								<div class="spinner renumber-spinner"></div>
 							</td>
 						</tr>
@@ -310,46 +310,46 @@
 			<!-- /renumber_documents -->
 			<!-- delete_documents -->
 			<div class="tool">
-				<h4><?php _e( 'Delete existing documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
-				<p><?php _e( 'This tool will delete existing documents within the selected order date range.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+				<h4><?php esc_html_e( 'Delete existing documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></h4>
+				<p><?php esc_html_e( 'This tool will delete existing documents within the selected order date range.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
 				<form method="post">
 					<table>
 						<tr>
-							<td><?php _e( 'Document type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><?php esc_html_e( 'Document type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
 							<td>
 								<select id="delete-document-type" name="delete-document-type">
-									<option value=""><?php _e( 'Select', 'woocommerce-pdf-invoices-packing-slips' ); ?>...</option>
+									<option value=""><?php esc_html_e( 'Select', 'woocommerce-pdf-invoices-packing-slips' ); ?>...</option>
 									<?php foreach ( $documents as $document ) : ?>
-										<option value="<?php echo $document->get_type(); ?>"><?php echo $document->get_title(); ?></option>
+										<option value="<?php echo esc_attr( $document->get_type() ); ?>"><?php echo esc_html( $document->get_title() ); ?></option>
 									<?php endforeach; ?>
-									<option value="all"><?php _e( 'All', 'woocommerce-pdf-invoices-packing-slips' ); ?></option>
+									<option value="all"><?php esc_html_e( 'All', 'woocommerce-pdf-invoices-packing-slips' ); ?></option>
 								</select>
 							</td>
 						</tr>
 						<tr>
-							<td><?php _e( 'Date type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><?php esc_html_e( 'Date type:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
 							<td>
 								<select id="delete-date-type" name="delete-date-type">
 									<?php
 										foreach ( $date_types as $key => $label ) {
-											printf( '<option value="%s">%s</option>', $key, $label );
+											printf( '<option value="%s">%s</option>', esc_attr( $key ), esc_html( $label ) );
 										}
 									?>
 								</select>
 							</td>
 						</tr>
 						<tr>
-							<td><?php _e( 'From:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
-							<td><input type="text" id="delete-date-from" name="delete-date-from" value="<?php echo date( 'Y-m-d' ); ?>" size="10"><span class="add-info"><?php _e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
+							<td><?php esc_html_e( 'From:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><input type="text" id="delete-date-from" name="delete-date-from" value="<?php echo esc_html( gmdate( 'Y-m-d' ) ); ?>" size="10"><span class="add-info"><?php esc_html_e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
 						</tr>
 						<tr>
-							<td><?php _e( 'To:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
-							<td><input type="text" id="delete-date-to" name="delete-date-to" value="<?php echo date( 'Y-m-d' ); ?>" size="10"><span class="add-info"><?php _e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
+							<td><?php esc_html_e( 'To:', 'woocommerce-pdf-invoices-packing-slips' ); ?></td>
+							<td><input type="text" id="delete-date-to" name="delete-date-to" value="<?php echo esc_html( gmdate( 'Y-m-d' ) ); ?>" size="10"><span class="add-info"><?php esc_html_e( '(as: yyyy-mm-dd)', 'woocommerce-pdf-invoices-packing-slips' ); ?></span></td>
 						</tr>
 						<tr>
 							<td>&nbsp;</td>
 							<td>
-								<button class="button button-large number-tools-btn" id="delete-documents-btn"><?php _e( 'Delete documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></button>
+								<button class="button button-large number-tools-btn" id="delete-documents-btn"><?php esc_html_e( 'Delete documents', 'woocommerce-pdf-invoices-packing-slips' ); ?></button>
 								<div class="spinner delete-spinner"></div>
 							</td>
 						</tr>
diff --git a/views/attachment-settings-hint.php b/views/attachment-settings-hint.php
index 19f1c6675..bf3cfcea6 100644
--- a/views/attachment-settings-hint.php
+++ b/views/attachment-settings-hint.php
@@ -8,7 +8,7 @@
 <div class="wcpdf-attachment-settings-hint notice inline">
 	<p>
 		<?php /* translators: <a> tags */ ?>
-		<?php printf( wp_kses_post( __( 'It looks like you haven\'t setup any email attachments yet, check the settings under <b>%1$sDocuments > Invoice%2$s</b>', 'woocommerce-pdf-invoices-packing-slips' ) ), '<a href="'.$invoice_settings_url.'">', '</a>' ); ?>
+		<?php printf( wp_kses_post( __( 'It looks like you haven\'t setup any email attachments yet, check the settings under <b>%1$sDocuments > Invoice%2$s</b>', 'woocommerce-pdf-invoices-packing-slips' ) ), '<a href="' . esc_url( $invoice_settings_url ) . '">', '</a>' ); ?>
 		<?php printf( '<a href="%s" style="display:block; margin-top:10px;">%s</a>', esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_attachments_hint', 'true' ), 'hide_attachments_hint_nonce' ) ), esc_html__( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ) ); ?>
 	</p>
 </div>
diff --git a/views/extensions.php b/views/extensions.php
index 37305776c..99de3f070 100644
--- a/views/extensions.php
+++ b/views/extensions.php
@@ -98,7 +98,7 @@
 		<?php
 		if ( ! class_exists( 'WooCommerce_PDF_IPS_Templates' ) && ! class_exists( 'WPO_WCPDF_Templates' ) && ! $no_pro ) {
 			$template_link = '<a href="https://wpovernight.com/downloads/woocommerce-pdf-invoices-packing-slips-premium-templates/" target="_blank">wpovernight.com</a>';
-			$email_link = '<a href="mailto:support@wpovernight.com">support@wpovernight.com</a>'
+			$email_link    = '<a href="mailto:support@wpovernight.com">support@wpovernight.com</a>'
 			?>
 			<li>
 				<?php esc_html_e( 'Advanced, customizable templates', 'woocommerce-pdf-invoices-packing-slips' ); ?>
@@ -106,10 +106,24 @@
 				<ul>
 					<li><?php esc_html_e( 'Completely customize the invoice contents (prices, taxes, thumbnails) to your needs with a drag & drop customizer', 'woocommerce-pdf-invoices-packing-slips' ); ?></li>
 					<li><?php esc_html_e( 'Two extra stylish premade templates (Modern & Business)', 'woocommerce-pdf-invoices-packing-slips' ); ?></li>
-					<?php /* translators: Premium Templates link */?>
-					<li><?php printf( esc_html__( "Check out the Premium PDF Invoice & Packing Slips templates at %s.", 'woocommerce-pdf-invoices-packing-slips' ), $template_link ); ?></li>
-					<?php /* translators: email link */?>
-					<li><?php printf( esc_html__( "For custom templates, contact us at %s.", 'woocommerce-pdf-invoices-packing-slips' ), $email_link ); ?></li>
+					<li>
+						<?php
+							printf(
+								/* translators: Premium Templates link */
+								esc_html__( 'Check out the Premium PDF Invoice & Packing Slips templates at %s.', 'woocommerce-pdf-invoices-packing-slips' ),
+								esc_url( $template_link )
+							);
+						?>
+					</li>
+					<li>
+						<?php
+							printf(
+								/* translators: email link */
+								esc_html__( 'For custom templates, contact us at %s.', 'woocommerce-pdf-invoices-packing-slips' ),
+								esc_url( $email_link )
+							);
+						?>
+					</li>
 				</ul>
 				</div>
 			</li>
diff --git a/views/promo.php b/views/promo.php
index 579355a75..b3516903f 100644
--- a/views/promo.php
+++ b/views/promo.php
@@ -10,7 +10,7 @@
 
 	if ( isset( $_REQUEST['wpo_wcpdf_hide_promo_ad'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 		// validate nonce
-		if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'hide_promo_ad_nonce' ) ) {
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'hide_promo_ad_nonce' ) ) {
 			wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_hide_promo_ad' );
 		} else {
 			update_option( 'wpo_wcpdf_hide_promo_ad', true );
diff --git a/views/settings-page.php b/views/settings-page.php
index 866077dca..6eac81d5b 100644
--- a/views/settings-page.php
+++ b/views/settings-page.php
@@ -1,12 +1,19 @@
 <?php defined( 'ABSPATH' ) or exit; ?>
 <?php
-$review_url = 'https://wordpress.org/support/plugin/woocommerce-pdf-invoices-packing-slips/reviews/#new-post';
-$review_link = sprintf( '<a href="%s">★★★★★</a>', $review_url );
+
+if ( ! wp_verify_nonce( $nonce, 'wp_wcpdf_settings_page_nonce' ) ) {
+	wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'woocommerce-pdf-invoices-packing-slips' ) );
+}
+
+$review_url        = 'https://wordpress.org/support/plugin/woocommerce-pdf-invoices-packing-slips/reviews/#new-post';
+$review_link       = sprintf( '<a href="%s">★★★★★</a>', $review_url );
 $review_invitation = sprintf(
 	/* translators: ★★★★★ (5-star) */
 	__( 'If you like <strong>PDF Invoices & Packing Slips for WooCommerce</strong> please leave us a %s rating. A huge thank you in advance!', 'woocommerce-pdf-invoices-packing-slips' ),
 	$review_link
 );
+$active_tab        = isset( $_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : $default_tab;
+$active_section    = isset( $_GET['section'] ) ? sanitize_text_field( wp_unslash( $_GET['section'] ) ) : '';
 ?>
 <script type="text/javascript">
 	jQuery( function( $ ) {
@@ -25,18 +32,24 @@
 		if ( $tab_beta ) {
 			$tab_title .= ' <sup class="wcpdf_beta">beta</sup>';
 		}
-		printf( '<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>', $tab_link, esc_attr( $tab_slug ), ( ( $active_tab == $tab_slug ) ? 'nav-tab-active' : '' ), $tab_title );
+		printf(
+			'<a href="%1$s" class="nav-tab nav-tab-%2$s %3$s">%4$s</a>',
+			esc_url( $tab_link ),
+			esc_attr( $tab_slug ),
+			( ( $active_tab === $tab_slug ) ? 'nav-tab-active' : '' ),
+			wp_kses_post( $tab_title )
+		);
 	}
 	?>
 	</h2>
 
 	<?php
-	do_action( 'wpo_wcpdf_before_settings_page', $active_tab, $active_section );
+	do_action( 'wpo_wcpdf_before_settings_page', $active_tab, $active_section, $nonce );
 
 	// save or check option to hide extensions ad
 	if ( isset( $_REQUEST['wpo_wcpdf_hide_extensions_ad'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 		// validate nonce
-		if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'hide_extensions_ad_nonce' ) ) {
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'hide_extensions_ad_nonce' ) ) {
 			wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_hide_extensions_ad' );
 			$hide_ad = false;
 		} else {
@@ -66,9 +79,9 @@
 				<form method="post" action="options.php" id="wpo-wcpdf-settings" class="<?php echo esc_attr( "{$active_tab} {$active_section}" ); ?>">
 			<?php endif; ?>
 				<?php
-					do_action( 'wpo_wcpdf_before_settings', $active_tab, $active_section );
+					do_action( 'wpo_wcpdf_before_settings', $active_tab, $active_section, $nonce );
 					if ( has_action( "wpo_wcpdf_settings_output_{$active_tab}" ) ) {
-						do_action( "wpo_wcpdf_settings_output_{$active_tab}", $active_section );
+						do_action( "wpo_wcpdf_settings_output_{$active_tab}", $active_section, $nonce );
 					} else {
 						// legacy settings
 						settings_fields( "wpo_wcpdf_{$active_tab}_settings" );
@@ -76,12 +89,12 @@
 
 						submit_button();
 					}
-					do_action( 'wpo_wcpdf_after_settings', $active_tab, $active_section );
+					do_action( 'wpo_wcpdf_after_settings', $active_tab, $active_section, $nonce );
 				?>
 			<?php if ( ! in_array( $active_section, $excluded_sections ) ) : ?>
 				</form>
 			<?php endif; ?>
-			<?php do_action( 'wpo_wcpdf_after_settings_form', $active_tab, $active_section ); ?>
+			<?php do_action( 'wpo_wcpdf_after_settings_form', $active_tab, $active_section, $nonce ); ?>
 		</div>
 
 		<div class="gutter">
@@ -95,17 +108,17 @@
 				$document_type = 'invoice';
 
 				if ( ! empty( $_REQUEST['section'] ) ) {
-					$document_type = sanitize_text_field( $_REQUEST['section'] );
+					$document_type = sanitize_text_field( wp_unslash( $_REQUEST['section'] ) );
 				} elseif ( ! empty( $_REQUEST['preview'] ) ) {
-					$document_type = sanitize_text_field( $_REQUEST['preview'] );
+					$document_type = sanitize_text_field( wp_unslash( $_REQUEST['preview'] ) );
 				}
 			?>
 			<div class="preview-data-wrapper">
 				<div class="save-settings"><?php submit_button(); ?></div>
 				<div class="preview-data preview-order-data">
 					<div class="preview-order-search-wrapper">
-						<input type="text" name="preview-order-search" id="preview-order-search" placeholder="<?php esc_html_e( 'ID, email or name', 'woocommerce-pdf-invoices-packing-slips' ); ?>" data-nonce="<?= wp_create_nonce( 'wpo_wcpdf_preview' ); ?>">
-						<img class="preview-order-search-clear" src="<?php echo WPO_WCPDF()->plugin_url().'/assets/images/reset-input.svg'; ?>" alt="<?php esc_html_e( 'Clear search text', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
+						<input type="text" name="preview-order-search" id="preview-order-search" placeholder="<?php esc_html_e( 'ID, email or name', 'woocommerce-pdf-invoices-packing-slips' ); ?>" data-nonce="<?php echo esc_attr( wp_create_nonce( 'wpo_wcpdf_preview' ) ); ?>">
+						<img class="preview-order-search-clear" src="<?php echo esc_url( WPO_WCPDF()->plugin_url() . '/assets/images/reset-input.svg' ); ?>" alt="<?php esc_html_e( 'Clear search text', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
 					</div>
 					<p class="last-order"><?php esc_html_e( 'Currently showing last order', 'woocommerce-pdf-invoices-packing-slips' ); ?><span class="arrow-down">&#9660;</span></p>
 					<p class="order-search"><span class="order-search-label"><?php esc_html_e( 'Search for an order', 'woocommerce-pdf-invoices-packing-slips' ); ?></span><span class="arrow-down">&#9660;</span></p>
@@ -124,29 +137,33 @@
 								echo '<p class="current"><span class="current-label">'.esc_html( $document->get_title() ).'</span><span class="arrow-down">&#9660;</span></p>';
 							}
 						} else {
-							echo '<p class="current"><span class="current-label">'.__( 'Invoice', 'woocommerce-pdf-invoices-packing-slips' ).'</span><span class="arrow-down">&#9660;</span></p>';
+							echo '<p class="current"><span class="current-label">'.esc_html__( 'Invoice', 'woocommerce-pdf-invoices-packing-slips' ).'</span><span class="arrow-down">&#9660;</span></p>';
 						}
 					?>
 					<ul class="preview-data-option-list" data-input-name="document_type">
 						<?php
 							foreach ( $documents as $document ) {
-								/* translators: 1. document type, 2. document title */
-								printf( '<li data-value="%1$s">%2$s</li>', $document->get_type(), $document->get_title() );
+								printf(
+									/* translators: 1. document type, 2. document title */
+									'<li data-value="%1$s">%2$s</li>',
+									esc_attr( $document->get_type() ),
+									esc_html( $document->get_title() )
+								);
 							}
 						?>
 					</ul>
 				</div>
 				<?php endif; ?>
 			</div>
-			<input type="hidden" name="document_type" data-default="<?php esc_attr_e( $document_type ); ?>" value="<?php esc_attr_e( $document_type ); ?>">
-			<input type="hidden" name="output_format" value="<?php echo ( isset( $_REQUEST['output_format'] ) && ! empty( $_REQUEST['output_format'] ) ) ? esc_attr( $_REQUEST['output_format'] ) : 'pdf'; ?>">
+			<input type="hidden" name="document_type" data-default="<?php echo esc_attr( $document_type ); ?>" value="<?php echo esc_attr( $document_type ); ?>">
+			<input type="hidden" name="output_format" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( ( isset( $_REQUEST['output_format'] ) && ! empty( $_REQUEST['output_format'] ) ) ? $_REQUEST['output_format'] : 'pdf' ) ) ); ?>">
 			<input type="hidden" name="order_id" value="">
-			<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'wpo_wcpdf_preview' ); ?>">
+			<input type="hidden" name="nonce" value="<?php echo esc_attr( wp_create_nonce( 'wpo_wcpdf_preview' ) ); ?>">
 			<div class="preview"></div>
 		</div>
 
 	</div>
 
-	<?php do_action( 'wpo_wcpdf_after_settings_page', $active_tab, $active_section ); ?>
+	<?php do_action( 'wpo_wcpdf_after_settings_page', $active_tab, $active_section, $nonce ); ?>
 
 </div>
diff --git a/views/upgrade-table.php b/views/upgrade-table.php
index b2838987d..3b3fd842c 100644
--- a/views/upgrade-table.php
+++ b/views/upgrade-table.php
@@ -26,8 +26,8 @@
 
 	<?php
 	foreach ( $features as $feature ) {
-		echo '<tr><td class="first feature-label">' . $feature['label'];
-		echo ! empty( $feature['description'] ) ? '<br><span class="description">' . $feature['description'] . '</span></td>' : '</td>';
+		echo '<tr><td class="first feature-label">' . esc_html( $feature['label'] );
+		echo ! empty( $feature['description'] ) ? '<br><span class="description">' . wp_kses_post( $feature['description'] ) . '</span></td>' : '</td>';
 		foreach ( ['pro', 'templates', 'bundle'] as $extension ) {
 			echo in_array( $extension, $feature['extensions'] ) ? '<td class="' . $extension . '"><span class="feature-available"></span></td>' : '<td class="' . $extension . '">-</td>';
 		}
@@ -125,7 +125,7 @@
 			echo '<style>' . $styles . '</style>';
 
 			foreach ( $extension_columns as $column ) {
-				echo $column;
+				echo wp_kses_post( $column );
 			}
 
 		?>
@@ -137,8 +137,8 @@
 	<h1><?php esc_html_e( 'You might also like these plugins...', 'woocommerce-pdf-invoices-packing-slips' ); ?></h1>
 	<?php
 	if ( count( array_column( $sorted_plugin_recommendations, 'installed' ) ) === count( $sorted_plugin_recommendations ) ) {
-		printf( '<p>%s</p>', __( 'Wow! It looks like you own all of our recommendations. Check out our shop for even more plugins.', 'woocommerce-pdf-invoices-packing-slips' ) );
-		printf( '<a class="upgrade_button" target="_blank" href="%s">%s</a>', 'https://wpovernight.com/shop/', __( 'Visit shop', 'woocommerce-pdf-invoices-packing-slips' ) );
+		printf( '<p>%s</p>', esc_html__( 'Wow! It looks like you own all of our recommendations. Check out our shop for even more plugins.', 'woocommerce-pdf-invoices-packing-slips' ) );
+		printf( '<a class="upgrade_button" target="_blank" href="%s">%s</a>', 'https://wpovernight.com/shop/', esc_html__( 'Visit shop', 'woocommerce-pdf-invoices-packing-slips' ) );
 	}
 	?>
 	<div class="card-container">
@@ -146,15 +146,15 @@
 		foreach ( $sorted_plugin_recommendations as $plugin ) {
 			?>
 			<div class="<?php echo isset( $plugin['installed'] ) ? 'recommendation-card currently-installed' : 'recommendation-card'; ?>">
-				<img src="<?php echo $plugin['thumbnail']; ?>" alt="<?php echo $plugin['title']; ?>">
+				<img src="<?php echo esc_url( $plugin['thumbnail'] ); ?>" alt="<?php echo esc_html( $plugin['title'] ); ?>">
 				<div class="card-content">
-					<h5><?php echo $plugin['title']; ?></h5>
-					<p><?php echo $plugin['description']; ?></p>
-					<?php 
+					<h5><?php echo esc_html( $plugin['title'] ); ?></h5>
+					<p><?php echo esc_html( $plugin['description'] ); ?></p>
+					<?php
 					if ( isset( $plugin['installed'] ) ) {
-						printf( '<span class="currently-installed">%s</span>', __( 'Currently installed', 'woocommerce-pdf-invoices-packing-slips' ) );
+						printf( '<span class="currently-installed">%s</span>', esc_html__( 'Currently installed', 'woocommerce-pdf-invoices-packing-slips' ) );
 					} else {
-						printf( '<a class="upgrade_button" target="_blank" href="%s">%s</a>', $plugin['url'], __( 'Buy now', 'woocommerce-pdf-invoices-packing-slips' ) );
+						printf( '<a class="upgrade_button" target="_blank" href="%s">%s</a>', esc_url( $plugin['url'] ), esc_html__( 'Buy now', 'woocommerce-pdf-invoices-packing-slips' ) );
 					}
 					?>
 				</div>
@@ -163,4 +163,4 @@
 		}
 	?>
 	</div>
-</div>
\ No newline at end of file
+</div>
diff --git a/woocommerce-pdf-invoices-packingslips.php b/woocommerce-pdf-invoices-packingslips.php
index 932a6b04c..d75b24e42 100644
--- a/woocommerce-pdf-invoices-packingslips.php
+++ b/woocommerce-pdf-invoices-packingslips.php
@@ -4,7 +4,7 @@
  * Requires Plugins:     woocommerce
  * Plugin URI:           https://wpovernight.com/downloads/woocommerce-pdf-invoices-packing-slips-bundle/
  * Description:          Create, print & email PDF or UBL Invoices & PDF Packing Slips for WooCommerce orders.
- * Version:              3.9.6
+ * Version:              4.0.0-beta-1
  * Author:               WP Overnight
  * Author URI:           https://www.wpovernight.com
  * License:              GPLv2 or later
@@ -22,7 +22,7 @@
 
 class WPO_WCPDF {
 
-	public $version              = '3.9.6';
+	public $version              = '4.0.0-beta-1';
 	public $version_php          = '7.4';
 	public $version_woo          = '3.3';
 	public $version_wp           = '4.4';
@@ -332,12 +332,12 @@ public function nginx_detected()
 			ob_start();
 			?>
 			<div class="error">
-				<img src="<?php echo $this->plugin_url() . '/assets/images/nginx.svg'; ?>" style="margin-top:10px;">
+				<img src="<?php echo esc_url( $this->plugin_url() . '/assets/images/nginx.svg' ); ?>" style="margin-top:10px;">
 				<?php /* translators: directory path */ ?>
-				<p><?php printf( __( 'The PDF files in %s are not currently protected due to your site running on <strong>NGINX</strong>.', 'woocommerce-pdf-invoices-packing-slips' ), '<strong>' . $tmp_path . '</strong>' ); ?></p>
-				<p><?php _e( 'To protect them, you must click the button below.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
-				<p><a class="button" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_protect_pdf_directory', 'true' ), 'protect_pdf_directory_nonce' ) ); ?>"><?php _e( 'Generate random temporary folder name', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
-				<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_nginx_notice', 'true' ), 'hide_nginx_notice_nonce' ) ); ?>"><?php _e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+				<p><?php printf( esc_html__( 'The PDF files in %s are not currently protected due to your site running on <strong>NGINX</strong>.', 'woocommerce-pdf-invoices-packing-slips' ), '<strong>' . wpo_wcpdf_escape_url_path_or_base64( $tmp_path ) . '</strong>' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></p>
+				<p><?php esc_html_e( 'To protect them, you must click the button below.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+				<p><a class="button" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_protect_pdf_directory', 'true' ), 'protect_pdf_directory_nonce' ) ); ?>"><?php esc_html_e( 'Generate random temporary folder name', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+				<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_nginx_notice', 'true' ), 'hide_nginx_notice_nonce' ) ); ?>"><?php esc_html_e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
 			</div>
 			<?php
 
@@ -347,7 +347,7 @@ public function nginx_detected()
 		// protect PDF directory
 		if ( isset( $_REQUEST['wpo_wcpdf_protect_pdf_directory'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 			// validate nonce
-			if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'protect_pdf_directory_nonce' ) ) {
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'protect_pdf_directory_nonce' ) ) {
 				wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_protect_pdf_directory' );
 				wp_redirect( 'admin.php?page=wpo_wcpdf_options_page' );
 				exit;
@@ -366,7 +366,7 @@ public function nginx_detected()
 		// save option to hide nginx notice
 		if ( isset( $_REQUEST['wpo_wcpdf_hide_nginx_notice'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 			// validate nonce
-			if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'hide_nginx_notice_nonce' ) ) {
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'hide_nginx_notice_nonce' ) ) {
 				wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_hide_nginx_notice' );
 				wp_redirect( 'admin.php?page=wpo_wcpdf_options_page' );
 				exit;
@@ -392,11 +392,11 @@ public function mailpoet_mta_detected() {
 				ob_start();
 				?>
 				<div class="error">
-					<img src="<?php echo $this->plugin_url() . "/assets/images/mailpoet.svg"; ?>" style="margin-top:10px;">
-					<p><?php _e( 'When sending emails with MailPoet 3 and the active sending method is <strong>MailPoet Sending Service</strong> or <strong>Your web host / web server</strong>, MailPoet does not include the <strong>PDF Invoices & Packing Slips for WooCommerce</strong> attachments in the emails.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
-					<p><?php _e( 'To fix this you should select <strong>The default WordPress sending method (default)</strong> on the <strong>Advanced tab</strong>.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
-					<p><a class="button" href="<?php echo esc_url( admin_url( 'admin.php?page=mailpoet-settings#/advanced' ) ); ?>"><?php _e( 'Change MailPoet sending method to WordPress (default)', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
-					<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_mailpoet_notice', 'true' ), 'hide_mailpoet_notice_nonce' ) ); ?>"><?php _e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+					<img src="<?php echo esc_url( $this->plugin_url() . '/assets/images/mailpoet.svg' ); ?>" style="margin-top:10px;">
+					<p><?php echo wp_kses_post( 'When sending emails with MailPoet 3 and the active sending method is <strong>MailPoet Sending Service</strong> or <strong>Your web host / web server</strong>, MailPoet does not include the <strong>PDF Invoices & Packing Slips for WooCommerce</strong> attachments in the emails.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+					<p><?php echo wp_kses_post( 'To fix this you should select <strong>The default WordPress sending method (default)</strong> on the <strong>Advanced tab</strong>.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+					<p><a class="button" href="<?php echo esc_url( admin_url( 'admin.php?page=mailpoet-settings#/advanced' ) ); ?>"><?php esc_html_e( 'Change MailPoet sending method to WordPress (default)', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+					<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_mailpoet_notice', 'true' ), 'hide_mailpoet_notice_nonce' ) ); ?>"><?php esc_html_e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
 				</div>
 				<?php
 				echo wp_kses_post( ob_get_clean() );
@@ -406,7 +406,7 @@ public function mailpoet_mta_detected() {
 		// save option to hide mailpoet notice
 		if ( isset( $_REQUEST['wpo_wcpdf_hide_mailpoet_notice'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 			// validate nonce
-			if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'hide_mailpoet_notice_nonce' ) ) {
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'hide_mailpoet_notice_nonce' ) ) {
 				wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_hide_mailpoet_notice' );
 				wp_redirect( 'admin.php?page=wpo_wcpdf_options_page' );
 				exit;
@@ -432,9 +432,9 @@ public function rtl_detected() {
 			ob_start();
 			?>
 			<div class="notice notice-warning">
-				<p><?php _e( 'PDF Invoices & Packing Slips for WooCommerce detected that your current site locale is right-to-left (RTL) which the current PDF engine does not support it. Please consider installing our mPDF extension that is compatible.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
-				<p><a class="button" href="<?php echo esc_url( 'https://github.com/wpovernight/woocommerce-pdf-ips-mpdf/releases/latest' ); ?>" target="_blank"><?php _e( 'Download mPDF extension', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
-				<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_rtl_notice', 'true' ), 'hide_rtl_notice_nonce' ) ); ?>"><?php _e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+				<p><?php esc_html_e( 'PDF Invoices & Packing Slips for WooCommerce detected that your current site locale is right-to-left (RTL) which the current PDF engine does not support it. Please consider installing our mPDF extension that is compatible.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
+				<p><a class="button" href="<?php echo esc_url( 'https://github.com/wpovernight/woocommerce-pdf-ips-mpdf/releases/latest' ); ?>" target="_blank"><?php esc_html_e( 'Download mPDF extension', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+				<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'wpo_wcpdf_hide_rtl_notice', 'true' ), 'hide_rtl_notice_nonce' ) ); ?>"><?php esc_html_e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
 			</div>
 			<?php
 			echo wp_kses_post( ob_get_clean() );
@@ -443,7 +443,7 @@ public function rtl_detected() {
 		// save option to hide notice
 		if ( isset( $_REQUEST['wpo_wcpdf_hide_rtl_notice'] ) && isset( $_REQUEST['_wpnonce'] ) ) {
 			// validate nonce
-			if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'hide_rtl_notice_nonce' ) ) {
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'hide_rtl_notice_nonce' ) ) {
 				wcpdf_log_error( 'You do not have sufficient permissions to perform this action: wpo_wcpdf_hide_rtl_notice' );
 				wp_redirect( 'admin.php?page=wpo_wcpdf_options_page' );
 				exit;
@@ -534,7 +534,7 @@ public function plugin_is_activated( $filename ) {
 		$active_plugin  = '';
 
 		foreach ( $active_plugins as $plugin ) {
-			if ( false !== strpos( $plugin, $filename ) ) {
+			if ( ! empty( $plugin ) && false !== strpos( $plugin, $filename ) ) {
 				$active_plugin = $plugin;
 				break;
 			}
@@ -563,12 +563,12 @@ public function legacy_addon_notices() {
 						<?php
 							printf(
 								/* translators: legacy addon name */
-								__( 'While updating the PDF Invoices & Packing Slips for WooCommerce plugin we\'ve noticed our legacy %s add-on was active on your site. This functionality is now incorporated into the core plugin. We\'ve deactivated the add-on for you, and you are free to uninstall it.', 'woocommerce-pdf-invoices-packing-slips' ),
+								esc_html__( 'While updating the PDF Invoices & Packing Slips for WooCommerce plugin we\'ve noticed our legacy %s add-on was active on your site. This functionality is now incorporated into the core plugin. We\'ve deactivated the add-on for you, and you are free to uninstall it.', 'woocommerce-pdf-invoices-packing-slips' ),
 								'<strong>' . esc_attr( $name ) . '</strong>'
 							);
 						?>
 					</p>
-					<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( $query_arg => true ) ), 'wcpdf_legacy_addon_notice' ) ); ?>"><?php _e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
+					<p><a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( $query_arg => true ) ), 'wcpdf_legacy_addon_notice' ) ); ?>"><?php esc_html_e( 'Hide this message', 'woocommerce-pdf-invoices-packing-slips' ); ?></a></p>
 				</div>
 				<?php
 				echo wp_kses_post( ob_get_clean() );
@@ -576,7 +576,7 @@ public function legacy_addon_notices() {
 
 			// save option to hide legacy addon notice
 			if ( isset( $_REQUEST[ $query_arg ] ) && isset( $_REQUEST['_wpnonce'] ) ) {
-				if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'wcpdf_legacy_addon_notice' ) ) {
+				if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'wcpdf_legacy_addon_notice' ) ) {
 					wcpdf_log_error( 'You do not have sufficient permissions to perform this action: ' . $query_arg );
 				} else {
 					delete_transient( $transient_name );
diff --git a/wpo-ips-functions.php b/wpo-ips-functions.php
index 2be30fce5..1d347d1b9 100644
--- a/wpo-ips-functions.php
+++ b/wpo-ips-functions.php
@@ -275,7 +275,7 @@ function wcpdf_get_document_file( object $document, string $output_format = 'pdf
 		return wcpdf_error_handling( $error_message, $error_handling, true, 'critical' );
 	}
 
-	$function = "get_document_{$output_format}_attachment";
+	$function = "get_document_{$output_format}_attachment"; // 'get_document_pdf_attachment' or 'get_document_ubl_attachment'
 
 	if ( ! is_callable( array( WPO_WCPDF()->main, $function ) ) ) {
 		$error_message = "The {$function} method is not callable on WPO_WCPDF()->main.";
@@ -330,10 +330,9 @@ function wcpdf_deprecated_function( $function, $version, $replacement = null ) {
 		do_action( 'deprecated_function_run', $function, $replacement, $version );
 		$log_string  = "The {$function} function is deprecated since version {$version}.";
 		$log_string .= $replacement ? " Replace with {$replacement}." : '';
-		error_log( $log_string );
 		wcpdf_log_error( $log_string, 'warning' );
 	} else {
-		_deprecated_function( $function, $version, $replacement );
+		_deprecated_function( esc_html( $function ), esc_html( $version ), esc_html( $replacement ) );
 	}
 }
 
@@ -363,7 +362,7 @@ function wcpdf_log_error( $message, $level = 'error', $e = null ) {
 		// emergency - 'System is unusable'.
 		$logger->log( $level, $message, $context );
 	} else {
-		error_log( "WCPDF error ({$level}): {$message}" );
+		wcpdf_log_error( "WCPDF error ({$level}): {$message}", 'warning' );
 	}
 }
 
@@ -402,7 +401,7 @@ function wcpdf_error_handling( string $message, string $handling_type = 'excepti
 
 	switch ( $handling_type ) {
 		case 'exception':
-			throw new \Exception( $message );
+			throw new \Exception( esc_html( $message ) );
 			break;
 		case 'output':
 			wcpdf_output_error( $message, $log_level );
@@ -682,7 +681,7 @@ function wcpdf_safe_redirect_or_die( $url = '', $message = '' ) {
 		wp_safe_redirect( $url );
 		exit;
 	} else {
-		wp_die( $message );
+		wp_die( esc_html( $message ) );
 	}
 }
 
@@ -794,10 +793,12 @@ function wpo_wcpdf_get_image_mime_type( string $src ): string {
 
 	// Fetch the actual image data if MIME type is still unknown (remote files)
 	if ( empty( $mime_type ) && filter_var( $src, FILTER_VALIDATE_URL ) ) {
-		$image_data = @file_get_contents( $src );
+		$response = wp_remote_get( $src );
 
-		if ( $image_data ) {
-			if ( function_exists( 'finfo_open' ) ) {
+		if ( ! is_wp_error( $response ) && 200 === wp_remote_retrieve_response_code( $response ) ) {
+			$image_data = wp_remote_retrieve_body( $response );
+
+			if ( $image_data && function_exists( 'finfo_open' ) ) {
 				$finfo = finfo_open( FILEINFO_MIME_TYPE );
 
 				if ( $finfo ) {
@@ -847,19 +848,21 @@ function wpo_wcpdf_get_image_mime_type( string $src ): string {
 }
 
 /**
- * Base64 encode file from URL or local path
+ * Base64 encode file from local path
  *
- * @param string $src
+ * @param string $local_path
  *
  * @return string|bool
  */
-function wpo_wcpdf_base64_encode_file( string $src ) {
-	if ( empty( $src ) ) {
+function wpo_wcpdf_base64_encode_file( string $local_path ) {
+	if ( empty( $local_path ) ) {
 		return false;
 	}
 
-	$file_data = @file_get_contents( $src );
-	return base64_encode( $file_data ) ?? false;
+	$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+	$file_data     = $wp_filesystem->get_contents( $local_path );
+
+	return $file_data ? base64_encode( $file_data ) : false;
 }
 
 /**
@@ -875,7 +878,7 @@ function wpo_wcpdf_is_file_readable( string $path ): bool {
 
 	// Check if the path is a URL
 	if ( filter_var( $path, FILTER_VALIDATE_URL ) ) {
-		$parsed_url = parse_url( $path );
+		$parsed_url = wp_parse_url( $path );
 		$args	    = array();
 
 		// Check if the URL is localhost
@@ -903,17 +906,18 @@ function wpo_wcpdf_is_file_readable( string $path ): bool {
 
 	// Local path file check
 	} else {
-		if ( @is_readable( $path ) ) {
+		$wp_filesystem = wpo_wcpdf_get_wp_filesystem();
+
+		if ( $wp_filesystem->is_readable( $path ) ) {
 			return true;
 		} else {
-			// Fallback to fopen if first check fails
-			$handle = @fopen( $path, 'r' );
-
-			if ( $handle ) {
-				fclose( $handle );
+			// Fallback to checking file readability by attempting to open it
+			$file_contents = $wp_filesystem->get_contents( $path );
+	
+			if ( $file_contents ) {
 				return true;
 			} else {
-				wcpdf_log_error( 'Failed to open local file with both methods: ' . $path, 'critical' );
+				wcpdf_log_error( 'Failed to open local file: ' . $path, 'critical' );
 				return false;
 			}
 		}
@@ -995,6 +999,50 @@ function wpo_wcpdf_get_simple_template_default_table_headers( $document ): array
 	return apply_filters( 'wpo_wcpdf_simple_template_default_table_headers', $headers, $document );
 }
 
+/**
+ * Get the WP_Filesystem instance
+ *
+ * @return WP_Filesystem|false
+ * @throws RuntimeException
+ */
+function wpo_wcpdf_get_wp_filesystem() {
+	global $wp_filesystem;
+
+	if ( empty( $wp_filesystem ) ) {
+		require_once ABSPATH . 'wp-admin/includes/file.php';
+		WP_Filesystem();
+	}
+	
+	if ( ! $wp_filesystem ) {
+		$error = 'Failed to initialize WP_Filesystem.';
+		wcpdf_log_error( $error, 'critical' );
+		throw new \RuntimeException( $error );
+	}
+
+	return $wp_filesystem;
+}
+
+/**
+ * Escapes a URL, filesystem path, or base64 string for safe output in HTML.
+ *
+ * @param string $url_path_or_base64
+ * @return string
+ */
+function wpo_wcpdf_escape_url_path_or_base64( string $url_path_or_base64 ): string {
+	// Check if it's a URL
+	if ( 0 === strpos( $url_path_or_base64, 'http' ) ) {
+		return esc_url( $url_path_or_base64 );
+	}
+	
+	// Check if it's a base64 string
+	if ( preg_match( '/^data:[a-zA-Z0-9\/\-\.\+]+;base64,/', $url_path_or_base64 ) ) {
+		return esc_attr( $url_path_or_base64 );
+	}
+
+	// Otherwise, assume it's a filesystem path
+	return esc_attr( wp_normalize_path( $url_path_or_base64 ) );
+}
+
 /**
  * Dynamic string translation
  *