CVE-2026-8457 is a critical authentication-bypass vulnerability in the WooCommerce Social Login plugin, affecting versions up to and including 2.8.7 and fixed in 2.8.8. It scores 9.8 out of 10 on CVSS. The plugin's Apple login handler does not validate Apple's JWT identity tokens against Apple's public keys, so an attacker can forge a token carrying any email address and be signed in as the matching user. Wordfence describes the result as unauthenticated attackers being able to log in as any existing WordPress user, including administrators. Administrator accounts carry no exclusion protection here, so a successful attempt hands over full control of the site without any legitimate credentials.Source: Search Engine Journal →
Our take: Update to 2.8.8 today if this plugin is installed anywhere you touch. A 9.8 with a forged-token path and no credentials required is the class that gets scanned for within days of disclosure, and social login is the kind of plugin switched on once during a launch and never opened again. For most BigCommerce and Shopify merchants the exposure sits on the WordPress blog or landing-page install on a subdomain beside the store, where the plugin list has not been read in a year and an administrator account is one forged token away.
CSS-Tricks published an explainer on border-shape, a CSS Borders Module Level 4 property that accepts the same values as clip-path — including the newer shape() function — but shapes the whole element rather than clipping it. That distinction is the point: borders, box-shadows, and outlines follow the shaped path instead of being cut off at it, which makes putting a real border on a non-rectangular CSS shape straightforward for the first time. Support is Chrome-only as of July 2026, so treat it as something to explore rather than ship.Source: CSS-Tricks →
Our take: Chrome-only means explore, don't ship. For stores it's eventual relief from the SVG-mask gymnastics behind badge shapes and promo callouts, a progressive-enhancement candidate for late 2026, not a today tool.
Nielsen Norman Group argues UX work should shift toward curating machine-readable context that AI tools consume when they generate design, rather than producing human-only deliverables like personas and reports. The anchor is real: Google Labs open-sourced DESIGN.md in April 2026, a file that lives alongside a product’s code and pairs machine-readable values — colors, type sizes, spacing — with human-readable guidance so a tool knows what a color is actually for. “UX.md” itself is NN/G’s thought experiment, not a standard anyone implements yet. Worth reading as a direction, not a checklist.Source: Nielsen Norman Group →
Our take: The direction is real even if UX.md isn't a standard yet: machine-readable design context is how AI-generated pages stay on-brand. We keep exactly that, tokens plus intent, in this site's repo; it's why AI-assisted edits don't drift the palette.
NN/G recommends moving to a combobox once a list exceeds roughly 15 options, and notes the major design systems all put the small-list cutoff low — the U.S. Web Design System says use radio buttons under 7 items, Material Design draws the line at 6, IBM’s Carbon at 3. It cites GOV.UK research documenting how dropdowns fail users with disabilities: trouble closing them, typing into them, confusing focused items with selected ones, and not realizing more options exist below the fold. GOV.UK’s own position is that dropdowns should be a last resort in public-facing services. Relevant to any store with variant pickers, filter menus, or a long country/state field at checkout.Source: Nielsen Norman Group →
Our take: Count the options in your variant pickers and the checkout country field. Past roughly 15, a searchable combobox beats a dropdown — and checkout is where those seconds cost real money. The accessibility failures GOV.UK documents are lawsuit surface, too.
NN/G names five design dimensions for site-specific AI chatbots: handoff willingness (respecting a user who wants a human), flexibility within defined guardrails, proactivity in suggesting next steps, emotional responsiveness, and transparency about the bot’s identity, capabilities, and reasoning. That last one is becoming a legal requirement rather than a courtesy — the article notes EU rules mandating AI-identity disclosure take effect in August 2026. If you’re putting an assistant on a storefront, the handoff path and the disclosure are the two to get right first.Source: Nielsen Norman Group →
Our take: Adding a storefront assistant? Get two things right before any clever parts: a real path to a human, and clear disclosure that it's a bot. The EU makes the second one law in August, so build it as the default, not the retrofit.
Deep dives, explainers, and the questions clients ask most.
Product detail pages
PDP Design Anatomy
The elements that drive add-to-cart on a product detail page — hero image, variant selector, trust signals, CTA placement, and the mobile-first considerations most desktop-first designers miss.
Where BigCommerce storefronts actually lose speed — app scripts, hero images, carousels, fonts — and the Stencil-specific fixes that get Core Web Vitals to Good and Lighthouse past 95.
BC's hosted checkout vs. custom checkout SDK — what you can and can't customize, the UX decisions that reduce abandonment, and B2B-specific checkout flows (PO number, NET terms, quote approval).
How we approach conversion rate optimization on BigCommerce stores — heatmaps, session recordings, funnel drop-off analysis, and the high-leverage changes that move conversion without a full redesign.