diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 2a27ea1dd..249bc2dea 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,11 +1,22 @@
 == Changelog ==
-= 2.3.2 2020-05-07 =
+= 2.3.3 - 2020-05-12 =
+* SECURITY: Fixed SQL injection vulnerability when logged in as an administrator and adding new orders in the dashboard. JVN#20248858 (Thanks, Kenichi Okuno of Mitsui Bussan Secure Directions, Inc)
+* SECURITY: Making sure to properly escape all values on the add/edit order form in the dashboard.
+* BUG FIX: Now properly setting the order status to "error" when an initial payment fails when using PayPal Express. Before the order status would be set as "cancelled", which would count the order toward reports and make it harder to find orders that had errors. (Thanks, Mirco Babini)
+* BUG FIX: Fixed issue with the PMPro logo and some other assets loading over the wrong schema (http vs https) in some cases.
+* BUG FIX: Fixed issue where the chosen discount code was not shown after submitting when adding a new order through the dashboard.
+* BUG FIX/ENHANCEMENT: Using "PMPro" in the admin activity email subject to keep the line shorter and avoid issues when replacing the word "member" via gettext.
+* ENHANCEMENT: Added a pmpro_allow_weak_passwords filter. You can set this to return true (like this https://gist.github.com/ideadude/5a12119b9ce1c2aad87b2d69cb8f9505) to allow weak passwords on the change password and reset password pages. Note that at this time, weak passwords are still allowed no matter the value of this filter. We expect to change that in the future. For now, you can use our PMPro Strong Passwords plugin to force strong passwords at checkout.
+* REFACTOR: Updated the logic around checking the PMPRO_IPN_DEBUG constant in the IPN handler. (Thanks, Mirco Babini)
+
+= 2.3.2 - 2020-05-07 =
 * BUG FIX: Fixed errors calling is_main_query() that came up with certain themes.
 * BUG FIX: Fixed typo in the pmpro_account_profile_action_links filter.
 * BUG FIX/ENHANCEMENT: Added a new force parameter to the pmpro_getAllLevels() function. This is used by the Multisite Membership Add On to fix an issue where levels were missing or incorrect on the subsites.
 * ENHANCEMENT: Removed mention of the ezAdsense plugin, which has been discontinued.
+* ENHANCEMENT: Added $recipient param in sendAdminActivity() function so you can send additional activity emails like this https://gist.github.com/dparker1005/6bf650370a12aef44adf8c8c26d3e906
 
-= 2.3.1 2020-05-01 =
+= 2.3.1 - 2020-05-01 =
 * BUG FIX: Fixed infinite redirect issue if no account page was set. Fixed a few other places where we do is_page() type checks just in case.
 * BUG FIX: Fixed issue where all pages were retitled to Welcome when logged in, if no login page was set.
 * BUG FIX: Fixed issue with BuddyBoss and other themes/plugins that use the_title filter with only one parameter.
diff --git a/adminpages/orders.php b/adminpages/orders.php
index d16d147d3..f95caaceb 100644
--- a/adminpages/orders.php
+++ b/adminpages/orders.php
@@ -291,11 +291,8 @@
 
 	// save
 	if ( $order->saveOrder() !== false && $nonceokay ) {
-		// also update the discount code if needed
-		if( isset( $_REQUEST['discount_code_id'] ) ) {
-			$order->updateDiscountCode( intval( $_REQUEST['discount_code_id'] ) );
-		}
-
+		$order_id = $order->id;
+		
 		// handle timestamp
 		if ( $order->updateTimestamp( intval( $_POST['ts_year'] ), intval( $_POST['ts_month'] ), intval( $_POST['ts_day'] ), intval( $_POST['ts_hour'] ) . ':' . intval( $_POST['ts_minute'] ) . ':00' ) !== false ) {
 			$pmpro_msg  = __( 'Order saved successfully.', 'paid-memberships-pro' );
@@ -308,6 +305,11 @@
 		$pmpro_msg  = __( 'Error saving order.', 'paid-memberships-pro' );
 		$pmpro_msgt = 'error';
 	}
+	
+	// also update the discount code if needed
+	if( isset( $_REQUEST['discount_code_id'] ) ) {
+		$order->updateDiscountCode( intval( $_REQUEST['discount_code_id'] ) );
+	}
 } else {
 	// order passed?
 	if ( ! empty( $_REQUEST['order'] ) ) {
@@ -371,9 +373,9 @@
 <?php if ( ! empty( $order ) ) { ?>
 
 	<?php if ( ! empty( $order->id ) ) { ?>
-		<h1 class="wp-heading-inline"><?php esc_html_e( 'Order', 'paid-memberships-pro' ); ?> #<?php echo $order->id; ?>: <?php echo $order->code; ?></h1>
-		<a title="<?php _e( 'Print', 'paid-memberships-pro' ); ?>" href="<?php echo add_query_arg( array( 'action' => 'pmpro_orders_print_view', 'order' => $order->id ), admin_url('admin-ajax.php' ) ); ?>" class="page-title-action" target="_blank" ><?php _e( 'Print', 'paid-memberships-pro' ); ?></a>
-		<a title="<?php _e( 'Email', 'paid-memberships-pro' ); ?>" href="#TB_inline?width=600&height=200&inlineId=email_invoice" class="thickbox email_link page-title-action" data-order="<?php echo $order->id; ?>"><?php _e( 'Email', 'paid-memberships-pro' ); ?></a>
+		<h1 class="wp-heading-inline"><?php esc_html_e( 'Order', 'paid-memberships-pro' ); ?> #<?php echo esc_html( $order->id ); ?>: <?php echo esc_html( $order->code ); ?></h1>
+		<a title="<?php esc_attr_e( 'Print', 'paid-memberships-pro' ); ?>" href="<?php echo esc_url( add_query_arg( array( 'action' => 'pmpro_orders_print_view', 'order' => $order->id ), admin_url( 'admin-ajax.php' ) ) ); ?>" class="page-title-action" target="_blank" ><?php esc_html_e( 'Print', 'paid-memberships-pro' ); ?></a>
+		<a title="<?php esc_attr_e( 'Email', 'paid-memberships-pro' ); ?>" href="#TB_inline?width=600&height=200&inlineId=email_invoice" class="thickbox email_link page-title-action" data-order="<?php echo esc_html( $order->id ); ?>"><?php esc_html_e( 'Email', 'paid-memberships-pro' ); ?></a>
 	<?php } else { ?>
 		<h1 class="wp-heading-inline"><?php esc_html_e( 'New Order', 'paid-memberships-pro' ); ?></h1>
 	<?php } ?>
@@ -401,7 +403,7 @@
 				<td>
 				<?php
 				if ( ! empty( $order->id ) ) {
-						echo $order->id;
+						echo esc_html( $order->id );
 				} else {
 					echo '<p class="description">' . __( 'This will be generated when you save.', 'paid-memberships-pro' ) . '</p>';
 				}
@@ -414,14 +416,14 @@
 				<td>
 					<?php
 						if ( in_array( 'code', $read_only_fields ) ) {
-							echo $order->code;
+							echo esc_html( $order->code );
 						} else { ?>
 							<input id="code" name="code" type="text" value="<?php echo esc_attr( $order->code ); ?>" class="regular-text" />
 						<?php 
 						}
 					?>
 					<?php if ( $order_id < 0 ) { ?>
-						<p class="description"><?php _e( 'Randomly generated for you.', 'paid-memberships-pro' ); ?></p>
+						<p class="description"><?php esc_html_e( 'Randomly generated for you.', 'paid-memberships-pro' ); ?></p>
 					<?php } ?>
 				</td>
 			</tr>
@@ -430,7 +432,7 @@
 				<td>
 					<?php
 						if ( in_array( 'user_id', $read_only_fields ) && $order_id > 0 ) {
-							echo $order->user_id;
+							echo esc_html( $order->user_id );
 						} else { ?>
 							<input id="user_id" name="user_id" type="text" value="<?php echo esc_attr( $order->user_id ); ?>" class="regular-text" />
 						<?php 
@@ -439,11 +441,11 @@
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="membership_id"><?php _e( 'Membership Level ID', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="membership_id"><?php esc_html_e( 'Membership Level ID', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 						if ( in_array( 'membership_id', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->membership_id;
+						echo esc_html( $order->membership_id );
 						} else { ?>
 							<input id="membership_id" name="membership_id" type="text" value="<?php echo esc_attr( $order->membership_id ); ?>" class="regular-text" />
 						<?php 
@@ -452,12 +454,12 @@
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="billing_name"><?php _e( 'Billing Name', 'paid-memberships-pro' ); ?>:</label>
+				<th scope="row" valign="top"><label for="billing_name"><?php esc_html_e( 'Billing Name', 'paid-memberships-pro' ); ?>:</label>
 				</th>
 				<td>
 					<?php
 					if ( in_array( 'billing_name', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->billing_name;
+						echo esc_html( $order->billing_name );
 					} else {
 										?>
 											<input id="billing_name" name="billing_name" type="text" size="50"
@@ -466,12 +468,12 @@
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="billing_street"><?php _e( 'Billing Street', 'paid-memberships-pro' ); ?>
+				<th scope="row" valign="top"><label for="billing_street"><?php esc_html_e( 'Billing Street', 'paid-memberships-pro' ); ?>
 						:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'billing_street', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->billing_street;
+						echo esc_html( $order->billing_street );
 					} else {
 										?>
 										<input id="billing_street" name="billing_street" type="text" size="50"
@@ -479,12 +481,12 @@
 									<?php } ?>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="billing_city"><?php _e( 'Billing City', 'paid-memberships-pro' ); ?>:</label>
+				<th scope="row" valign="top"><label for="billing_city"><?php esc_html_e( 'Billing City', 'paid-memberships-pro' ); ?>:</label>
 				</th>
 				<td>
 					<?php
 					if ( in_array( 'billing_city', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->billing_city;
+						echo esc_html( $order->billing_city );
 					} else {
 										?>
 										<input id="billing_city" name="billing_city" type="text" size="50"
@@ -492,12 +494,12 @@
 									<?php } ?>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="billing_state"><?php _e( 'Billing State', 'paid-memberships-pro' ); ?>
+				<th scope="row" valign="top"><label for="billing_state"><?php esc_html_e( 'Billing State', 'paid-memberships-pro' ); ?>
 						:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'billing_state', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->billing_state;
+						echo esc_html( $order->billing_state );
 					} else {
 										?>
 										<input id="billing_state" name="billing_state" type="text" size="50"
@@ -505,12 +507,12 @@
 									<?php } ?>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="billing_zip"><?php _e( 'Billing Postal Code', 'paid-memberships-pro' ); ?>
+				<th scope="row" valign="top"><label for="billing_zip"><?php esc_html_e( 'Billing Postal Code', 'paid-memberships-pro' ); ?>
 						:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'billing_zip', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->billing_zip;
+						echo esc_html( $order->billing_zip );
 					} else {
 										?>
 										<input id="billing_zip" name="billing_zip" type="text" size="50"
@@ -518,12 +520,12 @@
 									<?php } ?>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="billing_country"><?php _e( 'Billing Country', 'paid-memberships-pro' ); ?>
+				<th scope="row" valign="top"><label for="billing_country"><?php esc_html_e( 'Billing Country', 'paid-memberships-pro' ); ?>
 						:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'billing_country', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->billing_country;
+						echo esc_html( $order->billing_country );
 					} else {
 										?>
 											<input id="billing_country" name="billing_country" type="text" size="50"
@@ -532,12 +534,12 @@
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="billing_phone"><?php _e( 'Billing Phone', 'paid-memberships-pro' ); ?>
+				<th scope="row" valign="top"><label for="billing_phone"><?php esc_html_e( 'Billing Phone', 'paid-memberships-pro' ); ?>
 						:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'billing_phone', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->billing_phone;
+						echo esc_html( $order->billing_phone );
 					} else {
 										?>
 											<input id="billing_phone" name="billing_phone" type="text" size="50"
@@ -562,7 +564,7 @@
 			$codes = $wpdb->get_results($sqlQuery, OBJECT);
 			if ( ! empty( $codes ) ) { ?>
 			<tr>
-				<th scope="row" valign="top"><label for="discount_code_id"><?php _e( 'Discount Code', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="discount_code_id"><?php esc_html_e( 'Discount Code', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 						if ( in_array( 'discount_code_id', $read_only_fields ) && $order_id > 0 ) {
@@ -588,7 +590,7 @@
 				<td>
 					<?php
 					if ( in_array( 'subtotal', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->subtotal;
+						echo esc_html( $order->subtotal );
 					} else {
 										?>
 											<input id="subtotal" name="subtotal" type="text" size="10"
@@ -597,11 +599,11 @@
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="tax"><?php _e( 'Tax', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="tax"><?php esc_html_e( 'Tax', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'tax', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->tax;
+						echo esc_html( $order->tax );
 					} else {
 										?>
 											<input id="tax" name="tax" type="text" size="10"
@@ -610,86 +612,85 @@
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="couponamount"><?php _e( 'Coupon Amount', 'paid-memberships-pro' ); ?>:</label>
+				<th scope="row" valign="top"><label for="couponamount"><?php esc_html_e( 'Coupon Amount', 'paid-memberships-pro' ); ?>:</label>
 				</th>
 				<td>
 					<?php
 					if ( in_array( 'couponamount', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->couponamount;
+						echo esc_html( $order->couponamount );
 					} else {
-										?>
-											<input id="couponamount" name="couponamount" type="text" size="10"
-												   value="<?php echo esc_attr( $order->couponamount ); ?>"/>
+					?>
+						<input id="couponamount" name="couponamount" type="text" size="10" value="<?php echo esc_attr( $order->couponamount ); ?>"/>
 					<?php } ?>
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="total"><?php _e( 'Total', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="total"><?php esc_html_e( 'Total', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'total', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->total;
+						echo esc_html( $order->total );
 					} else {
 										?>
 											<input id="total" name="total" type="text" size="10"
 												   value="<?php echo esc_attr( $order->total ); ?>"/>
 					<?php } ?>
-					<p class="description"><?php _e( 'Should be subtotal + tax - couponamount.', 'paid-memberships-pro' ); ?></p>
+					<p class="description"><?php esc_html_e( 'Should be subtotal + tax - couponamount.', 'paid-memberships-pro' ); ?></p>
 				</td>
 			</tr>
 
 			<tr>
-				<th scope="row" valign="top"><label for="payment_type"><?php _e( 'Payment Type', 'paid-memberships-pro' ); ?>:</label>
+				<th scope="row" valign="top"><label for="payment_type"><?php esc_html_e( 'Payment Type', 'paid-memberships-pro' ); ?>:</label>
 				</th>
 				<td>
 					<?php
 					if ( in_array( 'payment_type', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->payment_type;
+						echo esc_html( $order->payment_type );
 					} else {
 										?>
 											<input id="payment_type" name="payment_type" type="text" size="50"
 												   value="<?php echo esc_attr( $order->payment_type ); ?>"/>
 					<?php } ?>
-					<p class="description"><?php _e( 'e.g. PayPal Express, PayPal Standard, Credit Card.', 'paid-memberships-pro' ); ?></p>
+					<p class="description"><?php esc_html_e( 'e.g. PayPal Express, PayPal Standard, Credit Card.', 'paid-memberships-pro' ); ?></p>
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="cardtype"><?php _e( 'Card Type', 'paid-memberships-pro' ); ?></label></th>
+				<th scope="row" valign="top"><label for="cardtype"><?php esc_html_e( 'Card Type', 'paid-memberships-pro' ); ?></label></th>
 				<td>
 					<?php
 					if ( in_array( 'cardtype', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->cardtype;
+						echo esc_html( $order->cardtype );
 					} else {
 										?>
 											<input id="cardtype" name="cardtype" type="text" size="50"
 												   value="<?php echo esc_attr( $order->cardtype ); ?>"/>
 					<?php } ?>
-					<p class="description"><?php _e( 'e.g. Visa, MasterCard, AMEX, etc', 'paid-memberships-pro' ); ?></p>
+					<p class="description"><?php esc_html_e( 'e.g. Visa, MasterCard, AMEX, etc', 'paid-memberships-pro' ); ?></p>
 				</td>
 			</tr>
 			<tr>
-				<th scope="row" valign="top"><label for="accountnumber"><?php _e( 'Account Number', 'paid-memberships-pro' ); ?>
+				<th scope="row" valign="top"><label for="accountnumber"><?php esc_html_e( 'Account Number', 'paid-memberships-pro' ); ?>
 						:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'accountnumber', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->accountnumber;
+						echo esc_html( $order->accountnumber );
 					} else {
 										?>
 											<input id="accountnumber" name="accountnumber" type="text" size="50"
 												   value="<?php echo esc_attr( $order->accountnumber ); ?>"/>
 					<?php } ?>
-					<p class="description"><?php _e( 'Obscure all but last 4 digits.', 'paid-memberships-pro' ); ?></p>
+					<p class="description"><?php esc_html_e( 'Obscure all but last 4 digits.', 'paid-memberships-pro' ); ?></p>
 				</td>
 			</tr>
 			<?php
 			if ( in_array( 'ExpirationDate', $read_only_fields ) && $order_id > 0 ) {
-				echo $order->ExpirationDate;
+				echo esc_html( $order->ExpirationDate );
 			} else {
 						?>
 							<tr>
 								<th scope="row" valign="top"><label
-							for="expirationmonth"><?php _e( 'Expiration Month', 'paid-memberships-pro' ); ?>:</label></th>
+							for="expirationmonth"><?php esc_html_e( 'Expiration Month', 'paid-memberships-pro' ); ?>:</label></th>
 					<td>
 						<input id="expirationmonth" name="expirationmonth" type="text" size="10"
 				   value="<?php echo esc_attr( $order->expirationmonth ); ?>"/>
@@ -697,7 +698,7 @@
 					</td>
 				</tr>
 				<tr>
-					<th scope="row" valign="top"><label for="expirationyear"><?php _e( 'Expiration Year', 'paid-memberships-pro' ); ?>
+					<th scope="row" valign="top"><label for="expirationyear"><?php esc_html_e( 'Expiration Year', 'paid-memberships-pro' ); ?>
 				:</label></th>
 					<td>
 						<input id="expirationyear" name="expirationyear" type="text" size="10"
@@ -707,11 +708,11 @@
 				</tr>
 			<?php } ?>
 			<tr>
-				<th scope="row" valign="top"><label for="status"><?php _e( 'Status', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="status"><?php esc_html_e( 'Status', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'status', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->status;
+						echo esc_html( $order->status );
 					} else { ?>
 					<?php
 						$statuses = pmpro_getOrderStatuses();
@@ -719,7 +720,7 @@
 						<select id="status" name="status">
 							<?php foreach ( $statuses as $status ) { ?>
 								<option
-									value="<?php echo esc_attr( $status ); ?>" <?php selected( $order->status, $status ); ?>><?php echo $status; ?></option>
+									value="<?php echo esc_attr( $status ); ?>" <?php selected( $order->status, $status ); ?>><?php echo esc_html( $status ); ?></option>
 							<?php } ?>
 						</select>
 						<?php 
@@ -729,47 +730,39 @@
 			</tr>
 
 			<tr>
-				<th scope="row" valign="top"><label for="gateway"><?php _e( 'Gateway', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="gateway"><?php esc_html_e( 'Gateway', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'gateway', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->gateway;
+						echo esc_html( $order->gateway );
 					} else {
-										?>
-											<select id="gateway" name="gateway" onchange="pmpro_changeGateway(jQuery(this).val());">
-												<?php
-												$pmpro_gateways = pmpro_gateways();
-												foreach ( $pmpro_gateways as $pmpro_gateway_name => $pmpro_gateway_label ) {
-													?>
-													<option
-														value="<?php echo esc_attr( $pmpro_gateway_name ); ?>" <?php selected( $order->gateway, $pmpro_gateway_name ); ?>><?php echo $pmpro_gateway_label; ?></option>
-								<?php
-												}
-												?>
-											</select>
-										<?php } ?>
+					?>
+						<select id="gateway" name="gateway" onchange="pmpro_changeGateway(jQuery(this).val());">
+					<?php
+						$pmpro_gateways = pmpro_gateways();
+						foreach ( $pmpro_gateways as $pmpro_gateway_name => $pmpro_gateway_label ) {
+							?>
+							<option
+								value="<?php echo esc_attr( $pmpro_gateway_name ); ?>" <?php selected( $order->gateway, $pmpro_gateway_name ); ?>><?php echo esc_html( $pmpro_gateway_label ); ?></option>
+							<?php
+						}
+					?>
+						</select>
+					<?php } ?>
 				</td>
 			</tr>
 			<tr>
 				<th scope="row" valign="top"><label
-						for="gateway_environment"><?php _e( 'Gateway Environment', 'paid-memberships-pro' ); ?>:</label></th>
+						for="gateway_environment"><?php esc_html_e( 'Gateway Environment', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'gateway_environment', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->gateway_environment;
+						echo esc_html( $order->gateway_environment );
 					} else {
-										?>
-											<select name="gateway_environment">
-												<option value="sandbox"
-									<?php
-									if ( $order->gateway_environment == 'sandbox' ) {
 					?>
-					selected="selected"<?php } ?>><?php _e( 'Sandbox/Testing', 'paid-memberships-pro' ); ?></option>
-							<option value="live"
-				<?php
-				if ( $order->gateway_environment == 'live' ) {
-?>
-selected="selected"<?php } ?>><?php _e( 'Live/Production', 'paid-memberships-pro' ); ?></option>
+						<select name="gateway_environment">
+							<option value="sandbox" <?php if ( $order->gateway_environment == 'sandbox' ) { ?>selected="selected"<?php } ?>><?php esc_html_e( 'Sandbox/Testing', 'paid-memberships-pro' ); ?></option>
+							<option value="live" <?php if ( $order->gateway_environment == 'live' ) { ?>selected="selected"<?php } ?>><?php esc_html_e( 'Live/Production', 'paid-memberships-pro' ); ?></option>
 						</select>
 					<?php } ?>
 				</td>
@@ -781,18 +774,18 @@
 				<td>
 					<?php
 					if ( in_array( 'payment_transaction_id', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->payment_transaction_id;
+						echo esc_html( $order->payment_transaction_id );
 					} else {
 										?>
 											<input id="payment_transaction_id" name="payment_transaction_id" type="text" size="50"
 												   value="<?php echo esc_attr( $order->payment_transaction_id ); ?>"/>
 					<?php } ?>
-					<p class="description"><?php _e( 'Generated by the gateway. Useful to cross reference orders.', 'paid-memberships-pro' ); ?></p>
+					<p class="description"><?php esc_html_e( 'Generated by the gateway. Useful to cross reference orders.', 'paid-memberships-pro' ); ?></p>
 				</td>
 			</tr>
 			<tr>
 				<th scope="row" valign="top"><label
-						for="subscription_transaction_id"><?php _e( 'Subscription Transaction ID', 'paid-memberships-pro' ); ?>
+						for="subscription_transaction_id"><?php esc_html_e( 'Subscription Transaction ID', 'paid-memberships-pro' ); ?>
 						:</label></th>
 				<td>
 					<?php
@@ -803,43 +796,41 @@
 											<input id="subscription_transaction_id" name="subscription_transaction_id" type="text" size="50"
 												   value="<?php echo esc_attr( $order->subscription_transaction_id ); ?>"/>
 					<?php } ?>
-					<p class="description"><?php _e( 'Generated by the gateway. Useful to cross reference subscriptions.', 'paid-memberships-pro' ); ?></p>
+					<p class="description"><?php esc_html_e( 'Generated by the gateway. Useful to cross reference subscriptions.', 'paid-memberships-pro' ); ?></p>
 				</td>
 			</tr>
 
 			<tr>
-				<th scope="row" valign="top"><label for="ts_month"><?php _e( 'Date', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="ts_month"><?php esc_html_e( 'Date', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
 					if ( in_array( 'timestamp', $read_only_fields ) && $order_id > 0 ) {
-						echo date_i18n( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $order->timestamp );
+						echo esc_html( date_i18n( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $order->timestamp ) );
 					} else {
-										?>
-											<?php
-											// set up date vars
-											if ( ! empty( $order->timestamp ) ) {
-												$timestamp = $order->timestamp;
-											} else {
-												$timestamp = current_time( 'timestamp' );
-											}
-											
-											$year   = date( 'Y', $timestamp );
-											$month  = date( 'n', $timestamp );
-											$day    = date( 'j', $timestamp );
-											$hour   = date( 'H', $timestamp );
-											$minute = date( 'i', $timestamp );
-											$second = date( 's', $timestamp );
-											?>
-											<select id="ts_month" name="ts_month">
-							<?php
-							for ( $i = 1; $i < 13; $i ++ ) {
-							?>
-								<option value="<?php echo esc_attr( $i ); ?>" <?php selected( $i, $month ); ?>>
-								<?php echo esc_html( date_i18n( 'F', mktime( 0, 0, 0, $i, 2 ) ) ); ?>
-								</option>
-							<?php
-							}
-							?>
+						// set up date vars
+						if ( ! empty( $order->timestamp ) ) {
+							$timestamp = $order->timestamp;
+						} else {
+							$timestamp = current_time( 'timestamp' );
+						}
+						
+						$year   = date( 'Y', $timestamp );
+						$month  = date( 'n', $timestamp );
+						$day    = date( 'j', $timestamp );
+						$hour   = date( 'H', $timestamp );
+						$minute = date( 'i', $timestamp );
+						$second = date( 's', $timestamp );
+						?>
+						<select id="ts_month" name="ts_month">
+						<?php
+						for ( $i = 1; $i < 13; $i ++ ) {
+						?>
+							<option value="<?php echo esc_attr( $i ); ?>" <?php selected( $i, $month ); ?>>
+							<?php echo esc_html( date_i18n( 'F', mktime( 0, 0, 0, $i, 2 ) ) ); ?>
+							</option>
+						<?php
+						}
+						?>
 						</select>
 						<input name="ts_day" type="text" size="2" value="<?php echo esc_attr( $day ); ?>"/>
 						<input name="ts_year" type="text" size="4" value="<?php echo esc_attr( $year ); ?>"/>
@@ -855,30 +846,28 @@
 			if ( ! empty( $affiliates ) ) {
 				?>
 				<tr>
-					<th scope="row" valign="top"><label for="affiliate_id"><?php _e( 'Affiliate ID', 'paid-memberships-pro' ); ?>
+					<th scope="row" valign="top"><label for="affiliate_id"><?php esc_html_e( 'Affiliate ID', 'paid-memberships-pro' ); ?>
 							:</label></th>
 					<td>
 						<?php
 						if ( in_array( 'affiliate_id', $read_only_fields ) && $order_id > 0 ) {
-							echo $order->affiliate_id;
+							echo esc_html( $order->affiliate_id );
 						} else {
-												?>
-													<input id="affiliate_id" name="affiliate_id" type="text" size="50"
-														   value="<?php echo esc_attr( $order->affiliate_id ); ?>"/>
+						?>
+							<input id="affiliate_id" name="affiliate_id" type="text" size="50" value="<?php echo esc_attr( $order->affiliate_id ); ?>"/>
 						<?php } ?>
 					</td>
 				</tr>
 				<tr>
-					<th scope="row" valign="top"><label for="affiliate_subid"><?php _e( 'Affiliate SubID', 'paid-memberships-pro' ); ?>
+					<th scope="row" valign="top"><label for="affiliate_subid"><?php esc_html_e( 'Affiliate SubID', 'paid-memberships-pro' ); ?>
 							:</label></th>
 					<td>
 						<?php
 						if ( in_array( 'affiliate_subid', $read_only_fields ) && $order_id > 0 ) {
-							echo $order->affiliate_subid;
+							echo esc_html( $order->affiliate_subid );
 						} else {
-												?>
-													<input id="affiliate_subid" name="affiliate_subid" type="text" size="50"
-														   value="<?php echo esc_attr( $order->affiliate_subid ); ?>"/>
+						?>
+							<input id="affiliate_subid" name="affiliate_subid" type="text" size="50" value="<?php echo esc_attr( $order->affiliate_subid ); ?>"/>
 						<?php } ?>
 					</td>
 				</tr>
@@ -891,14 +880,13 @@
 				if( !empty( $tospage_id ) || !empty( $consent_entry ) ) {
 				?>
 				<tr>
-					<th scope="row" valign="top"><label for="tos_consent"><?php _e( 'TOS Consent', 'paid-memberships-pro' ); ?>:</label></th>
+					<th scope="row" valign="top"><label for="tos_consent"><?php esc_html_e( 'TOS Consent', 'paid-memberships-pro' ); ?>:</label></th>
 					<td id="tos_consent">
 						<?php
-							
 							if( !empty( $consent_entry ) ) {
-								echo pmpro_consent_to_text( $consent_entry );
+								echo esc_html( pmpro_consent_to_text( $consent_entry ) );
 							} else {
-								echo __( 'N/A' );
+								esc_html_e( 'N/A' );
 							}
 						?>
 					</td>
@@ -906,17 +894,15 @@
 				<?php
 				}
 			?>
-
 			<tr>
-				<th scope="row" valign="top"><label for="notes"><?php _e( 'Notes', 'paid-memberships-pro' ); ?>:</label></th>
+				<th scope="row" valign="top"><label for="notes"><?php esc_html_e( 'Notes', 'paid-memberships-pro' ); ?>:</label></th>
 				<td>
 					<?php
-					if ( in_array( 'notes', $read_only_fields ) && $order_id > 0 ) {
-						echo $order->notes;
+					if ( in_array( 'notes', $read_only_fields ) && $order_id > 0 ) {						
+						echo wp_kses_post( $order->notes );
 					} else {
-										?>
-											<textarea id="notes" name="notes" rows="5"
-								  cols="80"><?php echo esc_textarea( $order->notes ); ?></textarea>
+					?>
+						<textarea id="notes" name="notes" rows="5" cols="80"><?php echo esc_textarea( $order->notes ); ?></textarea>
 					<?php } ?>
 				</td>
 			</tr>
@@ -930,15 +916,15 @@
 			<input name="order" type="hidden" value="
 			<?php
 			if ( ! empty( $order->id ) ) {
-				echo $order->id;
+				echo esc_html( $order->id );
 			} else {
-				echo $order_id;
+				echo esc_html( $order_id );
 			}
 			?>
 			"/>
-			<input name="save" type="submit" class="button-primary" value="<?php _e( 'Save Order', 'paid-memberships-pro' ); ?>"/>
-			<input name="cancel" type="button" class="cancel button-secondary" value="<?php _e( 'Cancel', 'paid-memberships-pro' ); ?>"
-				   onclick="location.href='<?php echo get_admin_url( null, '/admin.php?page=pmpro-orders' ); ?>';"/>
+			<input name="save" type="submit" class="button-primary" value="<?php esc_attr_e( 'Save Order', 'paid-memberships-pro' ); ?>"/>
+			<input name="cancel" type="button" class="cancel button-secondary" value="<?php esc_attr_e( 'Cancel', 'paid-memberships-pro' ); ?>"
+				   onclick="location.href='<?php echo esc_url( get_admin_url( null, '/admin.php?page=pmpro-orders' ) ); ?>';"/>
 		</p>
 
 	</form>
@@ -948,7 +934,7 @@
 	<form id="posts-filter" method="get" action="">
 
 		<h1 class="wp-heading-inline"><?php esc_html_e( 'Orders', 'paid-memberships-pro' ); ?></h1>
-		<a href="<?php echo add_query_arg( array( 'page' => 'pmpro-orders', 'order' => -1 ), get_admin_url(null, 'admin.php' ) ); ?>" class="page-title-action"><?php esc_html_e( 'Add New Order', 'paid-memberships-pro' ); ?></a>
+		<a href="<?php echo esc_url( add_query_arg( array( 'page' => 'pmpro-orders', 'order' => -1 ), get_admin_url(null, 'admin.php' ) ) ); ?>" class="page-title-action"><?php esc_html_e( 'Add New Order', 'paid-memberships-pro' ); ?></a>
 
 		<?php
 		// build the export URL
@@ -969,7 +955,7 @@
 		);
 		$export_url = add_query_arg( $url_params, $export_url );
 		?>
-		<a target="_blank" href="<?php echo $export_url; ?>" class="page-title-action"><?php _e( 'Export to CSV', 'paid-memberships-pro' ); ?></a>
+		<a target="_blank" href="<?php echo esc_url( $export_url ); ?>" class="page-title-action"><?php esc_html_e( 'Export to CSV', 'paid-memberships-pro' ); ?></a>
 		
 		<hr class="wp-header-end">
 
@@ -989,31 +975,31 @@
 
 		<ul class="subsubsub">
 			<li>
-				<?php _e( 'Show', 'paid-memberships-pro' ); ?>
+				<?php esc_html_e( 'Show', 'paid-memberships-pro' ); ?>
 				<select id="filter" name="filter">
-					<option value="all" <?php selected( $filter, 'all' ); ?>><?php _e( 'All', 'paid-memberships-pro' ); ?></option>
+					<option value="all" <?php selected( $filter, 'all' ); ?>><?php esc_html_e( 'All', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="within-a-date-range" <?php selected( $filter, 'within-a-date-range' ); ?>><?php _e( 'Within a Date Range', 'paid-memberships-pro' ); ?></option>
+						value="within-a-date-range" <?php selected( $filter, 'within-a-date-range' ); ?>><?php esc_html_e( 'Within a Date Range', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="predefined-date-range" <?php selected( $filter, 'predefined-date-range' ); ?>><?php _e( 'Predefined Date Range', 'paid-memberships-pro' ); ?></option>
+						value="predefined-date-range" <?php selected( $filter, 'predefined-date-range' ); ?>><?php esc_html_e( 'Predefined Date Range', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="within-a-level" <?php selected( $filter, 'within-a-level' ); ?>><?php _e( 'Within a Level', 'paid-memberships-pro' ); ?></option>
+						value="within-a-level" <?php selected( $filter, 'within-a-level' ); ?>><?php esc_html_e( 'Within a Level', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="with-discount-code" <?php selected( $filter, 'with-discount-code' ); ?>><?php _e( 'With a Discount Code', 'paid-memberships-pro' ); ?></option>
+						value="with-discount-code" <?php selected( $filter, 'with-discount-code' ); ?>><?php esc_html_e( 'With a Discount Code', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="within-a-status" <?php selected( $filter, 'within-a-status' ); ?>><?php _e( 'Within a Status', 'paid-memberships-pro' ); ?></option>
+						value="within-a-status" <?php selected( $filter, 'within-a-status' ); ?>><?php esc_html_e( 'Within a Status', 'paid-memberships-pro' ); ?></option>
 					<option 
-						value="only-paid" <?php selected( $filter, 'only-paid' ); ?>><?php _e( 'Only Paid Orders', 'paid-memberships-pro' ); ?></option>
+						value="only-paid" <?php selected( $filter, 'only-paid' ); ?>><?php esc_html_e( 'Only Paid Orders', 'paid-memberships-pro' ); ?></option>
 					<option 
-						value="only-free" <?php selected( $filter, 'only-free' ); ?>><?php _e( 'Only Free Orders', 'paid-memberships-pro' ); ?></option>
+						value="only-free" <?php selected( $filter, 'only-free' ); ?>><?php esc_html_e( 'Only Free Orders', 'paid-memberships-pro' ); ?></option>
 
 					<?php $custom_filters = apply_filters( 'pmpro_admin_orders_filters', array() ); ?>
 					<?php foreach( $custom_filters as $value => $name ) { ?>
-						<option value="<?php esc_attr_e( $value ); ?>" <?php selected( $filter, $value ); ?>><?php esc_html_e( $name ); ?></option>
+						<option value="<?php echo esc_attr( $value ); ?>" <?php selected( $filter, $value ); ?>><?php esc_html_e( $name ); ?></option>
 					<?php } ?>
 				</select>
 
-				<span id="from"><?php _e( 'From', 'paid-memberships-pro' ); ?></span>
+				<span id="from"><?php esc_html_e( 'From', 'paid-memberships-pro' ); ?></span>
 
 				<select id="start-month" name="start-month">
 					<?php for ( $i = 1; $i < 13; $i ++ ) { ?>
@@ -1028,7 +1014,7 @@
 					   value="<?php echo esc_attr( $start_year ); ?>"/>
 
 
-				<span id="to"><?php _e( 'To', 'paid-memberships-pro' ); ?></span>
+				<span id="to"><?php esc_html_e( 'To', 'paid-memberships-pro' ); ?></span>
 
 				<select id="end-month" name="end-month">
 					<?php for ( $i = 1; $i < 13; $i ++ ) { ?>
@@ -1041,18 +1027,18 @@
 				<input id='end-day' name="end-day" type="text" size="2" value="<?php echo esc_attr( $end_day ); ?>"/>
 				<input id='end-year' name="end-year" type="text" size="4" value="<?php echo esc_attr( $end_year ); ?>"/>
 
-				<span id="filterby"><?php _e( 'filter by ', 'paid-memberships-pro' ); ?></span>
+				<span id="filterby"><?php esc_html_e( 'filter by ', 'paid-memberships-pro' ); ?></span>
 
 				<select id="predefined-date" name="predefined-date">
 
 					<option
-						value="<?php echo 'This Month'; ?>" <?php selected( $predefined_date, 'This Month' ); ?>><?php echo 'This Month'; ?></option>
+						value="<?php echo 'This Month'; ?>" <?php selected( $predefined_date, 'This Month' ); ?>><?php esc_html_e( 'This Month', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="<?php echo 'Last Month'; ?>" <?php selected( $predefined_date, 'Last Month' ); ?>><?php echo 'Last Month'; ?></option>
+						value="<?php echo 'Last Month'; ?>" <?php selected( $predefined_date, 'Last Month' ); ?>><?php esc_html_e( 'Last Month', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="<?php echo 'This Year'; ?>" <?php selected( $predefined_date, 'This Year' ); ?>><?php echo 'This Year'; ?></option>
+						value="<?php echo 'This Year'; ?>" <?php selected( $predefined_date, 'This Year' ); ?>><?php esc_html_e( 'This Year', 'paid-memberships-pro' ); ?></option>
 					<option
-						value="<?php echo 'Last Year'; ?>" <?php selected( $predefined_date, 'Last Year' ); ?>><?php echo 'Last Year'; ?></option>
+						value="<?php echo 'Last Year'; ?>" <?php selected( $predefined_date, 'Last Year' ); ?>><?php esc_html_e( 'Last Year', 'paid-memberships-pro' ); ?></option>
 
 				</select>
 
@@ -1063,7 +1049,7 @@
 				<select id="l" name="l">
 					<?php foreach ( $levels as $level ) { ?>
 						<option
-							value="<?php echo $level->id; ?>" <?php selected( $l, $level->id ); ?>><?php echo $level->name; ?></option>
+							value="<?php echo esc_attr( $level->id ); ?>" <?php selected( $l, $level->id ); ?>><?php echo esc_html( $level->name ); ?></option>
 					<?php } ?>
 
 				</select>
@@ -1076,7 +1062,7 @@
 				<select id="discount_code" name="discount_code">
 					<?php foreach ( $codes as $code ) { ?>
 						<option
-							value="<?php echo $code->id; ?>" <?php selected( $discount_code, $code->id ); ?>><?php echo $code->code; ?></option>
+							value="<?php echo esc_attr( $code->id ); ?>" <?php selected( $discount_code, $code->id ); ?>><?php echo esc_html( $code->code ); ?></option>
 					<?php } ?>
 				</select>
 				<?php } ?>
@@ -1087,11 +1073,11 @@
 				<select id="status" name="status">
 					<?php foreach ( $statuses as $the_status ) { ?>
 						<option
-							value="<?php echo esc_attr( $the_status ); ?>" <?php selected( $the_status, $status ); ?>><?php echo $the_status; ?></option>
+							value="<?php echo esc_attr( $the_status ); ?>" <?php selected( $the_status, $status ); ?>><?php echo esc_html( $the_status ); ?></option>
 					<?php } ?>
 				</select>
 
-				<input id="submit" class="button" type="submit" value="<?php _e( 'Filter', 'paid-memberships-pro' ); ?>"/>
+				<input id="submit" class="button" type="submit" value="<?php esc_attr_e( 'Filter', 'paid-memberships-pro' ); ?>"/>
 			</li>
 		</ul>
 
@@ -1225,10 +1211,10 @@ function pmpro_ShowMonthOrYear() {
 		</script>
 
 		<p class="search-box">
-			<label class="hidden" for="post-search-input"><?php _e( 'Search Orders', 'paid-memberships-pro' ); ?>:</label>
+			<label class="hidden" for="post-search-input"><?php esc_html_e( 'Search Orders', 'paid-memberships-pro' ); ?>:</label>
 			<input type="hidden" name="page" value="pmpro-orders"/>
 			<input id="post-search-input" type="text" value="<?php echo esc_attr( $s ); ?>" name="s"/>
-			<input class="button" type="submit" value="<?php _e( 'Search Orders', 'paid-memberships-pro' ); ?>"/>
+			<input class="button" type="submit" value="<?php esc_attr_e( 'Search Orders', 'paid-memberships-pro' ); ?>"/>
 		</p>
 
 		<?php
@@ -1276,7 +1262,7 @@ function pmpro_ShowMonthOrYear() {
 			$fields = apply_filters( 'pmpro_orders_search_fields', $fields );
 
 			foreach ( $fields as $field ) {
-				$sqlQuery .= ' OR ' . $field . " LIKE '%" . esc_sql( $s ) . "%' ";
+				$sqlQuery .= ' OR ' . esc_sql( $field ) . " LIKE '%" . esc_sql( $s ) . "%' ";
 			}
 			$sqlQuery .= ') ';
 
@@ -1308,18 +1294,18 @@ function pmpro_ShowMonthOrYear() {
 		<table class="widefat">
 			<thead>
 			<tr class="thead">
-				<th><?php _e( 'ID', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Code', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Username', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'ID', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Code', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Username', 'paid-memberships-pro' ); ?></th>
 				<?php do_action( 'pmpro_orders_extra_cols_header', $order_ids ); ?>
-				<th><?php _e( 'Level', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Total', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Payment', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Gateway', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Transaction IDs', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Status', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Date', 'paid-memberships-pro' ); ?></th>
-				<th><?php _e( 'Discount Code', 'paid-memberships-pro' );?></th>
+				<th><?php esc_html_e( 'Level', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Total', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Payment', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Gateway', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Transaction IDs', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Status', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Date', 'paid-memberships-pro' ); ?></th>
+				<th><?php esc_html_e( 'Discount Code', 'paid-memberships-pro' );?></th>
 			</tr>
 			</thead>
 			<tbody id="orders" class="list:order orders-list">
@@ -1331,33 +1317,31 @@ function pmpro_ShowMonthOrYear() {
 				$order->getMemberOrderByID( $order_id );
 				$order->getUser();
 				?>
-				<tr 
-				<?php
-				if ( $count ++ % 2 == 0 ) {
-?>
-class="alternate"<?php } ?>>
+				<tr <?php if ( $count ++ % 2 == 0 ) { ?>
+				class="alternate"<?php } ?>>
 					<td>
-						<a href="admin.php?page=pmpro-orders&order=<?php echo $order->id; ?>"><?php echo $order->id; ?></a>
+						<a href="admin.php?page=pmpro-orders&order=<?php echo esc_attr( $order->id ); ?>"><?php echo esc_html( $order->id ); ?></a>
 					</td>
 					<td class="order_code column-order_code has-row-actions">
-						<a href="admin.php?page=pmpro-orders&order=<?php echo $order->id; ?>"><?php echo $order->code; ?></a>
+						<a href="admin.php?page=pmpro-orders&order=<?php echo esc_attr( $order->id ); ?>"><?php echo esc_html( $order->code ); ?></a>
 						<br />
 						<div class="row-actions">
 							<span class="edit">
-								<a title="<?php _e( 'Edit', 'paid-memberships-pro' ); ?>" href="<?php echo add_query_arg( array( 'page' => 'pmpro-orders', 'order' => $order->id ), admin_url('admin.php' ) ); ?>"><?php _e( 'Edit', 'paid-memberships-pro' ); ?></a>
+								<a title="<?php esc_attr_e( 'Edit', 'paid-memberships-pro' ); ?>" href="<?php echo esc_url( add_query_arg( array( 'page' => 'pmpro-orders', 'order' => $order->id ), admin_url('admin.php' ) ) ); ?>"><?php esc_html_e( 'Edit', 'paid-memberships-pro' ); ?></a>
 							</span> |
 							<span class="copy">
-								<a title="<?php _e( 'Copy', 'paid-memberships-pro' ); ?>" href="<?php echo add_query_arg( array( 'page' => 'pmpro-orders', 'order' => '-1', 'copy' => $order->id ), admin_url('admin.php' ) ); ?>"><?php _e( 'Copy', 'paid-memberships-pro' ); ?></a>
+								<a title="<?php esc_attr_e( 'Copy', 'paid-memberships-pro' ); ?>" href="<?php echo esc_url( add_query_arg( array( 'page' => 'pmpro-orders', 'order' => '-1', 'copy' => $order->id ), admin_url('admin.php' ) ) ); ?>"><?php esc_html_e( 'Copy', 'paid-memberships-pro' ); ?></a>
 							</span> |
 							<span class="delete">
-								<a href="javascript:pmpro_askfirst('<?php echo str_replace( "'", "\'", sprintf( __( 'Deleting orders is permanent and can affect active users. Are you sure you want to delete order %s?', 'paid-memberships-pro' ), str_replace( "'", '', $order->code ) ) ); ?>', 'admin.php?page=pmpro-orders&delete=<?php echo $order->id; ?>'); void(0);"><?php _e( 'Delete', 'paid-memberships-pro' ); ?></a>
+								<a href="javascript:pmpro_askfirst('<?php echo esc_attr
+								( sprintf( __( 'Deleting orders is permanent and can affect active users. Are you sure you want to delete order %s?', 'paid-memberships-pro' ), str_replace( "'", '', $order->code ) ) ); ?>', 'admin.php?page=pmpro-orders&delete=<?php echo $order->id; ?>'); void(0);"><?php esc_html_e( 'Delete', 'paid-memberships-pro' ); ?></a>
 							</span> |
 							<span class="print">
-								<a target="_blank" title="<?php _e( 'Print', 'paid-memberships-pro' ); ?>" href="<?php echo add_query_arg( array( 'action' => 'pmpro_orders_print_view', 'order' => $order->id ), admin_url('admin-ajax.php' ) ); ?>"><?php _e( 'Print', 'paid-memberships-pro' ); ?></a>
+								<a target="_blank" title="<?php esc_attr_e( 'Print', 'paid-memberships-pro' ); ?>" href="<?php echo esc_url( add_query_arg( array( 'action' => 'pmpro_orders_print_view', 'order' => $order->id ), admin_url('admin-ajax.php' ) ) ); ?>"><?php esc_html_e( 'Print', 'paid-memberships-pro' ); ?></a>
 							</span> |
 							<span class="email">
 								<a href="#TB_inline?width=600&height=200&inlineId=email_invoice" class="thickbox email_link"
-								   data-order="<?php echo $order->id; ?>"><?php _e( 'Email', 'paid-memberships-pro' ); ?></a>
+								   data-order="<?php echo esc_attr( $order->id ); ?>"><?php esc_html_e( 'Email', 'paid-memberships-pro' ); ?></a>
 							</span>
 							<?php
 							// Set up the hover actions for this user
@@ -1369,7 +1353,7 @@ class="alternate"<?php } ?>>
 								foreach ( $actions as $action => $link ) {
 									++ $i;
 									( $i == $action_count ) ? $sep = '' : $sep = ' | ';
-									$out .= "<span class='$action'>$link$sep</span>";
+									$out .= "<span class='" . esc_attr( $action ) . "'>" . esc_html( $link ) . $sep . "</span>";
 								}
 								echo $out;
 							}
@@ -1379,11 +1363,11 @@ class="alternate"<?php } ?>>
 					<td class="username column-username">
 						<?php $order->getUser(); ?>
 						<?php if ( ! empty( $order->user ) ) { ?>
-							<a href="user-edit.php?user_id=<?php echo $order->user->ID; ?>"><?php echo $order->user->user_login; ?></a>
+							<a href="user-edit.php?user_id=<?php echo esc_attr( $order->user->ID ); ?>"><?php echo esc_html( $order->user->user_login ); ?></a>
 						<?php } elseif ( $order->user_id > 0 ) { ?>
-							[<?php _e( 'deleted', 'paid-memberships-pro' ); ?>]
+							[<?php esc_html_e( 'deleted', 'paid-memberships-pro' ); ?>]
 						<?php } else { ?>
-							[<?php _e( 'none', 'paid-memberships-pro' ); ?>]
+							[<?php esc_html_e( 'none', 'paid-memberships-pro' ); ?>]
 						<?php } ?>	
 					</td>
 					<?php do_action( 'pmpro_orders_extra_cols_body', $order ); ?>
@@ -1391,80 +1375,80 @@ class="alternate"<?php } ?>>
 						<?php
 							$level = pmpro_getLevel( $order->membership_id );
 							if ( ! empty( $level ) ) {
-								echo $level->name;
+								echo esc_html( $level->name );
 							} elseif ( $order->membership_id > 0 ) { ?>
-								[<?php _e( 'deleted', 'paid-memberships-pro' ); ?>]
+								[<?php esc_html_e( 'deleted', 'paid-memberships-pro' ); ?>]
 							<?php } else { ?>
-								[<?php _e( 'none', 'paid-memberships-pro' ); ?>]
+								[<?php esc_html_e( 'none', 'paid-memberships-pro' ); ?>]
 							<?php }
 						?>
 					</td>
-					<td><?php echo pmpro_formatPrice( $order->total ); ?></td>
+					<td><?php echo esc_html( pmpro_formatPrice( $order->total ) ); ?></td>
 					<td>
 						<?php
 						if ( ! empty( $order->payment_type ) ) {
-							echo $order->payment_type . '<br />';
+							echo esc_html( $order->payment_type ) . '<br />';
 						}
 						?>
 						<?php if ( ! empty( $order->accountnumber ) ) { ?>
-							<?php echo $order->cardtype; ?>: x<?php echo last4( $order->accountnumber ); ?><br/>
+							<?php echo esc_html( $order->cardtype ); ?>: x<?php echo esc_html( last4( $order->accountnumber ) ); ?><br/>
 						<?php } ?>
 						<?php if ( ! empty( $order->billing->name ) ) { ?>
-								<?php echo $order->billing->name; ?><br/>
+								<?php echo esc_html( $order->billing->name ); ?><br/>
 						<?php } ?>
 						<?php if ( ! empty( $order->billing->street ) ) { ?>
-							<?php echo $order->billing->street; ?><br/>
+							<?php echo esc_html( $order->billing->street ); ?><br/>
 							<?php if ( $order->billing->city && $order->billing->state ) { ?>
-								<?php echo $order->billing->city; ?>, <?php echo $order->billing->state; ?><?php echo $order->billing->zip; ?>
-											<?php
-											if ( ! empty( $order->billing->country ) ) {
-												echo $order->billing->country; }
+								<?php echo esc_html( $order->billing->city ); ?>, <?php echo esc_html( $order->billing->state ); ?><?php echo esc_html( $order->billing->zip ); ?>
+									<?php
+									if ( ! empty( $order->billing->country ) ) {
+										echo esc_html( $order->billing->country ); }
 									?>
 									<br/>
 							<?php } ?>
 						<?php } ?>
 						<?php
 						if ( ! empty( $order->billing->phone ) ) {
-							echo formatPhone( $order->billing->phone );
+							echo esc_html( formatPhone( $order->billing->phone ) );
 						}
 						?>
 					</td>
 					<td><?php echo $order->gateway; ?>
-									<?php
-									if ( $order->gateway_environment == 'test' ) {
-											echo '(test)';
-									}
+						<?php
+						if ( $order->gateway_environment == 'test' ) {
+							echo '(test)';
+						}
 						?>
-						</td>
+					</td>
 					<td>
-						<?php _e( 'Payment', 'paid-memberships-pro' ); ?>: 
-									<?php
-									if ( ! empty( $order->payment_transaction_id ) ) {
-										echo $order->payment_transaction_id;
-									} else {
-										_e( 'N/A', 'paid-memberships-pro' );
-									}
+						<?php esc_html_e( 'Payment', 'paid-memberships-pro' ); ?>: 
+						<?php
+						if ( ! empty( $order->payment_transaction_id ) ) {
+							echo esc_html( $order->payment_transaction_id );
+						} else {
+							esc_html_e( 'N/A', 'paid-memberships-pro' );
+						}
 						?>
 						<br/>
-						<?php _e( 'Subscription', 'paid-memberships-pro' ); ?>
+						<?php esc_html_e( 'Subscription', 'paid-memberships-pro' ); ?>
 						: 
 						<?php
 						if ( ! empty( $order->subscription_transaction_id ) ) {
-							echo $order->subscription_transaction_id;
+							echo esc_html( $order->subscription_transaction_id );
 						} else {
-							_e( 'N/A', 'paid-memberships-pro' );
+							esc_html_e( 'N/A', 'paid-memberships-pro' );
 						}
 						?>
 					</td>
-					<td><?php echo $order->status; ?></td>
+					<td><?php echo esc_html( $order->status ); ?></td>
 					<td>
-						<?php echo date_i18n( get_option( 'date_format' ), $order->timestamp ); ?><br/>
-						<?php echo date_i18n( get_option( 'time_format' ), $order->timestamp ); ?>
+						<?php echo esc_html( date_i18n( get_option( 'date_format' ), $order->timestamp ) ); ?><br/>
+						<?php echo esc_html( date_i18n( get_option( 'time_format' ), $order->timestamp ) ); ?>
 					</td>
 					<td>
 						<?php if ( $order->getDiscountCode() ) { ?>
-							<a title="<?php _e('edit', 'paid-memberships-pro' ); ?>" href="<?php echo add_query_arg( array( 'page' => 'pmpro-discountcodes', 'edit' => $order->discount_code->id ), admin_url('admin.php' ) ); ?>">
-								<?php echo $order->discount_code->code; ?>
+							<a title="<?php esc_attr_e('edit', 'paid-memberships-pro' ); ?>" href="<?php echo esc_url( add_query_arg( array( 'page' => 'pmpro-discountcodes', 'edit' => $order->discount_code->id ), admin_url('admin.php' ) ) ); ?>">
+								<?php echo esc_html( $order->discount_code->code ); ?>
 							</a>
 						<?php } ?>							
 					</td>
@@ -1475,7 +1459,7 @@ class="alternate"<?php } ?>>
 			if ( ! $order_ids ) {
 				?>
 				<tr>
-					<td colspan="9"><p><?php _e( 'No orders found.', 'paid-memberships-pro' ); ?></p></td>
+					<td colspan="9"><p><?php esc_html_e( 'No orders found.', 'paid-memberships-pro' ); ?></p></td>
 				</tr>
 				<?php
 			}
@@ -1485,7 +1469,7 @@ class="alternate"<?php } ?>>
 	</form>
 	<?php
 	// add normal args
-	$pagination_url = add_query_arg( $url_params, get_admin_url( null, '/admin.php?page=pmpro-orders' ) );
+	$pagination_url = esc_url( add_query_arg( $url_params, get_admin_url( null, '/admin.php?page=pmpro-orders' ) ) );
 	echo pmpro_getPaginationString( $pn, $totalrows, $limit, 1, $pagination_url, "&limit=$limit&pn=" );
 	?>
 
diff --git a/classes/class-pmpro-admin-activity-email.php b/classes/class-pmpro-admin-activity-email.php
index 606f091a8..3732a004d 100644
--- a/classes/class-pmpro-admin-activity-email.php
+++ b/classes/class-pmpro-admin-activity-email.php
@@ -405,7 +405,7 @@ public function sendAdminActivity( $frequency = '', $recipient = null ) {
 		}
 		$this->email = $recipient;
 
-		$this->subject  = sprintf( __( '[%1$s] Paid Memberships Pro Activity for %2$s: %3$s', 'paid-memberships-pro' ), get_bloginfo( 'name' ), ucwords( $term ), $date_range );
+		$this->subject  = sprintf( __( '[%1$s] PMPro Activity for %2$s: %3$s', 'paid-memberships-pro' ), get_bloginfo( 'name' ), ucwords( $term ), $date_range );
 		$this->template = 'admin_activity_email';
 		$this->body     = $admin_activity_email_body;
 		$this->from     = pmpro_getOption( 'from' );
diff --git a/classes/class.memberorder.php b/classes/class.memberorder.php
index 8e081a8eb..bb65ed57c 100644
--- a/classes/class.memberorder.php
+++ b/classes/class.memberorder.php
@@ -654,11 +654,11 @@ function saveOrder()
 				$after_action = "pmpro_updated_order";
 				//update
 				$this->sqlQuery = "UPDATE $wpdb->pmpro_membership_orders
-									SET `code` = '" . $this->code . "',
-									`session_id` = '" . $this->session_id . "',
+									SET `code` = '" . esc_sql( $this->code ) . "',
+									`session_id` = '" . esc_sql( $this->session_id ) . "',
 									`user_id` = " . intval($this->user_id) . ",
 									`membership_id` = " . intval($this->membership_id) . ",
-									`paypal_token` = '" . $this->paypal_token . "',
+									`paypal_token` = '" . esc_sql( $this->paypal_token ) . "',
 									`billing_name` = '" . esc_sql($this->billing->name) . "',
 									`billing_street` = '" . esc_sql($this->billing->street) . "',
 									`billing_city` = '" . esc_sql($this->billing->city) . "',
@@ -666,20 +666,20 @@ function saveOrder()
 									`billing_zip` = '" . esc_sql($this->billing->zip) . "',
 									`billing_country` = '" . esc_sql($this->billing->country) . "',
 									`billing_phone` = '" . esc_sql($this->billing->phone) . "',
-									`subtotal` = '" . $this->subtotal . "',
-									`tax` = '" . $this->tax . "',
-									`couponamount` = '" . $this->couponamount . "',
+									`subtotal` = '" . esc_sql( $this->subtotal ) . "',
+									`tax` = '" . esc_sql( $this->tax ) . "',
+									`couponamount` = '" . esc_sql( $this->couponamount ) . "',
 									`certificate_id` = " . intval($this->certificate_id) . ",
-									`certificateamount` = '" . $this->certificateamount . "',
-									`total` = '" . $this->total . "',
-									`payment_type` = '" . $this->payment_type . "',
-									`cardtype` = '" . $this->cardtype . "',
-									`accountnumber` = '" . $this->accountnumber . "',
-									`expirationmonth` = '" . $this->expirationmonth . "',
-									`expirationyear` = '" . $this->expirationyear . "',
+									`certificateamount` = '" . esc_sql( $this->certificateamount ) . "',
+									`total` = '" . esc_sql( $this->total ) . "',
+									`payment_type` = '" . esc_sql( $this->payment_type ) . "',
+									`cardtype` = '" . esc_sql( $this->cardtype ) . "',
+									`accountnumber` = '" . esc_sql( $this->accountnumber ) . "',
+									`expirationmonth` = '" . esc_sql( $this->expirationmonth ) . "',
+									`expirationyear` = '" . esc_sql( $this->expirationyear ) . "',
 									`status` = '" . esc_sql($this->status) . "',
-									`gateway` = '" . $this->gateway . "',
-									`gateway_environment` = '" . $this->gateway_environment . "',
+									`gateway` = '" . esc_sql( $this->gateway ) . "',
+									`gateway_environment` = '" . esc_sql( $this->gateway_environment ) . "',
 									`payment_transaction_id` = '" . esc_sql($this->payment_transaction_id) . "',
 									`subscription_transaction_id` = '" . esc_sql($this->subscription_transaction_id) . "',
 									`timestamp` = '" . esc_sql($this->datetime) . "',
@@ -687,7 +687,7 @@ function saveOrder()
 									`affiliate_subid` = '" . esc_sql($this->affiliate_subid) . "',
 									`notes` = '" . esc_sql($this->notes) . "',
 									`checkout_id` = " . intval($this->checkout_id) . "
-									WHERE id = '" . $this->id . "'
+									WHERE id = '" . esc_sql( $this->id ) . "'
 									LIMIT 1";
 			}
 			else
@@ -705,32 +705,32 @@ function saveOrder()
 				//insert
 				$this->sqlQuery = "INSERT INTO $wpdb->pmpro_membership_orders
 								(`code`, `session_id`, `user_id`, `membership_id`, `paypal_token`, `billing_name`, `billing_street`, `billing_city`, `billing_state`, `billing_zip`, `billing_country`, `billing_phone`, `subtotal`, `tax`, `couponamount`, `certificate_id`, `certificateamount`, `total`, `payment_type`, `cardtype`, `accountnumber`, `expirationmonth`, `expirationyear`, `status`, `gateway`, `gateway_environment`, `payment_transaction_id`, `subscription_transaction_id`, `timestamp`, `affiliate_id`, `affiliate_subid`, `notes`, `checkout_id`)
-								VALUES('" . $this->code . "',
-									   '" . session_id() . "',
+								VALUES('" . esc_sql( $this->code ) . "',
+									   '" . esc_sql( session_id() ) . "',
 									   " . intval($this->user_id) . ",
 									   " . intval($this->membership_id) . ",
-									   '" . $this->paypal_token . "',
+									   '" . esc_sql( $this->paypal_token ) . "',
 									   '" . esc_sql(trim($this->billing->name)) . "',
 									   '" . esc_sql(trim($this->billing->street)) . "',
 									   '" . esc_sql($this->billing->city) . "',
 									   '" . esc_sql($this->billing->state) . "',
 									   '" . esc_sql($this->billing->zip) . "',
 									   '" . esc_sql($this->billing->country) . "',
-									   '" . cleanPhone($this->billing->phone) . "',
-									   '" . $this->subtotal . "',
-									   '" . $tax . "',
-									   '" . $this->couponamount. "',
+									   '" . esc_sql( cleanPhone($this->billing->phone) ) . "',
+									   '" . esc_sql( $this->subtotal ) . "',
+									   '" . esc_sql( $tax ) . "',
+									   '" . esc_sql( $this->couponamount ). "',
 									   " . intval($this->certificate_id) . ",
-									   '" . $this->certificateamount . "',
-									   '" . $total . "',
-									   '" . $this->payment_type . "',
-									   '" . $this->cardtype . "',
-									   '" . hideCardNumber($this->accountnumber, false) . "',
-									   '" . $this->expirationmonth . "',
-									   '" . $this->expirationyear . "',
+									   '" . esc_sql( $this->certificateamount ) . "',
+									   '" . esc_sql( $total ) . "',
+									   '" . esc_sql( $this->payment_type ) . "',
+									   '" . esc_sql( $this->cardtype ) . "',
+									   '" . esc_sql( hideCardNumber($this->accountnumber, false) ) . "',
+									   '" . esc_sql( $this->expirationmonth ) . "',
+									   '" . esc_sql( $this->expirationyear ) . "',
 									   '" . esc_sql($this->status) . "',
-									   '" . $this->gateway . "',
-									   '" . $this->gateway_environment . "',
+									   '" . esc_sql( $this->gateway ) . "',
+									   '" . esc_sql( $this->gateway_environment ) . "',
 									   '" . esc_sql($this->payment_transaction_id) . "',
 									   '" . esc_sql($this->subscription_transaction_id) . "',
 									   '" . esc_sql($this->datetime) . "',
diff --git a/includes/admin.php b/includes/admin.php
index 2c294a6ce..2cdf430fd 100644
--- a/includes/admin.php
+++ b/includes/admin.php
@@ -32,7 +32,13 @@ function pmpro_admin_init_redirect_to_dashboard() {
 function pmpro_block_dashboard() {
 	global $current_user;
 	$block_dashboard = pmpro_getOption( 'block_dashboard' );
-	if ( ! wp_doing_ajax() && ! empty( $block_dashboard ) && in_array( 'subscriber', (array) $current_user->roles ) ) {
+
+	if ( ! wp_doing_ajax()
+			&& ! empty( $block_dashboard )
+			&& ! current_user_can( 'manage_options' )
+			&& ! current_user_can( 'edit_users' )
+			&& ! current_user_can( 'edit_posts' )
+			&& in_array( 'subscriber', (array) $current_user->roles ) ) {
 		$block = true;
 	} else {
 		$block = false;
diff --git a/includes/functions.php b/includes/functions.php
index 5cf2e3d2b..ffa3a3238 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -1074,6 +1074,10 @@ function pmpro_changeMembershipLevel( $level, $user_id = null, $old_level_status
 
 			if ( ! empty( $c_order->error ) ) {
 				$pmpro_error = $c_order->error;
+			} else {
+				if( $old_level_status == 'error' ) {
+					$c_order->updateStatus("error");
+				}
 			}
 		}
 	}
@@ -3255,4 +3259,4 @@ function pmpro_int_compare( $a, $b, $operator ) {
 	}
 	
 	return $r;
-}
\ No newline at end of file
+}
diff --git a/includes/scripts.php b/includes/scripts.php
index 1c2e02223..a48f1575d 100644
--- a/includes/scripts.php
+++ b/includes/scripts.php
@@ -69,10 +69,22 @@ function pmpro_enqueue_scripts() {
                             array( 'jquery', 'password-strength-meter' ),
                             PMPRO_VERSION );
 
+        /**
+         * Filter to allow weak passwords on the 
+         * change password and reset password forms.
+         * At this time, this only disables the JS check on the frontend.
+         * There is no backend check for weak passwords on those forms.
+         * 
+         * @since 2.3.3
+         *
+         * @param bool $allow_weak_passwords    Whether to allow weak passwords.
+         */
+        $allow_weak_passwords = apply_filters( 'pmpro_allow_weak_passwords', false );
+
         wp_localize_script( 'pmpro_login', 'pmpro', array(
             'pmpro_login_page' => 'changepassword',
 			'strength_indicator_text' => __( 'Strength Indicator', 'paid-memberships-pro' ),
-        ));
+            'allow_weak_passwords' => $allow_weak_passwords ) );
         wp_enqueue_script( 'pmpro_login' );	
     }
 }
diff --git a/js/pmpro-login.js b/js/pmpro-login.js
index f9994b588..dead706bb 100644
--- a/js/pmpro-login.js
+++ b/js/pmpro-login.js
@@ -29,11 +29,15 @@ jQuery(document).ready(function(){
 		switch ( strength ) {
 			case -1:
 				indicator.addClass( 'empty' ).html( '&nbsp;' );
-				submitbutton.prop( 'disabled', true );
+				if ( pmpro.allow_weak_passwords === '' ) {
+					submitbutton.prop( 'disabled', true );
+				}
 				break;
 			case 2:
 				indicator.addClass( 'bad' ).html( pwsL10n.bad );
-				submitbutton.prop( 'disabled', true );
+				if ( pmpro.allow_weak_passwords === '' ) {
+					submitbutton.prop( 'disabled', true );
+				}
 				break;
 			case 3:
 				indicator.addClass( 'good' ).html( pwsL10n.good );
@@ -49,7 +53,9 @@ jQuery(document).ready(function(){
 				break;
 			default:
 				indicator.addClass( 'short' ).html( pwsL10n['short'] );
-				submitbutton.prop( 'disabled', true );
+				if ( pmpro.allow_weak_passwords === '' ) {
+					submitbutton.prop( 'disabled', true );
+				}
 		}
 	}
 	
diff --git a/paid-memberships-pro.php b/paid-memberships-pro.php
index 7ac5033e3..1b5aa71da 100644
--- a/paid-memberships-pro.php
+++ b/paid-memberships-pro.php
@@ -3,7 +3,7 @@
  * Plugin Name: Paid Memberships Pro
  * Plugin URI: https://www.paidmembershipspro.com
  * Description: The most complete member management and membership subscriptions plugin for WordPress.
- * Version: 2.3.2
+ * Version: 2.3.3
  * Author: Stranger Studios
  * Author URI: https://www.strangerstudios.com
  * Text Domain: paid-memberships-pro
@@ -16,7 +16,7 @@
  */
 
 // version constant
-define( 'PMPRO_VERSION', '2.3.2' );
+define( 'PMPRO_VERSION', '2.3.3' );
 define( 'PMPRO_USER_AGENT', 'Paid Memberships Pro v' . PMPRO_VERSION . '; ' . site_url() );
 define( 'PMPRO_MIN_PHP_VERSION', '5.6' );
 
@@ -139,7 +139,7 @@
 if ( ! defined( 'SECUREURL'  ) ) {
 	define( 'SECUREURL', str_replace( 'http://', 'https://', get_bloginfo( 'wpurl' ) ) );
 }
-define( 'PMPRO_URL', WP_PLUGIN_URL . '/paid-memberships-pro' );
+define( 'PMPRO_URL', plugins_url( '', PMPRO_BASE_FILE ) );
 define( 'PMPRO_DOMAIN', pmpro_getDomainFromURL( site_url() ) );
 define( 'PAYPAL_BN_CODE', 'PaidMembershipsPro_SP' );
 
diff --git a/readme.txt b/readme.txt
index 9a82f9513..58352f3ee 100644
--- a/readme.txt
+++ b/readme.txt
@@ -3,7 +3,7 @@ Contributors: strangerstudios, kimannwall, andrewza, dlparker1005
 Tags: memberships, members, subscriptions, ecommerce, user registration, member, membership, e-commerce, paypal, stripe, braintree, authorize.net, payflow, restrict access, restrict content, directory
 Requires at least: 4
 Tested up to: 5.4.1
-Stable tag: 2.3.2
+Stable tag: 2.3.3
 
 Get Paid with Paid Memberships Pro: The most complete member management and membership subscriptions plugin for your WordPress site.
 
@@ -153,13 +153,24 @@ Not sure? You can find out by doing a bit a research.
 8. Membership Account page, display all sections or show specific sections using shortcode attributes.
 
 == Changelog ==
-= 2.3.2 2020-05-07 =
+= 2.3.3 - 2020-05-12 =
+* SECURITY: Fixed SQL injection vulnerability when logged in as an administrator and adding new orders in the dashboard. JVN#20248858 (Thanks, Kenichi Okuno of Mitsui Bussan Secure Directions, Inc)
+* SECURITY: Making sure to properly escape all values on the add/edit order form in the dashboard.
+* BUG FIX: Now properly setting the order status to "error" when an initial payment fails when using PayPal Express. Before the order status would be set as "cancelled", which would count the order toward reports and make it harder to find orders that had errors. (Thanks, Mirco Babini)
+* BUG FIX: Fixed issue with the PMPro logo and some other assets loading over the wrong schema (http vs https) in some cases.
+* BUG FIX: Fixed issue where the chosen discount code was not shown after submitting when adding a new order through the dashboard.
+* BUG FIX/ENHANCEMENT: Using "PMPro" in the admin activity email subject to keep the line shorter and avoid issues when replacing the word "member" via gettext.
+* ENHANCEMENT: Added a pmpro_allow_weak_passwords filter. You can set this to return true (like this https://gist.github.com/ideadude/5a12119b9ce1c2aad87b2d69cb8f9505) to allow weak passwords on the change password and reset password pages. Note that at this time, weak passwords are still allowed no matter the value of this filter. We expect to change that in the future. For now, you can use our PMPro Strong Passwords plugin to force strong passwords at checkout.
+* REFACTOR: Updated the logic around checking the PMPRO_IPN_DEBUG constant in the IPN handler. (Thanks, Mirco Babini)
+
+= 2.3.2 - 2020-05-07 =
 * BUG FIX: Fixed errors calling is_main_query() that came up with certain themes.
 * BUG FIX: Fixed typo in the pmpro_account_profile_action_links filter.
 * BUG FIX/ENHANCEMENT: Added a new force parameter to the pmpro_getAllLevels() function. This is used by the Multisite Membership Add On to fix an issue where levels were missing or incorrect on the subsites.
 * ENHANCEMENT: Removed mention of the ezAdsense plugin, which has been discontinued.
+* ENHANCEMENT: Added $recipient param in sendAdminActivity() function so you can send additional activity emails like this https://gist.github.com/dparker1005/6bf650370a12aef44adf8c8c26d3e906
 
-= 2.3.1 2020-05-01 =
+= 2.3.1 - 2020-05-01 =
 * BUG FIX: Fixed infinite redirect issue if no account page was set. Fixed a few other places where we do is_page() type checks just in case.
 * BUG FIX: Fixed issue where all pages were retitled to Welcome when logged in, if no login page was set.
 * BUG FIX: Fixed issue with BuddyBoss and other themes/plugins that use the_title filter with only one parameter.
diff --git a/services/ipnhandler.php b/services/ipnhandler.php
index 6c978dd2d..bd8f11703 100644
--- a/services/ipnhandler.php
+++ b/services/ipnhandler.php
@@ -361,22 +361,27 @@ function pmpro_ipnExit() {
 
 		echo $logstr;
 
-		//log in file or email?
-		if ( defined( 'PMPRO_IPN_DEBUG' ) && PMPRO_IPN_DEBUG === "log" ) {
-			//file
-			$loghandle = fopen( dirname( __FILE__ ) . "/../logs/ipn.txt", "a+" );
-			fwrite( $loghandle, $logstr );
-			fclose( $loghandle );
-		} elseif ( defined( 'PMPRO_IPN_DEBUG' ) ) {
-			//email
-			if ( strpos( PMPRO_IPN_DEBUG, "@" ) ) {
-				$log_email = PMPRO_IPN_DEBUG;
-			}    //constant defines a specific email address
-			else {
-				$log_email = get_option( "admin_email" );
+		//log or dont log? log in file or email?
+		//- dont log if constant is undefined or defined but false
+		//- log to file if constant is set to TRUE or 'log'
+		//- log to file if constant is defined to a valid email address
+		if ( defined( 'PMPRO_IPN_DEBUG' ) ) {
+			if( PMPRO_IPN_DEBUG === false ){
+				//dont log here. false mean no.
+				//should avoid counterintuitive interpretation of false.
+			} elseif ( PMPRO_IPN_DEBUG === "log" ) {
+				//file
+				$logfile = apply_filters( 'pmpro_ipn_logfile', dirname( __FILE__ ) . "/../logs/ipn.txt" );
+				$loghandle = fopen( $logfile, "a+" );
+				fwrite( $loghandle, $logstr );
+				fclose( $loghandle );
+			} elseif ( is_email( PMPRO_IPN_DEBUG ) ) {
+				//email to specified address
+				wp_mail( PMPRO_IPN_DEBUG, get_option( "blogname" ) . " IPN Log", nl2br( $logstr ) );							
+			} else {
+				//email to admin
+				wp_mail( get_option( "admin_email" ), get_option( "blogname" ) . " IPN Log", nl2br( $logstr ) );							
 			}
-			
-			wp_mail( $log_email, get_option( "blogname" ) . " IPN Log", nl2br( $logstr ) );			
 		}
 	}