=== Xtreme Courses ===
Contributors: xtremplugins
Tags: lms, courses, elearning, woocommerce, quiz
Requires at least: 6.5
Tested up to:      7.0
Requires PHP: 8.2
Stable tag: 2.1.9
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Sell and run online courses on WordPress — LMS with WooCommerce checkout, quizzes, drip content, certificates, gamification. Free, no upsells.

== Description ==

**Xtreme Courses** is a complete **learning management system (LMS) plugin** for WordPress. Build structured online courses in a React drag-and-drop builder, sell them through WooCommerce, schedule drip content, run auto-graded quizzes, issue verifiable PDF certificates, and keep students engaged with XP, badges, and leaderboards — all from your own WordPress site.

**No upsells. No locked features.** There is no "Pro" version of Xtreme Courses — every feature listed on this page ships in the free download and is fully functional out of the box. No upgrade nags, no feature gates, no artificial limits on courses, students, or enrollments.

[Plugin homepage](https://xtremeplugins.com/plugins/xtreme-courses/) · [Documentation](https://xtremeplugins.com/docs/xtreme-courses) · [Support](https://xtremeplugins.com/support/)

= Why Xtreme Courses? =

If you've evaluated the established LMS plugins (LearnDash, LifterLMS, Tutor LMS, LearnPress, Sensei) you already know the pattern: the features you actually need to run a paid course business — certificates, drip scheduling, quizzes, e-commerce checkout, reporting — are spread across paid tiers and per-feature add-ons. Xtreme Courses is built differently:

* **The whole stack is free.** Course builder, WooCommerce selling, drip content, quiz engine, PDF certificates, gamification, live lessons, reviews, analytics — nothing is held back for a paid tier.
* **Commerce-ready from day one.** Native WooCommerce integration: one-time purchases, free enrollments, subscription-gated content, bundles, bulk enrollment coupons, and gift enrollment.
* **Modern WordPress stack.** PHP 8.2+ with strict types, a React drag-and-drop course builder, custom REST API, Action Scheduler background jobs, and full uninstall cleanup.
* **Self-hosted and private by default.** No telemetry, no external service calls unless you explicitly configure live Zoom lessons (disclosed below). Your course content and student data stay on your server.
* **WordPress.org-compliant.** Fully GPL, no obfuscated code, every external-service touchpoint disclosed on this page.

A free alternative to **LearnDash**, **LifterLMS**, **Tutor LMS**, **LearnPress**, and **Sensei** for course creators who want the complete LMS feature set without per-feature pricing.

**Core Features (Free):**

* **React Drag-and-Drop Course Builder** — Build structured courses with sections, lessons (video, text, PDF, audio), and quizzes using a visual drag-and-drop interface.
* **WooCommerce Integration** — Sell courses as one-time purchases, free enrollments, or subscription-gated content. Supports bulk enrollment coupons and gift enrollment.
* **Drip Content Scheduling** — Release lessons on a fixed date, X days after enrollment, or after completing the previous lesson. Visual Gantt-style drip timeline.
* **Quiz Engine** — Multiple choice, true/false, and fill-in-the-blank questions with timed mode, pass thresholds, retake limits, and auto-grading.
* **PDF Certificate Generator** — Auto-generate personalized certificates on course completion with a public verification URL.
* **Student Dashboard** — Tabbed dashboard showing enrolled courses, progress rings, certificates, achievements, and order history.
* **Instructor Role & Dashboard** — Dedicated `xc_instructor` role with scoped access to own courses, student roster, and earnings.
* **Gamification** — XP points, badges with trigger conditions, and a leaderboard Gutenberg block/shortcode.
* **Live Lessons** — Zoom SDK embed and Google Meet pre-join cards with calendar reminder emails (.ics attachment).
* **Analytics Dashboard** — Chart.js-powered admin panel with enrollment trends, lesson funnel, quiz performance, revenue, active students, and certificate issuance rate.
* **Course Reviews & Ratings** — Star ratings and written reviews with moderation, instructor replies, and aggregate display.
* **Course Bundles & Prerequisites** — Bundle multiple courses into a single WooCommerce product and enforce prerequisite completion.
* **Mobile Lesson Player** — Distraction-free, full-viewport lesson player with progress persistence.

**Technical Highlights:**

* PHP 8.2+ with strict types
* Custom REST API namespace `/xtreme-courses/v1/`
* Custom database tables with proper indexes
* Action Scheduler for all background jobs
* Transient-based caching for leaderboard and progress queries
* Full nonce verification on all AJAX/REST write endpoints
* Input sanitization and output escaping throughout
* Complete uninstall routine (tables, options, uploaded files)

== Bundled libraries ==

This plugin bundles **Chart.js v4.5.1** (MIT, Copyright 2014-2025 Chart.js Contributors) for the Analytics admin panel. The script is served from the plugin folder at `assets/js/vendor/chart.umd.min.js` — no third-party CDN is contacted.

== Installation ==

1. Upload the `xtreme-courses` folder to the `/wp-content/plugins/` directory, or install directly via the WordPress Plugins screen.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Navigate to **Xtreme Courses → Settings** to configure the plugin.
4. Install and activate **WooCommerce** (8.x+) to enable paid enrollments and commerce features.
5. Create your first course by going to **Courses → Add New** in the WordPress admin.

**Minimum Requirements:**

* WordPress 6.5 or higher
* PHP 8.2 or higher
* MySQL 5.7+ or MariaDB 10.3+

**Recommended:**

* WooCommerce 8.x (for paid enrollment, subscriptions, and revenue analytics)
* Action Scheduler (bundled with WooCommerce) for drip content and live lesson reminders

== Frequently Asked Questions ==

= Is Xtreme Courses really free? =

Yes. There is no premium version — every feature on this page (course builder, WooCommerce selling, quizzes, drip content, certificates, gamification, live lessons, analytics) ships in the free plugin with no artificial limits on courses, students, or enrollments.

= Does Xtreme Courses require WooCommerce? =

WooCommerce is not required for free courses, but is needed for paid enrollment, subscription-gated courses, bulk enrollment coupons, and revenue analytics.

= Can I use Xtreme Courses without a page builder? =

Yes. Xtreme Courses provides a standalone React drag-and-drop course builder in wp-admin, a shortcode/Gutenberg block for the student dashboard, and a custom lesson player — no page builder required.

= Are certificates generated server-side? =

Yes. Certificates are generated as PDF files using mPDF (PHP, no external service). Each certificate has a unique ID and a public verification URL.

= Can students earn badges and XP? =

Yes. The gamification system awards XP on lesson and quiz completion. Badge trigger conditions (e.g., "Complete 1 course", "Earn 500 XP") are configurable in the admin.

= Does Xtreme Courses support Zoom? =

Yes. Instructors can schedule live lessons with a Zoom meeting URL/ID. If Zoom SDK credentials are configured, the meeting embeds directly in the lesson page. Without SDK credentials, a styled pre-join card with the meeting link is displayed.

= Is my data removed when I uninstall the plugin? =

Yes. The uninstall routine removes all custom database tables, plugin options, Action Scheduler jobs, and uploaded files in the `wp-content/uploads/xtreme-courses/` directory.

= Where can I find documentation? =

Full documentation lives at [xtremeplugins.com/docs/xtreme-courses](https://xtremeplugins.com/docs/xtreme-courses), covering course building, selling with WooCommerce, drip scheduling, quizzes, certificates, and gamification setup.

= Where do I report bugs or request features? =

Please use the [WordPress.org support forum](https://wordpress.org/support/plugin/xtreme-courses/) for this plugin, or reach us through [xtremeplugins.com/support](https://xtremeplugins.com/support/).

== External services ==

This plugin can connect to one third-party service. It is **opt-in** — it is only contacted when an admin or instructor explicitly creates a live lesson and a student attends it. The default install of the plugin does not contact any external service.

= Zoom Meeting SDK (optional, used for live lessons) =

If an admin or instructor creates a live lesson and pastes a Zoom meeting URL into the lesson, then when a student opens that lesson the plugin will:

* Render an embedded Zoom client by enqueueing the Zoom Meeting SDK JavaScript directly from `https://source.zoom.us/zoom-meeting-3.1.2.min.js` on that lesson page only.
* The Zoom SDK then connects to Zoom's own infrastructure to join the meeting. The plugin itself does not send any data to Zoom from your server — all communication happens between the student's browser and Zoom.

If you do not use the live-lesson feature (no live lesson with a Zoom URL is ever created), the Zoom SDK is never loaded and Zoom is never contacted.

Service provider: Zoom Communications, Inc. [Terms of Service](https://explore.zoom.us/en/terms/) · [Privacy Statement](https://explore.zoom.us/en/privacy/)

== Screenshots ==

1. React Drag-and-Drop Course Builder — build and reorder sections and lessons visually.
2. Student Dashboard — progress rings, resume button, certificates, achievements.
3. Quiz Engine — configurable pass threshold, timer, and instant results screen.
4. Analytics Dashboard — Chart.js charts for enrollments, revenue, and quiz performance.
5. Certificate Template Editor — drag-to-position dynamic text fields on a custom background.
6. Gamification — XP bar, badge grid, and leaderboard widget.

== Changelog ==

= 2.1.9 =
* WordPress.org reviewer feedback round (follow-up to the 2.1.8 submission) — addresses the two findings from the latest manual review.
* REST permissions: the course publish endpoint (`POST /xtreme-courses/v1/courses/{id}/publish`) now uses a dedicated `publish_course_permissions_check()` gate. Publishing previously shared the editing gate (`edit_post` ownership only); it now additionally requires the publish-specific primitive capability for the course post type (`publish_xtrc_courses`, resolved from the CPT `capability_type`). An author who can edit a draft but lacks the publish capability is denied — the permission check now matches the strength of the action. `includes/REST/class-courses-controller.php`.
* Certificate generator: the in-document PDF stylesheet block is now composed from a constant element name rather than a literal `<style>` element, with an expanded comment clarifying that this CSS is parsed by the bundled PDF engine (never streamed to the browser) so `wp_enqueue_style()` does not apply. Every browser-facing script and style in the plugin is registered/enqueued via `wp_register_*` / `wp_enqueue_*`; this block is PDF-document markup, not front-end output. Output is byte-identical. `includes/Certificate/class-certificate-generator.php`.
* readme.txt: the `== Changelog ==` section is trimmed below WordPress.org's 5000-character limit (older per-version entries rolled up; full history retained in CHANGELOG.md).
* No database changes, no schema changes. Safe to upgrade.

= 2.1.8 =
* WordPress.org reviewer feedback round: updated the bundled Chart.js to v4.5.1 (MIT) with a matching `filemtime()`-busted enqueue; the optional mPDF autoloader now loads only from the plugin's own `vendor/` (the non-portable `ABSPATH` fallback was removed); lowered the top-level admin menu position from 2 to 58; hardened the drip-override nonces to fail closed and moved `_wpnonce` verification to the top of the set/remove handlers; bound the per-student override `IN ()` lists via `%d` in `wpdb::prepare()`; sanitized the certificate-layout JSON (`$_POST['xtrc_cert_layout']`) and `$_SERVER['SCRIPT_NAME']` at the boundary; assembled the certificate PDF HTML as a returned string and escaped the Courses-list status row with `wp_kses_post()`; and removed the deprecated 2-character `XC_*` constant aliases (the `XTREMECOURSES_*` constants are now the only names). No database or schema changes.

= 2.1.x (2.1.0 – 2.1.7) =
* Admin UX and review-round fixes across the 2.1 line: first-run setup wizard, server-rendered Courses list page and dashboard refresh, plugin-row action/meta links, React builder save-error fixes (linked-quiz validation, type-aware lesson PATCH, full-text error banner, non-blocking quiz-on-Update warning), and successive Plugin Check / PHPCS hardening passes.

= 2.0.x =
* WordPress.org review and Plugin Check rounds: Chart.js bundled locally (no CDN), `XC_*` constants renamed to `XTREMECOURSES_*`, folder/slug/namespace normalized to `xtreme-courses`, certificate PDF CSS moved to a bundled file, plus numerous escaping, prefix, nonce, and `$wpdb`-suppression fixes.

= 1.x =
* Initial builds through 1.9.0: React course builder, lesson player, WooCommerce enrollment, drip scheduling, quiz engine, PDF certificates, gamification, live Zoom/Meet lessons, reviews, and analytics.

For the complete release notes for every individual version, see CHANGELOG.md in the source repository.

== Upgrade Notice ==

= 2.1.9 =
Reviewer follow-up: adds a publish-specific capability check (publish_xtrc_courses) to the course publish REST endpoint, and composes the certificate PDF stylesheet block from a constant instead of a literal style element (PDF markup, not enqueueable front-end CSS). No DB changes.

= 2.1.8 =
Reviewer round: updates bundled Chart.js to v4.5.1, hardens drip-override nonces, binds the override SQL via prepare(), sanitizes the certificate layout JSON and SCRIPT_NAME, lowers the admin menu position, and drops the deprecated XC_* aliases. No DB changes.

= 2.1.7 =
Plugin Check round 4: rewrites the `$_GET['xtrc_bulk_token']` read so `wp_unslash()` wraps the raw `$_GET` value directly (sniff-compatible pattern). Trims oversize Upgrade Notices to comply with the 300-char guideline. No DB or schema changes.

= 2.1.6 =
React course-builder UX: save-failure banner now wraps multi-line and shows the full error message (was truncated at ~360px). Update on a published course no longer hard-blocks when a Quiz lesson has zero questions — saves with an amber warning. Publish still blocks. No DB changes.

= 2.1.5 =
Fixes the React course builder "Save failed — Quiz not found." error on every Update / Publish of a course containing a Quiz lesson. Builder now sends `lesson.quiz_id` instead of the lesson ID; backend `validate_quiz()` falls back through lesson-ID lookup. No DB or schema changes.

= 2.1.4 =
Adds plugin-row Settings / Upgrade / Docs / Support links. Fixes 4 Plugin Check findings: badge-icon upload isset() guard, bulk-token + lesson-player $_GET wp_unslash + sanitize (lesson-player is a regression of work that never reached main), uninstall.php NoCaching suppression. No DB changes.

= 2.1.3 =
Fixes the React course builder "Save failed — Invalid parameter(s): live_meeting_*" error on Video, Text, PDF, Audio, and Quiz lessons. The builder now strips fields irrelevant to the selected content type before PATCHing. No DB or schema changes — safe to upgrade.

= 2.1.2 =
PHPCS / Plugin Check round 3: $wpdb call suppressions converted from single-line phpcs:ignore to phpcs:disable/enable BLOCK form, translators comments added on the Courses list page, $_SERVER / $_GET / $_FILES reads sanitized, tax_query slow-query suppression added. No DB or behaviour changes.

= 2.1.1 =
Admin-menu fixes: Xtreme Courses now sits immediately after Dashboard instead of below Tutor LMS / ReviewX / Elementor, and editing a course / lesson / quiz / section / question no longer collapses the Xtreme Courses sidebar menu. No database changes — safe to upgrade.

= 2.1.0 =
Admin UX restructure: top-level menu moves to position 3, submenus register centrally, new server-rendered Courses page replaces the CPT screen, dashboard gains stat tiles + activity feed, fresh installs see a 4-step welcome wizard. Existing 2.0.x sites upgrade silently, no DB changes.

= 2.0.8 =
PHPCS / Plugin Check round 2: ~40 $wpdb queries gain the missing PluginCheck DirectDB suppression, real prepare() placeholder-count bugs fixed, nonce checks added to badge / leaderboard admin handlers, readme short description rewritten in plain English. No database or behavioural changes.

= 2.0.7 =
Plugin Check / PHPCS cleanup: `unlink()` → `wp_delete_file()`, direct `$wpdb` writes wrapped in proper `phpcs:disable/enable` blocks, `get_posts()` slow-query suppressions, and certificate-admin input sanitisation tightened. No database, UI, or behavioural changes — safe to upgrade.

= 2.0.6 =
WordPress.org compliance round: Chart.js bundled locally (no CDN), Zoom signature endpoint now enforces drip rules, constants renamed to `XTREMECOURSES_*` (old `XC_*` aliases kept for one release), certificate verification page styles properly enqueued. No database changes.

= 2.0.3 =
Restores the course builder admin screen for users upgrading from 2.0.1 — bookmarks and cached links to old post-type slugs are now redirected instead of producing an empty screen. Sweeps stale option keys left over by the 2.0.2 prefix rename. No database schema changes.

= 2.0.2 =
WordPress.org Plugin Check compliance: prefix length, inline style extraction, translator label fix. First-time installs only — internal identifier rename is not back-compatible with 2.0.x installs that already store data.

= 2.0.1 =
WordPress.org submission preparation. No database changes — safe to upgrade from 2.0.0.

= 2.0.0 =
This release adds the Analytics admin panel, digest email, improved CSV exports, and a complete uninstall routine. Upgrading from 1.x is seamless — no manual database migration required.

== License ==

Xtreme Courses is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.

Xtreme Courses is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Xtreme Courses. If not, see https://www.gnu.org/licenses/gpl-2.0.html.
