Core Forms
Get Core Forms
Shipping in the open

Changelog

Every Core Forms release, with full notes. Most weeks ship a small, focused update. Every release is free for existing license holders.

v4.7.2 Latest

Per-form Skeleton CSS control without forcing a visual theme

  • Added a per-form Skeleton CSS control with options to inherit the global setting, always load forms.css, or always skip it.
  • The form-editor preview now follows the same resolved Skeleton CSS and default form-theme settings as the frontend.
  • Existing forms keep their current behavior unless a per-form Skeleton CSS override is selected.
Permalink #
v4.7.1

Standalone and fullscreen forms keep their complete responsive design baseline

  • Fixed standalone and fullscreen form pages rendering browser-default controls when the global or per-form built-in theme was disabled.
  • Standalone routes now always load the Core Forms design baseline and generated theme-token overrides because the active WordPress theme is not rendered on those pages.
  • Made the default form theme depend on the core form stylesheet and added regression coverage for standalone asset loading.
Permalink #
v4.7.0

A calmer admin, a real theme workflow, portable data, and a complete Core Commerce customer workspace

  • Unified Core Forms, Submissions, Core Commerce, and Settings under one compact product navigation, with contextual actions, responsive controls, persistent save bars, and a searchable action library.
  • Added a dedicated Form Theme Customizer with four presets, live desktop/mobile preview, accessibility checks, copyable CSS, and automatic regeneration of a cache-versioned frontend CSS asset.
  • Added selective portable JSON export and import for forms, submissions and replies, polls and votes, settings and theme tokens, activity and analytics, and all Core Commerce records with destination-safe relationship remapping.
  • Rebuilt Core Commerce around operational next actions, product readiness, store totals, recent activity, guided product setup, and a task-oriented Storefront workspace.
  • Added a case-insensitive Customers view that combines each buyer’s orders, licenses, active sites, and latest activity.
  • Added product-specific Block Editor and shortcode guidance, copy controls, and clear instructions for creating a single-product page when and where the site owner chooses.
  • Replaced the all-submissions card grid with a searchable, sortable table and improved form lists, selects, checkboxes, settings screens, and narrow-screen builder behavior.
  • Fixed starter-template previews resolving as unknown, aligned the Warm preset with frontend output, corrected LTR select arrows, and prevented host themes from enlarging Core Forms help text.
Permalink #
v4.6.3

More reliable validation, licensing, headless submissions, and clearer Core Forms administration

  • Renamed the Forms dashboard to Core Forms, added the installed version beside the heading, and renamed Products & Licensing to Core Commerce across the admin workspace.
  • Fixed required and email validation for schema and legacy forms, repaired same-name choice groups and empty select placeholders, and stopped invalid submissions from reaching the inbox or consuming the successful-submission rate limit.
  • Fixed headless REST errors returning HTTP 200, restored submissions when nonce enforcement is enabled, normalized array fields, and preserved canonical field descriptions and grouped options.
  • Fixed Emailit v2 sends and contact subscriptions being marked as failed when the API correctly returns HTTP 200.
  • Made license activation records self-healing during normal heartbeats, added canonical site and runtime metadata, retried transient activation failures, and kept the local key when remote deactivation fails.
  • Removed the redundant one-page Core Commerce table footer and its misplaced card treatment while preserving real multi-page navigation.
Permalink #
v4.6.2

A public Storefront API for headless storefronts, plus a block editor and builder preview that finally look like the real form

  • Added a public, read-only Storefront REST API for static sites and external product embeds, exposing active-only product and plan data with resolved icons, hosted checkout URLs, filters, pagination, CORS, caching, and ETags.
  • The form skeleton and default theme stylesheets now load inside the Block Editor canvas, so the Core Form block preview matches the published page instead of rendering unstyled.
  • Fixed the form builder preview pane painting unstyled before restyling itself, and stopped the unused-asset cleanup from stripping the preview of its own stylesheets.
  • The License Issuing Server no longer takes over an existing /checkout/ page it does not own — when that slug is already taken it provisions /core-checkout/ instead, leaving WooCommerce and hand-built checkout pages untouched.
  • Replaced deprecated DOING_AJAX constant checks with wp_doing_ajax(), corrected several inaccurate PHPDoc return types, and removed dead admin code.
Permalink #
v4.6.0

Products, currency-aware checkout, software licensing, and customer access now work as one native commerce flow

  • Rebuilt Products & Licensing around searchable product, license, and order tables, product workspaces, setup checks, operational alerts, activity timelines, and validated plugin or theme release ZIPs.
  • Added product icons, sample-product generation, and optional purchase and renewal form generation for every active plan.
  • Added currency-to-gateway routing with multiple compatible gateways and a preferred gateway for each currency, plus a native product checkout that does not require a stored Core Form.
  • Expanded purchase templates for Stripe, PayPal, Razorpay, and Polar with optional business, tax, billing, phone, website, and order-note fields.
  • Added permissioned commerce REST endpoints and matching WordPress 6.9+ MCP-discoverable abilities for products, plans, releases, orders, licenses, subscriptions, downloads, gateways, and sample data.
  • Added native blocks and shortcodes for product catalogs, product lists, single products, prices, buy buttons, checkout, and the customer dashboard, all grouped in the Core Forms block category.
  • Corrected the plugin and installation-documentation product URL to core-forms.com.
  • Removed customer emails and full license keys from newly generated renewal and package URLs, added enumeration-safe dashboard access requests, and recorded non-secret commerce activity events.
Permalink #
v4.5.0

Cleaner frontend assets, pretty standalone URLs, and explicit privacy controls

  • Standalone forms now support readable URLs such as /collect/form-slug/, with a configurable base slug, stable per-form public slugs, collision protection, and legacy ?cf-form links kept compatible.
  • Frontend assets now load from each form's actual feature requirements. Basic forms retain inline validation without loading the Smart Forms stylesheet, and pages without forms no longer inherit Core Forms assets from metadata or block discovery.
  • Forms can submit through a native Post/Redirect/Get flow when AJAX is disabled, so validation, success messages, redirects, and stored submissions continue to work without JavaScript.
  • Added global and per-form analytics controls, an explicit partial-entry setting, a consent filter, runtime diagnostics, and direct shortcode/block usage discovery in the form editor.
  • Fixed clean activation and upgrades on SQLite-backed WordPress installations, limited the poll voter cookie to pages that contain a poll, and corrected AJAX validation errors that could reset an invalid form.
Permalink #
v4.4.3

Email action variables now match the fields in the current form

  • Send Email, Auto-Responder, and Emailit action cards now list the current form fields as usable variables.
  • Field variables are rendered on the server, so they no longer depend on JavaScript that only loads on the Fields tab.
  • Array field names are normalized, duplicate variables are removed, and internal form fields stay hidden from the variable list.
Permalink #
v4.4.2

Stricter submission limits and a working per-form hourly rate limiter

  • Added server-side limits for email length, declared field lengths, nested values, and total stored submission size before hooks, database writes, or notifications run.
  • Rendered email fields now include a safe 254-character browser limit while preserving smaller limits configured by the form owner.
  • Restored single and multiple multipart file uploads while keeping binary file sizes under their separate upload limit instead of the submission-metadata ceiling.
  • Invalid and spammed submissions no longer move uploads or retain temporary server paths.
  • Fixed the per-form rate limiter reading the wrong setting and using a one-minute counter for a setting defined as submissions per IP per hour.
Permalink #
v4.4.1

The Gutenberg form preview now loads in under a second instead of stalling for about a minute

  • Fixed the Core Form block preview taking about 60 seconds to load on busy WordPress editor screens.
  • Replaced the generic WordPress server-render request with a focused Core Forms preview endpoint and a summary-only form selector.
  • Shared form-option and preview requests across block instances, avoiding duplicate editor work when a page contains multiple forms.
Permalink #
v4.4.0

The complete 4.4 + 4.5 roadmap: commerce, licensing, integrations, faster forms, and Razorpay

  • Payments: inline Stripe Payment Element checkout with server-owned pricing and idempotent PaymentIntents, plus expanded Razorpay hosted checkout, signed payment/refund webhooks, and improved payment correlation.
  • Licensing commerce: sell any number of plugins, themes, or digital products with one-time and recurring plans, activation limits, renewals, refunds, orders, customer accounts, signed downloads, and a dedicated customer dashboard.
  • License-ready forms: free, Stripe, Razorpay, and renewal templates ship with the correct payment and fulfillment actions. New sites also receive a safe Sample Product with free, USD annual, and INR annual plans.
  • Faster builder: the editor renders only the active tab and boots from server data, eliminating the indefinite loading spinner and unnecessary Analytics/REST work. Markup and schema save together through one bounded request with a standard form-post fallback.
  • Better product administration: product and plan slugs generate automatically, plan prices use normal customer-facing amounts, release ZIPs use the WordPress Media Library picker, and the catalog dashboard includes statistics and quick-start links.
  • Native integrations: WooCommerce, EDD, SureCart, WP Simple Pay, MemberPress, LearnDash, PMPro, Groundhogg, Jetpack CRM, WP-CRM System, SureContact, AutomatorWP, Uncanny Automator, and OttoKit.
  • Operations: Ninja Forms and Formidable Forms importers, expanded WP-CLI form/submission/license commands, and signed Meta/Twilio inbound WhatsApp conversations.
  • Builders and accessibility: Bricks and Elementor integrations plus per-form WCAG 2.2 reports and conservative one-click repairs.
  • Compatibility: the existing core-forms.com CF Licenser client, option shape, automatic-update hooks, and 32-character product-license keys remain unchanged and separate from the new merchant licensing catalog.
Permalink #
v4.3.8

Uppercase field names, richer textarea and phone controls, and corrected release packaging

  • Field names now preserve uppercase letters while continuing to reject unsafe characters.
  • Textarea fields gain rows, resize behavior, and live character-counter controls; phone fields gain min length, max length, and pattern controls.
  • Fixed generated textarea markup dropping validation and conditional-logic attributes on save.
  • Fixed the release package omitting smart-forms.js, block.json, and render.php, restoring frontend smart-form behavior and Gutenberg block registration on installed sites.
Permalink #
v4.3.7

Fixes the updater callback that could crash WordPress after any update or rollback

  • Fixed the upgrader_process_complete migration callback being registered under the plugin namespace while its function lives in the global namespace. Plugin, theme, and core updates now finish without the critical-error screen.
Permalink #
v4.3.6

44px touch-target floor, HCM-safe focus, 5-line textareas, styles at the bottom of <head>

  • Accessibility: every text input, select, textarea and button inside a Core Form now has a min-height of 44 CSS px — the WCAG 2.5.5 AAA touch-target size. Applied in both forms.css and form-theme.css so the floor holds whether you load just the skeleton, just the theme, or both.
  • Accessibility: the keyboard-focus indicator is now Windows High Contrast Mode-safe. The themed :focus-visible state pairs the colored box-shadow with a transparent 2px outline — HCM strips box-shadow but forces the transparent outline to the system focus color, so keyboard users on HCM still see a ring. Previously the ring vanished entirely in HCM.
  • Accessibility: forms.css now ships a tiny baseline (44px target, currentColor focus outline, prefers-reduced-motion transition kill-switch) so an author who disables the form theme still gets an accessible-by-default form instead of a bare browser stylesheet.
  • UX: textareas are 5 lines tall by default instead of the browser's stingy 2-line default. Uses lh (line-height) units in both stylesheets with a 140px px fallback for older browsers, so the height tracks the computed line-height rather than being pinned to a px value.
  • Performance: form stylesheets and the poll stylesheet now enqueue at wp_enqueue_scripts priority 99 instead of 20, so they print at the bottom of <head> — after the host theme's styles. No more !important, no specificity arms race, clean cascade override.
  • Performance: poll-frontend.css used to land in the footer (it was enqueued during the_content, after wp_head printed). PollFrontend now pre-scans for core-forms/poll blocks and [cf_poll] shortcodes at wp_enqueue_scripts priority 99 and pre-enqueues the stylesheet, so it lands in <head> on poll pages and is omitted everywhere else.
Permalink #
v4.3.5

Kills a legacy pre-4.0 block script that was hijacking the Gutenberg editor on every site

  • Fixed: the Core Forms block editor experience is back to normal. A legacy pre-4.0 script (assets/js/gutenberg-block.js) was still being enqueued on enqueue_block_editor_assets and registering core-forms/form before block.json could — that's why 4.3.3 and 4.3.4 editors fell back to a generic blue "CF" icon and a single dropdown with no live preview and no inspector panels. The legacy enqueue is gone; block.json now owns the entire editor lifecycle, and the modern Edit component (ServerSideRender preview, Form/Header/Layout/Stylesheets panels, the correct form icon) loads as intended.
  • Fixed: the legacy script had no version arg on wp_enqueue_script, so its URL was cache-busted against the WP core version (?ver=7.0) instead of the plugin version — confusing in dev tools and bad for hot-fix cache invalidation. All block assets now version-bust against CORE_FORMS_VERSION via block.json's version field.
  • UX: reverted the 4.3.4 form-picker label tweak — the dropdown shows "Title (slug)" again so forms sharing a base title (e.g. "Contact" / "Contact Us") stay distinguishable.
Permalink #
v4.3.4

cf_get_form() and submission counts are now request-scoped memoised + small editor polish

  • Performance: cf_get_form() is now request-scoped memoised. The same form requested multiple times per page (block render, get_html, the action loop, the analytics tracker) no longer re-fetches the post + meta and rebuilds the settings/messages arrays — second call onward is a cache hit. Returns clones so callers can't mutate the cached instance. Invalidated on save_post_core-form and *_post_meta hooks (post-type-gated so other CPTs touching meta don't trash the cache), so admin saves still see fresh data inside the same request.
  • Performance: cf_count_form_submissions() is now request-scoped memoised. The forms list table used to issue one COUNT(*) per row — a 50-form admin was 50 queries; now it's 50 cache hits with one query per (form_id, spam-filter) pair. Invalidated on cf_submission_inserted.
  • UX: pressing / or s on the Core Forms list page focuses the search box. Standard list-UI shortcut (GitHub, GitLab, Linear, every modern dashboard). Skipped when an input, textarea, or contenteditable already has focus so it never hijacks typing.
Permalink #
v4.3.3

Missing submission_replies table self-heals + un-spam replays the action loop

  • Fixed: opening a submission no longer throws "Table 'wp_cf_submission_replies' doesn't exist". The reply-history feature queried a table that no installer or migration ever created. The table is now created on activation, on new-blog insert, on multisite activation, and backfilled by a 4.3.3 migration — existing sites self-heal on update.
  • Fixed: moving a submission out of spam via the per-form submissions-table "Not Spam" bulk action now fires the form's success and configured actions (notifications, integrations) that were skipped at submit time. The spam-page single + bulk paths already did this; the per-form table path didn't, so it silently delivered nothing.
  • Internal: the un-spam action replay is centralized in cf_replay_submission_actions() so the single, bulk, and submissions-table paths can't drift apart again.
Permalink #
v4.3.2

Frontend asset loading — only enqueued when a form is actually on the page

  • forms.js, accessibility.js, analytics.js and the form stylesheets only load on pages that actually render a Core Forms block or shortcode — no more global enqueue tax on posts and pages that have nothing to do with forms.
  • Removed the redundant block-level viewScript metadata since rendered forms already enqueue the runtime directly. Cleaner request waterfall, no double-loading.
  • New unit tests for the asset-detection logic, including the poll-only case (a page with a [cf_poll] but no [cf_form] still gets the poll runtime, nothing else).
Permalink #
v4.3.1

License & updates now flow through CF Licenser on core-forms.com — existing keys carry over unchanged

  • Licensing — drop-in replacement for the previous FluentCart-backed license manager. License keys, options shape, and admin UI stay compatible so 4.3.0 installs upgrade with no manual re-entry.
  • Licensing — heartbeat every 6 hours instead of weekly. Update checks also use a 6-hour transient cache, so the "Check for updates now" button always returns a fresh answer when you actually want one.
  • Licensing — update metadata includes the release SHA-256 generated when the ZIP is uploaded, giving the updater and support tools an integrity reference for each release.
  • Licensing — server is multi-product-ready and provider-agnostic from day one (PayPal + Polar wired today; PayPal/Stripe/etc. drop in via a Provider interface).
  • Build — fixed a stale phpstan baseline entry for DAY_IN_SECONDS that the new manager no longer references.
Permalink #
v4.3.0

Polls rework + Gravity / WPForms / Fluent importers + conditional emails (per recipient)

  • Polls — full rework. Tabbed editor (Question / Settings / Schedule / Embed / Results), drag-to-reorder options, "Other" write-in toggle, Duplicate row action.
  • Polls — vote integrity rewrite. Every vote stores a voter_hash (poll + IP + UA + cookie + user) and dedupe queries that single column regardless of mode. Cookie set on render with SameSite=Lax; Secure; persists across AJAX. vote_limit=user rejects anonymous voters at submit. Honeypot on by default, per-IP rate limiter (12/minute).
  • Polls — scheduling (start date + hourly cf_poll_auto_close cron). Post-close behavior: show results / hide / redirect.
  • Polls — change-vote window (per-poll, in minutes) re-renders the form pre-checked so the same voter can update their selection.
  • Polls — Gutenberg block (core-forms/poll). Picker + display-mode; editor preview matches the front of the site (stylesheet registered as both style and editor_style).
  • Polls — opt-in live results (15s polling, pauses on hidden tab); bar / columns / percent result styles.
  • Polls — container-query-driven adaptive layout (cqi units + clamp). Card tunes padding, radius, type scale to its container width, not the viewport. Options auto-flow into multi-column grid in wide embeds.
  • Polls — REST API. Public GET /cf/v1/polls/{id}/results; authenticated GET /cf/v1/polls, /polls/{id}, /polls/{id}/analytics (per-day series).
  • Polls — per-poll analytics screen + CSV export (option label, value, voter hash, IP, user, timestamp, referrer).
  • Polls — accessibility pass. <fieldset><legend>, role="progressbar" with aria-valuenow, role="status" aria-live="polite", focus moves to result heading on submit, prefers-reduced-motion respected.
  • Polls — jQuery removed from poll frontend and admin scripts.
  • Polls — schema migration (cf_db_version → 4.3.0). Adds type / starts_at / allow_other / post_close_behavior / redirect_url / enable_live_results / change_vote_window on wp_cf_polls; option_value / voter_hash / referrer on wp_cf_poll_votes plus a (poll_id, voter_hash) composite index. Existing rows backfilled so historical dedupe keeps working.
  • Importer — Gravity Forms. GFAPI-driven, converts ~14 field types to HTML; every notification becomes a Send Email action with per-recipient conditions when the source notification had its own conditional-logic block; default confirmation maps to the success message / redirect URL; field-level conditional logic carries across as data-show-if / data-hide-if. Field IDs resolve through a per-form name map so condition references stay valid.
  • Importer — WPForms (Lite + Pro). Decodes the JSON form definition, maps notifications, optionally imports stored entries from wp_wpforms_entries (Pro) into wp_cf_submissions so admin history survives the cutover. Success notice shows the entries-imported count.
  • Importer — Fluent Forms. Reads wp_fluentform_forms + wp_fluentform_form_meta directly (no Fluent API dependency, works even when the source plugin is deactivated). Maps fields, notifications, webhooks, and conditional logic.
  • Importer extension point. CF7Migration's source picker now driven by cf_import_sources filter + cf_import_render_section action; three new migrators plug in via a shared BaseMigration abstract class. Field names always carry an _<id> suffix so two source fields sharing a label produce distinct names.
  • Send Email — conditional emails (per recipient). New "Recipient routes" repeater on the Send Email action: each route has a field + operator + value + recipient; the first matching route's recipient overrides the default To. The existing action-level conditions block still gates whether the action runs at all; routes only re-target where it sends.
  • Fix: Duplicate row action on the forms list. Clicking Duplicate used to drop the user into the editor for the original form because the URL carries a form_id and the overview page short-circuited into the editor before the list table's single-row handler could run.
  • ESLint inheritance cleared (~80 prettier autofixes + targeted eqeqeq / no-unsafe-wp-apis / no-noninteractive-element-interactions fixes). PHPStan baseline regenerated at level 5. PHP 8.1 / 8.2 / 8.3 unit tests green.
Permalink #
v4.2.10

Fix: Duplicate row action on the forms list now actually duplicates the form

  • Clicking Duplicate on the forms list used to drop the user into the editor for the original form because the duplicate URL carries a form_id and the overview page short-circuited into the editor before the list table could run its single-row action handler. The overview now processes action=duplicate_single first, clones the form, and redirects back to the list.
Permalink #
v4.2.9

Container builder polish — popover redesign, single-column default, real-time preview

  • Add Field popover redesigned — fixed 360px panel with a 4-column icon grid, header bar with title, and a dedicated close button.
  • Popover now dismisses on outside-click or Escape — no more stranded popovers floating over the canvas.
  • Containers default to a single-column wrapper (cols_desktop: 1, tablet/mobile inherit) — authors opt into a grid via the Layout panel when they actually want one.
  • Column changes preview in real time on the canvas — .cf-row grid rules are duplicated locally so the preview updates immediately, no front-end stylesheet dependency.
  • Better drop-target affordance — empty containers and group bodies show a dashed outline at rest and a solid blue highlight while dragging.
  • Cleared two pre-existing PHPStan errors (current_time() bool arg, WP_Screen::$id non-nullable property) that were blocking the release pipeline.
Permalink #
v4.2.8

Container Layout panel — per-breakpoint column counts in the inspector

  • Container field gets a Layout panel in the inspector sidebar — selecting a Container on the Fields tab reveals desktop / tablet / mobile column counts (1–6 each) plus a gap field.
  • Settings persist on the field and emit as inline CSS variables (--cf-cols, --cf-cols-t, --cf-cols-m, --cf-gap) on the saved .cf-row wrapper.
  • Canvas applies the same CSS variables to the container body, so the drag-and-drop area shows the columns layout the user just configured instead of a generic stacked list.
  • Containers initially shipped with a 2-column default (revised to single column in 4.2.9).
Permalink #
v4.2.7

Rollup of the 4.2.1–4.2.7 patch line

  • Polls moved under the Core Forms admin menu — two submenu entries (Polls, Add Poll), parent-file filter keeps the Core Forms item highlighted on poll screens.
  • Template preview iframe modal lifted to admin_footer and listens for [data-cf-preview] clicks via delegation; React template picker on the Fields tab now carries a per-card Preview pill.
  • wp_ajax_cf_template_preview re-registered in the AJAX branch (was gated behind ! DOING_AJAX so the handler never wired during AJAX).
  • Create Comment action now appears in the Actions tab picker — added to the WordPress category with an admin-comments icon.
  • Every starter template lands with a default "Email the admin" action wired in _cf_settings.actions; product_review + page_comment templates ship with Create Comment pre-wired (rating, author/email/content field mappings).
  • New .cf-rating star rating field — radio-based 1–5 picker with CSS-mask icons, reverse-order cascade, keyboard-reachable, per-star screen-reader labels. Code-mode "Insert star rating" toolbar button.
  • New Create Comment / Review action — posts submissions as WP comments, stores rating as comment meta, recomputes cf_rating_average + cf_rating_count post meta. Hooks transition_comment_status so moderation flips keep the aggregate accurate.
  • Five new starter templates: Product review, Lightweight comment form, NPS survey, Bug report, Product waitlist.
  • .cf-row columns container — inline CSS variables (--cf-cols, --cf-cols-t, --cf-cols-m, --cf-gap) drive desktop / tablet / mobile counts up to 6 each. Code-mode "Insert columns row" inserter.
  • Real-time preview sync — code-mode textarea pushes markup to the preview iframe on every keystroke (180ms debounce, postMessage, origin- and form-id-scoped).
  • Form editor preview now enqueues forms.css + form-theme.css with cf_form_theme_tokens overrides so the canvas and code-mode iframe match the front-end render.
  • Global stylesheet settings clarified: Skeleton CSS (forms.css) vs Default form theme (form-theme.css), with explicit descriptions of what each loads. Choices are Load / Skip.
  • After Submission — two-way choice (Show message / Redirect to URL). Removed the redundant "Redirect to a page" option, added contextual help per selection.
  • Create Post and Create Article actions merged — CreateArticle claims the create_post slug; old create_article type forwarded at runtime.
  • Per-form Settings tab opens with only the first accordion (Submissions) by default. After-submission no longer auto-opens.
  • "Add-ons" → "Extras" in Settings + Messages section labels.
  • vendor/autoload.php require guarded with file_exists() so a partial extraction during in-place plugin upgrade can't fatal the site.
  • wp_die() in the template preview now passes HTTP codes via the response arg instead of as the title — unauthorized hits actually return 403/400/404.
  • Localized cfFormTemplates carries preview_url per template; window.CoreFormsAdmin.openTemplatePreview(id, label) exposed for programmatic triggers.
  • Demo-mode guard for the public Playground demo — when CF_DEMO_MODE is defined in wp-config.php, the plugin refuses to boot outside a playground.wordpress.net sandbox.
  • Headless embed: success message no longer renders as "[object Object]". embed.js now plucks .text from the form processor's structured message object.
  • Per-form spam view routes correctly — the form-edit router branches on form_id instead of view=edit, so view=spam / view=all / view=inbox all open the Submissions tab.
  • Submissions list visual cleanup — dropped the inset left border on new/spam rows and the muted-gray text on spam; status reads entirely from the STATUS badge column.
  • Dashicon alignment fix for WP < 7.0 — buttons pairing a dashicon with text (Documentation, Refresh, copy buttons in Headless) had the glyph ~2px above the text baseline on 6.9.x; high-specificity scoped rule fixes it.
Permalink #
v4.2.0

WhatsApp, CF7 migration, analytics, revisions, security hardening

  • WhatsApp, three ways. New WhatsApp Cloud API action (Meta's Graph API, free tier covers 1,000 conversations/month, built-in Test connection button), Twilio WhatsApp action (reuses existing Twilio creds, supports Content Template SIDs), and Click-to-WhatsApp redirect (wa.me deep link with submission pre-filled as the post-submit redirect). Both Cloud API and Twilio sends log through Email Logs.
  • Contact Form 7 → Core Forms migration tool. New Import page that scans every wpcf7_contact_form, converts shortcode markup to plain HTML (14 tag types), maps the CF7 mail template to a Send Email action, and carries _messages overrides across. Per-row preview before commit. CF7 stays installed and untouched.
  • Per-form analytics dashboard. New Analytics tab with a Funnel postbox (views / starts / submissions / spam), SVG daily-activity chart, field-interactions + top-sources panels, and auto-generated recommendations. Date-range presets 7d / 30d / 90d / 1y plus custom from/to.
  • Form versioning + change history. Every save creates a revision — including settings-only or messages-only saves. _cf_settings, _cf_hidden_columns, and cf_message_* overrides persist alongside each snapshot. New Revisions tab lists each one with author + diff hint; restore drops back into Core Forms admin with a flash and copies meta back automatically.
  • Security hardening — 14 audit findings fixed: CSRF on by default (existing installs preserved via migration), submission mass-assignment closed via markup-derived allowlist, headless API key header-only (no more ?cf_key= leakage), headless CORS allowlist, workflow /actions/test bumped to manage_options, webhook SSRF guard (rejects loopback / RFC1918 / link-local / non-HTTP), email header CRLF injection closed, custom CSS </style> escape closed, polls trust REMOTE_ADDR only, draft saves rate-limited, file upload blocklist extended (html/htm/xhtml/xml/xsl/xslt), honeypot returns opaque success.
  • Admin redesign — WordPress-native everything. New pen-field plugin icon across admin menu, block inserter, and editor placeholder. Analytics + Revisions tabs use native WP chrome (postbox, wp-list-table, tablenav, row-actions, notice variants). Button styling unified — removed the .button-primary glow override. Display mode (Typeform-style fullscreen) promoted to a top-level Settings card. Per-form Template picker unified with the Add-New-Form gallery — all 12 templates available everywhere.
  • Headless [CF_REFERRER_URL] fix. Cross-origin Referer headers are stripped to the bare origin by browsers, so the variables were resolving to the WP REST endpoint URL. The submit endpoint now reads _cf_page_url from the JSON body; bundled embed.js forwards window.location.href automatically.
Permalink #
v4.1.0

Payments, headless forms, and a new admin pass

  • Take payments on form submission via Stripe, PayPal, Razorpay or Polar.sh — webhook-verified, with the action loop firing only after the gateway confirms the charge.
  • FluentCart hosted-checkout handoff — pick a product variation on the Payment tab, the form turns the submission into a FluentCart cart and redirects to FluentCart’s checkout. Free + Pro both supported, subscriptions included.
  • FluentCart address fields prefill — billing_country, billing_city, etc. on the form pass straight to FluentCart’s checkout (and to its tax engine) so the user never sees an empty checkout.
  • Six new payment-ready starting points: One-time (Stripe), Donation (PayPal), INR payment (Razorpay), FluentCart product, Subscription (FluentCart Pro), Event ticket — each ships with a provider preselected and a context-appropriate success message.
  • Headless / cross-origin REST submissions — a single API key under Settings → Headless plus a per-form toggle exposes any form via /wp-json/core-forms/v1. Three integration modes: drop-in vanilla JS widget, native fetch, and cURL recipe.
  • Per-form Settings, Messages, and Payment tabs redesigned around <details>/<summary> accordions with state badges (rate-limit count, schedule "window set", honeypot on/off, confirmation type, etc.) so you can see the form’s shape at a glance.
  • Submissions page rebuilt for WP 7.0 — toolbar split into a clean filter card and search card with consistent control heights so taller native dates don’t stagger the row.
  • Custom per-template messages on every starting point — payment templates say "Redirecting to PayPal…", the Booking template says "You’ll get a confirmation email," etc. No more generic "We will be in touch soon."
  • WordPress Screen Options dropdown hidden across all Core Forms admin screens.
  • Akismet status banner removed from form-edit pages — status info doesn’t belong as a banner on screens unrelated to it.
Permalink #
v4.0.3

Dashboard nav + friendlier submissions

  • Unified sub-navigation tab bar across every Core Forms admin page (Forms, Add New, Submissions, Settings, Spam).
  • Page headers redesigned to match the Form Theme Customizer card — clean, restrained, no gradients.
  • Submissions show friendly action labels: cf_form_submit → “Form Submission”, cf_save_draft → “Form Draft Saved”.
  • Non-destructive “Hide Column” toggle on submission columns (alongside Rename / Delete).
  • New action template variables: CF_REFERRER_URL, CF_POST_TITLE, CF_USER_EMAIL, CF_SUBMISSION_ID and more.
Permalink #
v4.0.2

Admin design system + form theme refresh

  • New brand-aligned admin design tokens (colors, spacing, shadows) scoped to Core Forms pages.
  • Default front-end form theme rewritten — modern brand-blue submit buttons, 8px input radii, 4-step focus ring.
  • No webfonts loaded anywhere — the admin uses the system stack, the front-end inherits the host theme’s font.
Permalink #
v4.0.1

Actions tab redesign + new template variables

  • Configured actions are now unified `.cf-action-card` panels — icon inside the header, click to expand, soft remove.
  • Per-action “Available variables” reference panel. Click any token to insert it at the cursor of the focused field.
  • New variables for submission source (referrer URL, post ID, post title) and logged-in user (login, email, display name).
Permalink #
v4.0.0 Major

First stable release on the 4.x line

  • Gutenberg block now respects the global / per-form “Default form theme” toggle (no more force-loaded stylesheet).
  • Block inspector overhaul: form picker, header (show title + heading level), layout (alignment, max-width, anchor), per-block stylesheet overrides.
  • Promoted from 4.0.0-beta — same plugin, same data, no migrations.
Permalink #
v4.0.0-b9 Beta

Final beta polish before stable

  • Final round of bug fixes and copy tweaks ahead of the 4.0.0 stable cut.
  • Vendor refresh (doctrine/instantiator) for PHP 7.4–8.3 compatibility on CI.
  • Block-editor edge-case fixes around form-theme toggle precedence.
Permalink #
v4.0.0-b5 Beta

The big 4.0 beta — schema engine, visual builder, smart forms, 21 integrations

  • Schema-backed form engine with JSON storage, versioning, and migration from legacy HTML.
  • Visual form builder: React 3-column layout (inserter | canvas | inspector), 25+ field types, drag-and-drop, fieldset nesting, 6 starter templates, fullscreen preview.
  • Smart forms: multi-step with progress bar, save & resume via tokenised draft links, field calculations (safe parser), schedule windows, conditional logic with 14 operators and grouped AND/OR rules, accessible inline validation.
  • 21 native integrations across notifications (Email, Autoresponder, Slack, Discord, Telegram, Twilio SMS), marketing/CRM (Mailchimp, ConvertKit, ActiveCampaign, Brevo, Drip, MailerLite, HubSpot, FluentCRM), data (Google Sheets, Notion, Airtable), automation (Webhooks, Zapier, Make), WordPress (Create User, Create Post, Create Article with ACF mapping).
  • Workflow automation: async action queue with background processing, exponential-backoff retries, structured action logs, HMAC-SHA256 webhook signatures.
  • Analytics: form views, starts, submissions, abandonment, field-level drop-off, UTM and referrer attribution, auto-generated recommendations.
  • Native block editor with ServerSideRender live preview, form picker InspectorControls, shortcode transform, block variations, spacing/alignment supports.
  • Security hardening: 50+ bugs fixed across 6 audit rounds, upload MIME validation, 30+ blocked extensions, PHPUnit (114 tests), PHPStan level 5, ESLint.
  • Documentation: 61 markdown files, 11,000+ lines covering getting started, form builder, smart forms, integrations, workflows, analytics, developer reference.
Permalink #
v3.5.0

REST API, submission status, conditional actions

  • Full CRUD REST API for submissions at the `cf/v1` namespace — collection endpoints with pagination, status/spam/date/search filtering, status validation with proper 400/404 errors.
  • Submission status tracking: new, read, replied, archived. Auto-marks as “read” when viewed, “replied” after sending a reply. Bulk status actions in the table; status badges in the global view.
  • Conditional actions: run a form action only when field conditions match. Operators include equals, not equals, contains, does not contain, is empty, is not empty. AND-only logic.
  • Akismet whitelist keywords — bypass spam checks for trusted submissions. Configurable in Settings → Spam protection.
  • One-click form duplication from the forms list. Status column included in CSV exports. Polls database tables created on activation/migration.
  • Security fixes: escaped HTML name attributes in condition row output (XSS), added capability check to form duplication handler, REST API validates status values on update.
Permalink #
v3.4.0

Emailit integration + data-variable fixes

  • Send Email via Emailit — new action to deliver form notifications through the Emailit API instead of `wp_mail()`.
  • Emailit Subscribe — push contacts into Emailit audiences on submit, with multi-audience support and custom field mapping.
  • Emailit API key configuration in global settings.
  • Fixed `[all:label]` — was silently broken (never implemented). Now renders every field with human-readable labels extracted from form HTML.
  • Fixed `[all]`, `[CF_FORM_ID]`, `[CF_FORM_TITLE]` — also previously non-functional. Rewrote `cf_replace_data_variables()` with a clean switch-based implementation.
  • All actions (Email, Autoresponder, MailerPress, Emailit, Emailit Subscribe) auto-detect field names from form HTML when first created — no more manually typing `[EMAIL]`, `[FIRST_NAME]`.
Permalink #
v3.3.2

License API switch to POST

  • Switched the license-manager API to POST requests for compatibility with stricter WAF rules.
  • Hardened the update-check flow on activation; weekly cron schedule now registers reliably.
  • Removed PrismJS syntax-highlighting from the code editor for a smaller admin bundle.
Permalink #
v3.3.0

MailerPress + Fluent Cart integrations

  • MailerPress integration — native list subscription with tag assignment and field mapping. No third-party API to configure.
  • Fluent Cart integration — sync paid customers straight into your MailerPress lists at checkout.
  • Added the Fluent Cart license manager so updates and license verification flow through the same publisher.
Permalink #
v3.2.2

Extensions support + release workflow

  • Plugin now supports a stable extensions API — drop-in modules under `extensions/` register their hooks automatically on load.
  • Build and release workflow rewritten so the GitHub Action ships a clean ZIP without corrupting `composer.lock`.
  • Fullscreen-form fix: container scroll on long forms no longer pins to the viewport edge.
Permalink #
v3.1.7

Production-ready 3.x line

  • Tagging the 3.1 line as production-ready after a month of dogfooding across client sites.
  • Drag-and-drop field reordering in the visual builder, polished and stable.
  • Polls feature finalized with proper database tables and admin UI.
  • Spam management: math captcha, accessibility improvements, developer documentation, and `cf_` prefix migration across UI strings.
Permalink #

Stay current — every release is included.

Buy once and every Core Forms release is yours. Yearly subscribers get every update while subscribed; Lifetime owners get every update, forever. Use code CFLAUNCH for 20% off.

Get Lifetime — $249 Yearly — $59/yr See the roadmap →