Core Forms
Get Core Forms
Shipping in the open

Changelog

Every Core Forms release, with full notes. Most weeks ship a small, focused update. Every release is free for existing license holders.

v4.4.3 Latest

Email action variables now match the fields in the current form

  • Send Email, Auto-Responder, and Emailit action cards now list the current form fields as usable variables.
  • Field variables are rendered on the server, so they no longer depend on JavaScript that only loads on the Fields tab.
  • Array field names are normalized, duplicate variables are removed, and internal form fields stay hidden from the variable list.
Permalink #
v4.4.2

Stricter submission limits and a working per-form hourly rate limiter

  • Added server-side limits for email length, declared field lengths, nested values, and total stored submission size before hooks, database writes, or notifications run.
  • Rendered email fields now include a safe 254-character browser limit while preserving smaller limits configured by the form owner.
  • Restored single and multiple multipart file uploads while keeping binary file sizes under their separate upload limit instead of the submission-metadata ceiling.
  • Invalid and spammed submissions no longer move uploads or retain temporary server paths.
  • Fixed the per-form rate limiter reading the wrong setting and using a one-minute counter for a setting defined as submissions per IP per hour.
Permalink #
v4.4.1

The Gutenberg form preview now loads in under a second instead of stalling for about a minute

  • Fixed the Core Form block preview taking about 60 seconds to load on busy WordPress editor screens.
  • Replaced the generic WordPress server-render request with a focused Core Forms preview endpoint and a summary-only form selector.
  • Shared form-option and preview requests across block instances, avoiding duplicate editor work when a page contains multiple forms.
Permalink #
v4.4.0

The complete 4.4 + 4.5 roadmap: commerce, licensing, integrations, faster forms, and Razorpay

  • Payments: inline Stripe Payment Element checkout with server-owned pricing and idempotent PaymentIntents, plus expanded Razorpay hosted checkout, signed payment/refund webhooks, and improved payment correlation.
  • Licensing commerce: sell any number of plugins, themes, or digital products with one-time and recurring plans, activation limits, renewals, refunds, orders, customer accounts, signed downloads, and a dedicated customer dashboard.
  • License-ready forms: free, Stripe, Razorpay, and renewal templates ship with the correct payment and fulfillment actions. New sites also receive a safe Sample Product with free, USD annual, and INR annual plans.
  • Faster builder: the editor renders only the active tab and boots from server data, eliminating the indefinite loading spinner and unnecessary Analytics/REST work. Markup and schema save together through one bounded request with a standard form-post fallback.
  • Better product administration: product and plan slugs generate automatically, plan prices use normal customer-facing amounts, release ZIPs use the WordPress Media Library picker, and the catalog dashboard includes statistics and quick-start links.
  • Native integrations: WooCommerce, EDD, SureCart, WP Simple Pay, MemberPress, LearnDash, PMPro, Groundhogg, Jetpack CRM, WP-CRM System, SureContact, AutomatorWP, Uncanny Automator, and OttoKit.
  • Operations: Ninja Forms and Formidable Forms importers, expanded WP-CLI form/submission/license commands, and signed Meta/Twilio inbound WhatsApp conversations.
  • Builders and accessibility: Bricks and Elementor integrations plus per-form WCAG 2.2 reports and conservative one-click repairs.
  • Compatibility: the existing core-forms.com CF Licenser client, option shape, automatic-update hooks, and 32-character product-license keys remain unchanged and separate from the new merchant licensing catalog.
Permalink #
v4.3.8

Uppercase field names, richer textarea and phone controls, and corrected release packaging

  • Field names now preserve uppercase letters while continuing to reject unsafe characters.
  • Textarea fields gain rows, resize behavior, and live character-counter controls; phone fields gain min length, max length, and pattern controls.
  • Fixed generated textarea markup dropping validation and conditional-logic attributes on save.
  • Fixed the release package omitting smart-forms.js, block.json, and render.php, restoring frontend smart-form behavior and Gutenberg block registration on installed sites.
Permalink #
v4.3.7

Fixes the updater callback that could crash WordPress after any update or rollback

  • Fixed the upgrader_process_complete migration callback being registered under the plugin namespace while its function lives in the global namespace. Plugin, theme, and core updates now finish without the critical-error screen.
Permalink #
v4.3.6

44px touch-target floor, HCM-safe focus, 5-line textareas, styles at the bottom of <head>

  • Accessibility: every text input, select, textarea and button inside a Core Form now has a min-height of 44 CSS px — the WCAG 2.5.5 AAA touch-target size. Applied in both forms.css and form-theme.css so the floor holds whether you load just the skeleton, just the theme, or both.
  • Accessibility: the keyboard-focus indicator is now Windows High Contrast Mode-safe. The themed :focus-visible state pairs the coloured box-shadow with a transparent 2px outline — HCM strips box-shadow but forces the transparent outline to the system focus colour, so keyboard users on HCM still see a ring. Previously the ring vanished entirely in HCM.
  • Accessibility: forms.css now ships a tiny baseline (44px target, currentColor focus outline, prefers-reduced-motion transition kill-switch) so an author who disables the form theme still gets an accessible-by-default form instead of a bare browser stylesheet.
  • UX: textareas are 5 lines tall by default instead of the browser's stingy 2-line default. Uses lh (line-height) units in both stylesheets with a 140px px fallback for older browsers, so the height tracks the computed line-height rather than being pinned to a px value.
  • Performance: form stylesheets and the poll stylesheet now enqueue at wp_enqueue_scripts priority 99 instead of 20, so they print at the bottom of <head> — after the host theme's styles. No more !important, no specificity arms race, clean cascade override.
  • Performance: poll-frontend.css used to land in the footer (it was enqueued during the_content, after wp_head printed). PollFrontend now pre-scans for core-forms/poll blocks and [cf_poll] shortcodes at wp_enqueue_scripts priority 99 and pre-enqueues the stylesheet, so it lands in <head> on poll pages and is omitted everywhere else.
Permalink #
v4.3.5

Kills a legacy pre-4.0 block script that was hijacking the Gutenberg editor on every site

  • Fixed: the Core Forms block editor experience is back to normal. A legacy pre-4.0 script (assets/js/gutenberg-block.js) was still being enqueued on enqueue_block_editor_assets and registering core-forms/form before block.json could — that's why 4.3.3 and 4.3.4 editors fell back to a generic blue "CF" icon and a single dropdown with no live preview and no inspector panels. The legacy enqueue is gone; block.json now owns the entire editor lifecycle, and the modern Edit component (ServerSideRender preview, Form/Header/Layout/Stylesheets panels, the correct form icon) loads as intended.
  • Fixed: the legacy script had no version arg on wp_enqueue_script, so its URL was cache-busted against the WP core version (?ver=7.0) instead of the plugin version — confusing in dev tools and bad for hot-fix cache invalidation. All block assets now version-bust against CORE_FORMS_VERSION via block.json's version field.
  • UX: reverted the 4.3.4 form-picker label tweak — the dropdown shows "Title (slug)" again so forms sharing a base title (e.g. "Contact" / "Contact Us") stay distinguishable.
Permalink #
v4.3.4

cf_get_form() and submission counts are now request-scoped memoised + small editor polish

  • Performance: cf_get_form() is now request-scoped memoised. The same form requested multiple times per page (block render, get_html, the action loop, the analytics tracker) no longer re-fetches the post + meta and rebuilds the settings/messages arrays — second call onward is a cache hit. Returns clones so callers can't mutate the cached instance. Invalidated on save_post_core-form and *_post_meta hooks (post-type-gated so other CPTs touching meta don't trash the cache), so admin saves still see fresh data inside the same request.
  • Performance: cf_count_form_submissions() is now request-scoped memoised. The forms list table used to issue one COUNT(*) per row — a 50-form admin was 50 queries; now it's 50 cache hits with one query per (form_id, spam-filter) pair. Invalidated on cf_submission_inserted.
  • UX: pressing / or s on the Core Forms list page focuses the search box. Standard list-UI shortcut (GitHub, GitLab, Linear, every modern dashboard). Skipped when an input, textarea, or contenteditable already has focus so it never hijacks typing.
Permalink #
v4.3.3

Missing submission_replies table self-heals + un-spam replays the action loop

  • Fixed: opening a submission no longer throws "Table 'wp_cf_submission_replies' doesn't exist". The reply-history feature queried a table that no installer or migration ever created. The table is now created on activation, on new-blog insert, on multisite activation, and backfilled by a 4.3.3 migration — existing sites self-heal on update.
  • Fixed: moving a submission out of spam via the per-form submissions-table "Not Spam" bulk action now fires the form's success and configured actions (notifications, integrations) that were skipped at submit time. The spam-page single + bulk paths already did this; the per-form table path didn't, so it silently delivered nothing.
  • Internal: the un-spam action replay is centralised in cf_replay_submission_actions() so the single, bulk, and submissions-table paths can't drift apart again.
Permalink #
v4.3.2

Frontend asset loading — only enqueued when a form is actually on the page

  • forms.js, accessibility.js, analytics.js and the form stylesheets only load on pages that actually render a Core Forms block or shortcode — no more global enqueue tax on posts and pages that have nothing to do with forms.
  • Removed the redundant block-level viewScript metadata since rendered forms already enqueue the runtime directly. Cleaner request waterfall, no double-loading.
  • New unit tests for the asset-detection logic, including the poll-only case (a page with a [cf_poll] but no [cf_form] still gets the poll runtime, nothing else).
Permalink #
v4.3.1

License & updates now flow through CF Licenser on core-forms.com — existing keys carry over unchanged

  • Licensing — drop-in replacement for the previous FluentCart-backed license manager. License keys, options shape, and admin UI stay compatible so 4.3.0 installs upgrade with no manual re-entry.
  • Licensing — heartbeat every 6 hours instead of weekly. Update checks also use a 6-hour transient cache, so the "Check for updates now" button always returns a fresh answer when you actually want one.
  • Licensing — update metadata includes the release SHA-256 generated when the ZIP is uploaded, giving the updater and support tools an integrity reference for each release.
  • Licensing — server is multi-product-ready and provider-agnostic from day one (PayPal + Polar wired today; PayPal/Stripe/etc. drop in via a Provider interface).
  • Build — fixed a stale phpstan baseline entry for DAY_IN_SECONDS that the new manager no longer references.
Permalink #
v4.3.0

Polls rework + Gravity / WPForms / Fluent importers + conditional emails (per recipient)

  • Polls — full rework. Tabbed editor (Question / Settings / Schedule / Embed / Results), drag-to-reorder options, "Other" write-in toggle, Duplicate row action.
  • Polls — vote integrity rewrite. Every vote stores a voter_hash (poll + IP + UA + cookie + user) and dedupe queries that single column regardless of mode. Cookie set on render with SameSite=Lax; Secure; persists across AJAX. vote_limit=user rejects anonymous voters at submit. Honeypot on by default, per-IP rate limiter (12/minute).
  • Polls — scheduling (start date + hourly cf_poll_auto_close cron). Post-close behavior: show results / hide / redirect.
  • Polls — change-vote window (per-poll, in minutes) re-renders the form pre-checked so the same voter can update their selection.
  • Polls — Gutenberg block (core-forms/poll). Picker + display-mode; editor preview matches the front of the site (stylesheet registered as both style and editor_style).
  • Polls — opt-in live results (15s polling, pauses on hidden tab); bar / columns / percent result styles.
  • Polls — container-query-driven adaptive layout (cqi units + clamp). Card tunes padding, radius, type scale to its container width, not the viewport. Options auto-flow into multi-column grid in wide embeds.
  • Polls — REST API. Public GET /cf/v1/polls/{id}/results; authenticated GET /cf/v1/polls, /polls/{id}, /polls/{id}/analytics (per-day series).
  • Polls — per-poll analytics screen + CSV export (option label, value, voter hash, IP, user, timestamp, referrer).
  • Polls — accessibility pass. <fieldset><legend>, role="progressbar" with aria-valuenow, role="status" aria-live="polite", focus moves to result heading on submit, prefers-reduced-motion respected.
  • Polls — jQuery removed from poll frontend and admin scripts.
  • Polls — schema migration (cf_db_version → 4.3.0). Adds type / starts_at / allow_other / post_close_behavior / redirect_url / enable_live_results / change_vote_window on wp_cf_polls; option_value / voter_hash / referrer on wp_cf_poll_votes plus a (poll_id, voter_hash) composite index. Existing rows backfilled so historical dedupe keeps working.
  • Importer — Gravity Forms. GFAPI-driven, converts ~14 field types to HTML; every notification becomes a Send Email action with per-recipient conditions when the source notification had its own conditional-logic block; default confirmation maps to the success message / redirect URL; field-level conditional logic carries across as data-show-if / data-hide-if. Field IDs resolve through a per-form name map so condition references stay valid.
  • Importer — WPForms (Lite + Pro). Decodes the JSON form definition, maps notifications, optionally imports stored entries from wp_wpforms_entries (Pro) into wp_cf_submissions so admin history survives the cutover. Success notice shows the entries-imported count.
  • Importer — Fluent Forms. Reads wp_fluentform_forms + wp_fluentform_form_meta directly (no Fluent API dependency, works even when the source plugin is deactivated). Maps fields, notifications, webhooks, and conditional logic.
  • Importer extension point. CF7Migration's source picker now driven by cf_import_sources filter + cf_import_render_section action; three new migrators plug in via a shared BaseMigration abstract class. Field names always carry an _<id> suffix so two source fields sharing a label produce distinct names.
  • Send Email — conditional emails (per recipient). New "Recipient routes" repeater on the Send Email action: each route has a field + operator + value + recipient; the first matching route's recipient overrides the default To. The existing action-level conditions block still gates whether the action runs at all; routes only re-target where it sends.
  • Fix: Duplicate row action on the forms list. Clicking Duplicate used to drop the user into the editor for the original form because the URL carries a form_id and the overview page short-circuited into the editor before the list table's single-row handler could run.
  • ESLint inheritance cleared (~80 prettier autofixes + targeted eqeqeq / no-unsafe-wp-apis / no-noninteractive-element-interactions fixes). PHPStan baseline regenerated at level 5. PHP 8.1 / 8.2 / 8.3 unit tests green.
Permalink #
v4.2.10

Fix: Duplicate row action on the forms list now actually duplicates the form

  • Clicking Duplicate on the forms list used to drop the user into the editor for the original form because the duplicate URL carries a form_id and the overview page short-circuited into the editor before the list table could run its single-row action handler. The overview now processes action=duplicate_single first, clones the form, and redirects back to the list.
Permalink #
v4.2.9

Container builder polish — popover redesign, single-column default, real-time preview

  • Add Field popover redesigned — fixed 360px panel with a 4-column icon grid, header bar with title, and a dedicated close button.
  • Popover now dismisses on outside-click or Escape — no more stranded popovers floating over the canvas.
  • Containers default to a single-column wrapper (cols_desktop: 1, tablet/mobile inherit) — authors opt into a grid via the Layout panel when they actually want one.
  • Column changes preview in real time on the canvas — .cf-row grid rules are duplicated locally so the preview updates immediately, no front-end stylesheet dependency.
  • Better drop-target affordance — empty containers and group bodies show a dashed outline at rest and a solid blue highlight while dragging.
  • Cleared two pre-existing PHPStan errors (current_time() bool arg, WP_Screen::$id non-nullable property) that were blocking the release pipeline.
Permalink #
v4.2.8

Container Layout panel — per-breakpoint column counts in the inspector

  • Container field gets a Layout panel in the inspector sidebar — selecting a Container on the Fields tab reveals desktop / tablet / mobile column counts (1–6 each) plus a gap field.
  • Settings persist on the field and emit as inline CSS variables (--cf-cols, --cf-cols-t, --cf-cols-m, --cf-gap) on the saved .cf-row wrapper.
  • Canvas applies the same CSS variables to the container body, so the drag-and-drop area shows the columns layout the user just configured instead of a generic stacked list.
  • Containers initially shipped with a 2-column default (revised to single column in 4.2.9).
Permalink #
v4.2.7

Rollup of the 4.2.1–4.2.7 patch line

  • Polls moved under the Core Forms admin menu — two submenu entries (Polls, Add Poll), parent-file filter keeps the Core Forms item highlighted on poll screens.
  • Template preview iframe modal lifted to admin_footer and listens for [data-cf-preview] clicks via delegation; React template picker on the Fields tab now carries a per-card Preview pill.
  • wp_ajax_cf_template_preview re-registered in the AJAX branch (was gated behind ! DOING_AJAX so the handler never wired during AJAX).
  • Create Comment action now appears in the Actions tab picker — added to the WordPress category with an admin-comments icon.
  • Every starter template lands with a default "Email the admin" action wired in _cf_settings.actions; product_review + page_comment templates ship with Create Comment pre-wired (rating, author/email/content field mappings).
  • New .cf-rating star rating field — radio-based 1–5 picker with CSS-mask icons, reverse-order cascade, keyboard-reachable, per-star screen-reader labels. Code-mode "Insert star rating" toolbar button.
  • New Create Comment / Review action — posts submissions as WP comments, stores rating as comment meta, recomputes cf_rating_average + cf_rating_count post meta. Hooks transition_comment_status so moderation flips keep the aggregate accurate.
  • Five new starter templates: Product review, Lightweight comment form, NPS survey, Bug report, Product waitlist.
  • .cf-row columns container — inline CSS variables (--cf-cols, --cf-cols-t, --cf-cols-m, --cf-gap) drive desktop / tablet / mobile counts up to 6 each. Code-mode "Insert columns row" inserter.
  • Real-time preview sync — code-mode textarea pushes markup to the preview iframe on every keystroke (180ms debounce, postMessage, origin- and form-id-scoped).
  • Form editor preview now enqueues forms.css + form-theme.css with cf_form_theme_tokens overrides so the canvas and code-mode iframe match the front-end render.
  • Global stylesheet settings clarified: Skeleton CSS (forms.css) vs Default form theme (form-theme.css), with explicit descriptions of what each loads. Choices are Load / Skip.
  • After Submission — two-way choice (Show message / Redirect to URL). Removed the redundant "Redirect to a page" option, added contextual help per selection.
  • Create Post and Create Article actions merged — CreateArticle claims the create_post slug; old create_article type forwarded at runtime.
  • Per-form Settings tab opens with only the first accordion (Submissions) by default. After-submission no longer auto-opens.
  • "Add-ons" → "Extras" in Settings + Messages section labels.
  • vendor/autoload.php require guarded with file_exists() so a partial extraction during in-place plugin upgrade can't fatal the site.
  • wp_die() in the template preview now passes HTTP codes via the response arg instead of as the title — unauthorized hits actually return 403/400/404.
  • Localized cfFormTemplates carries preview_url per template; window.CoreFormsAdmin.openTemplatePreview(id, label) exposed for programmatic triggers.
  • Demo-mode guard for the public Playground demo — when CF_DEMO_MODE is defined in wp-config.php, the plugin refuses to boot outside a playground.wordpress.net sandbox.
  • Headless embed: success message no longer renders as "[object Object]". embed.js now plucks .text from the form processor's structured message object.
  • Per-form spam view routes correctly — the form-edit router branches on form_id instead of view=edit, so view=spam / view=all / view=inbox all open the Submissions tab.
  • Submissions list visual cleanup — dropped the inset left border on new/spam rows and the muted-grey text on spam; status reads entirely from the STATUS badge column.
  • Dashicon alignment fix for WP < 7.0 — buttons pairing a dashicon with text (Documentation, Refresh, copy buttons in Headless) had the glyph ~2px above the text baseline on 6.9.x; high-specificity scoped rule fixes it.
Permalink #
v4.2.0

WhatsApp, CF7 migration, analytics, revisions, security hardening

  • WhatsApp, three ways. New WhatsApp Cloud API action (Meta's Graph API, free tier covers 1,000 conversations/month, built-in Test connection button), Twilio WhatsApp action (reuses existing Twilio creds, supports Content Template SIDs), and Click-to-WhatsApp redirect (wa.me deep link with submission pre-filled as the post-submit redirect). Both Cloud API and Twilio sends log through Email Logs.
  • Contact Form 7 → Core Forms migration tool. New Import page that scans every wpcf7_contact_form, converts shortcode markup to plain HTML (14 tag types), maps the CF7 mail template to a Send Email action, and carries _messages overrides across. Per-row preview before commit. CF7 stays installed and untouched.
  • Per-form analytics dashboard. New Analytics tab with a Funnel postbox (views / starts / submissions / spam), SVG daily-activity chart, field-interactions + top-sources panels, and auto-generated recommendations. Date-range presets 7d / 30d / 90d / 1y plus custom from/to.
  • Form versioning + change history. Every save creates a revision — including settings-only or messages-only saves. _cf_settings, _cf_hidden_columns, and cf_message_* overrides persist alongside each snapshot. New Revisions tab lists each one with author + diff hint; restore drops back into Core Forms admin with a flash and copies meta back automatically.
  • Security hardening — 14 audit findings fixed: CSRF on by default (existing installs preserved via migration), submission mass-assignment closed via markup-derived allowlist, headless API key header-only (no more ?cf_key= leakage), headless CORS allowlist, workflow /actions/test bumped to manage_options, webhook SSRF guard (rejects loopback / RFC1918 / link-local / non-HTTP), email header CRLF injection closed, custom CSS </style> escape closed, polls trust REMOTE_ADDR only, draft saves rate-limited, file upload blocklist extended (html/htm/xhtml/xml/xsl/xslt), honeypot returns opaque success.
  • Admin redesign — WordPress-native everything. New pen-field plugin icon across admin menu, block inserter, and editor placeholder. Analytics + Revisions tabs use native WP chrome (postbox, wp-list-table, tablenav, row-actions, notice variants). Button styling unified — removed the .button-primary glow override. Display mode (Typeform-style fullscreen) promoted to a top-level Settings card. Per-form Template picker unified with the Add-New-Form gallery — all 12 templates available everywhere.
  • Headless [CF_REFERRER_URL] fix. Cross-origin Referer headers are stripped to the bare origin by browsers, so the variables were resolving to the WP REST endpoint URL. The submit endpoint now reads _cf_page_url from the JSON body; bundled embed.js forwards window.location.href automatically.
Permalink #
v4.1.0

Payments, headless forms, and a new admin pass

  • Take payments on form submission via Stripe, PayPal, Razorpay or Polar.sh — webhook-verified, with the action loop firing only after the gateway confirms the charge.
  • FluentCart hosted-checkout handoff — pick a product variation on the Payment tab, the form turns the submission into a FluentCart cart and redirects to FluentCart’s checkout. Free + Pro both supported, subscriptions included.
  • FluentCart address fields prefill — billing_country, billing_city, etc. on the form pass straight to FluentCart’s checkout (and to its tax engine) so the user never sees an empty checkout.
  • Six new payment-ready starting points: One-time (Stripe), Donation (PayPal), INR payment (Razorpay), FluentCart product, Subscription (FluentCart Pro), Event ticket — each ships with a provider preselected and a context-appropriate success message.
  • Headless / cross-origin REST submissions — a single API key under Settings → Headless plus a per-form toggle exposes any form via /wp-json/core-forms/v1. Three integration modes: drop-in vanilla JS widget, native fetch, and cURL recipe.
  • Per-form Settings, Messages, and Payment tabs redesigned around <details>/<summary> accordions with state badges (rate-limit count, schedule "window set", honeypot on/off, confirmation type, etc.) so you can see the form’s shape at a glance.
  • Submissions page rebuilt for WP 7.0 — toolbar split into a clean filter card and search card with consistent control heights so taller native dates don’t stagger the row.
  • Custom per-template messages on every starting point — payment templates say "Redirecting to PayPal…", the Booking template says "You’ll get a confirmation email," etc. No more generic "We will be in touch soon."
  • WordPress Screen Options dropdown hidden across all Core Forms admin screens.
  • Akismet status banner removed from form-edit pages — status info doesn’t belong as a banner on screens unrelated to it.
Permalink #
v4.0.3

Dashboard nav + friendlier submissions

  • Unified sub-navigation tab bar across every Core Forms admin page (Forms, Add New, Submissions, Settings, Spam).
  • Page headers redesigned to match the Form Theme Customizer card — clean, restrained, no gradients.
  • Submissions show friendly action labels: cf_form_submit → “Form Submission”, cf_save_draft → “Form Draft Saved”.
  • Non-destructive “Hide Column” toggle on submission columns (alongside Rename / Delete).
  • New action template variables: CF_REFERRER_URL, CF_POST_TITLE, CF_USER_EMAIL, CF_SUBMISSION_ID and more.
Permalink #
v4.0.2

Admin design system + form theme refresh

  • New brand-aligned admin design tokens (colors, spacing, shadows) scoped to Core Forms pages.
  • Default front-end form theme rewritten — modern brand-blue submit buttons, 8px input radii, 4-step focus ring.
  • No webfonts loaded anywhere — the admin uses the system stack, the front-end inherits the host theme’s font.
Permalink #
v4.0.1

Actions tab redesign + new template variables

  • Configured actions are now unified `.cf-action-card` panels — icon inside the header, click to expand, soft remove.
  • Per-action “Available variables” reference panel. Click any token to insert it at the cursor of the focused field.
  • New variables for submission source (referrer URL, post ID, post title) and logged-in user (login, email, display name).
Permalink #
v4.0.0 Major

First stable release on the 4.x line

  • Gutenberg block now respects the global / per-form “Default form theme” toggle (no more force-loaded stylesheet).
  • Block inspector overhaul: form picker, header (show title + heading level), layout (alignment, max-width, anchor), per-block stylesheet overrides.
  • Promoted from 4.0.0-beta — same plugin, same data, no migrations.
Permalink #
v4.0.0-b9 Beta

Final beta polish before stable

  • Final round of bug fixes and copy tweaks ahead of the 4.0.0 stable cut.
  • Vendor refresh (doctrine/instantiator) for PHP 7.4–8.3 compatibility on CI.
  • Block-editor edge-case fixes around form-theme toggle precedence.
Permalink #
v4.0.0-b5 Beta

The big 4.0 beta — schema engine, visual builder, smart forms, 21 integrations

  • Schema-backed form engine with JSON storage, versioning, and migration from legacy HTML.
  • Visual form builder: React 3-column layout (inserter | canvas | inspector), 25+ field types, drag-and-drop, fieldset nesting, 6 starter templates, fullscreen preview.
  • Smart forms: multi-step with progress bar, save & resume via tokenised draft links, field calculations (safe parser), schedule windows, conditional logic with 14 operators and grouped AND/OR rules, accessible inline validation.
  • 21 native integrations across notifications (Email, Autoresponder, Slack, Discord, Telegram, Twilio SMS), marketing/CRM (Mailchimp, ConvertKit, ActiveCampaign, Brevo, Drip, MailerLite, HubSpot, FluentCRM), data (Google Sheets, Notion, Airtable), automation (Webhooks, Zapier, Make), WordPress (Create User, Create Post, Create Article with ACF mapping).
  • Workflow automation: async action queue with background processing, exponential-backoff retries, structured action logs, HMAC-SHA256 webhook signatures.
  • Analytics: form views, starts, submissions, abandonment, field-level drop-off, UTM and referrer attribution, auto-generated recommendations.
  • Native block editor with ServerSideRender live preview, form picker InspectorControls, shortcode transform, block variations, spacing/alignment supports.
  • Security hardening: 50+ bugs fixed across 6 audit rounds, upload MIME validation, 30+ blocked extensions, PHPUnit (114 tests), PHPStan level 5, ESLint.
  • Documentation: 61 markdown files, 11,000+ lines covering getting started, form builder, smart forms, integrations, workflows, analytics, developer reference.
Permalink #
v3.5.0

REST API, submission status, conditional actions

  • Full CRUD REST API for submissions at the `cf/v1` namespace — collection endpoints with pagination, status/spam/date/search filtering, status validation with proper 400/404 errors.
  • Submission status tracking: new, read, replied, archived. Auto-marks as “read” when viewed, “replied” after sending a reply. Bulk status actions in the table; status badges in the global view.
  • Conditional actions: run a form action only when field conditions match. Operators include equals, not equals, contains, does not contain, is empty, is not empty. AND-only logic.
  • Akismet whitelist keywords — bypass spam checks for trusted submissions. Configurable in Settings → Spam protection.
  • One-click form duplication from the forms list. Status column included in CSV exports. Polls database tables created on activation/migration.
  • Security fixes: escaped HTML name attributes in condition row output (XSS), added capability check to form duplication handler, REST API validates status values on update.
Permalink #
v3.4.0

Emailit integration + data-variable fixes

  • Send Email via Emailit — new action to deliver form notifications through the Emailit API instead of `wp_mail()`.
  • Emailit Subscribe — push contacts into Emailit audiences on submit, with multi-audience support and custom field mapping.
  • Emailit API key configuration in global settings.
  • Fixed `[all:label]` — was silently broken (never implemented). Now renders every field with human-readable labels extracted from form HTML.
  • Fixed `[all]`, `[CF_FORM_ID]`, `[CF_FORM_TITLE]` — also previously non-functional. Rewrote `cf_replace_data_variables()` with a clean switch-based implementation.
  • All actions (Email, Autoresponder, MailerPress, Emailit, Emailit Subscribe) auto-detect field names from form HTML when first created — no more manually typing `[EMAIL]`, `[FIRST_NAME]`.
Permalink #
v3.3.2

License API switch to POST

  • Switched the license-manager API to POST requests for compatibility with stricter WAF rules.
  • Hardened the update-check flow on activation; weekly cron schedule now registers reliably.
  • Removed PrismJS syntax-highlighting from the code editor for a smaller admin bundle.
Permalink #
v3.3.0

MailerPress + Fluent Cart integrations

  • MailerPress integration — native list subscription with tag assignment and field mapping. No third-party API to configure.
  • Fluent Cart integration — sync paid customers straight into your MailerPress lists at checkout.
  • Added the Fluent Cart license manager so updates and license verification flow through the same publisher.
Permalink #
v3.2.2

Extensions support + release workflow

  • Plugin now supports a stable extensions API — drop-in modules under `extensions/` register their hooks automatically on load.
  • Build and release workflow rewritten so the GitHub Action ships a clean ZIP without corrupting `composer.lock`.
  • Fullscreen-form fix: container scroll on long forms no longer pins to the viewport edge.
Permalink #
v3.1.7

Production-ready 3.x line

  • Tagging the 3.1 line as production-ready after a month of dogfooding across client sites.
  • Drag-and-drop field reordering in the visual builder, polished and stable.
  • Polls feature finalized with proper database tables and admin UI.
  • Spam management: math captcha, accessibility improvements, developer documentation, and `cf_` prefix migration across UI strings.
Permalink #

Stay current — every release is included.

Buy once and every Core Forms release is yours. Yearly subscribers get every update while subscribed; Lifetime owners get every update, forever. Use code CFLAUNCH for 20% off.

Get Lifetime — $249 Yearly — $59/yr See the roadmap →