Changelogs

Core Forms 4.7.4 fixes native FluentCRM double opt-in.

• Contacts added as Pending now receive the configured confirmation email after list and tag assignment.
• Existing subscribed or suppressed contacts are not force-resubscribed.

Licensing and automatic updates now run through gauravtiwari.org, the home for every Core Forms license.

• Your existing license key keeps working. Sites re-register themselves on the first admin page load after updating, so there is nothing to re-enter.
• If that automatic step cannot reach the server, the key is left untouched and a notice asks you to reactivate, rather than the license being cleared.
• License checks now retry once on a timeout or server error, so a brief network problem no longer marks an active license invalid.

Full changelog: https://core-forms.com/changelog/

Core Forms 4.7.2 adds per-form Skeleton CSS control without forcing a visual theme.

• Choose the global default, always load forms.css, or always skip it for each form.
• Keep the form-editor preview aligned with the frontend’s resolved Skeleton CSS and form-theme settings.
• Preserve existing form behavior until a per-form override is selected.

Fixed

• Standalone and fullscreen form pages no longer fall back to browser-default controls when the global or per-form built-in theme is disabled.
• Standalone routes now always load the complete Core Forms design baseline and generated theme-token overrides because these pages do not render the active WordPress theme.

Changed

• The default form theme now depends on the core form stylesheet so its layout primitives are always present.
• Added regression coverage for standalone asset loading.

Core Forms 4.7.0 is the admin, design, migration, and Core Commerce release.

Highlights

• Unified Core Forms, Submissions, Core Commerce, and Settings under one compact, responsive navigation.
• Added a dedicated Form Theme Customizer with presets, live desktop/mobile preview, accessibility checks, and generated cache-versioned CSS.
• Added selective portable JSON backup and restore for forms, submissions, polls, settings, analytics, and complete Core Commerce data.
• Rebuilt Core Commerce around next actions, product readiness, customers, licenses, orders, and storefront publishing.
• Added case-insensitive customer records with order, license, activation, and site metadata.
• Added copy-ready product blocks and shortcodes plus single-product-page publishing guidance.
• Replaced the all-submissions card grid with a searchable sortable table and improved responsive controls throughout the plugin.
• Fixed starter-template previews, preview/frontend theme drift, Warm preset styling, LTR select arrows, checkbox alignment, and help text sizing.

Compatibility

• WordPress 6.4 or newer
• Tested through WordPress 6.8
• PHP 8.1 or newer

Integrity

• SHA-256: 9c4974ebe162f16790e7fc7c8927458473ca894b7abc2a57b20f13b9be537c4b
• ZIP size: 1,097,202 bytes

Full public changelog: https://core-forms.com/changelog/

Core Forms 4.6.3 improves validation, licensing reliability, headless submissions, and the Core Forms admin experience.

• Renames the Forms dashboard to Core Forms, adds the installed version badge, and renames Products & Licensing to Core Commerce.
• Fixes schema and legacy-form validation, same-name choice groups, empty select placeholders, and invalid-submission rate-limit accounting.
• Fixes headless REST error statuses, nonce-enforced submissions, array-field normalization, and canonical field descriptions.
• Fixes Emailit v2 sends and contact subscriptions being marked failed after a valid HTTP 200 response.
• Makes activation records self-healing, retries transient license requests, and preserves the local key when remote deactivation fails.
• Removes the redundant one-page Core Commerce footer and misplaced card treatment.

A public Storefront API for headless storefronts, plus a block editor and builder preview that finally look like the real form.

Added

• Added a public, read-only Storefront REST API for static sites and external product embeds, exposing active-only product and plan data with resolved icons, hosted checkout URLs, filters, pagination, CORS, caching, and ETags.
• The form skeleton (forms.css) and default theme (form-theme.css) now load inside the Block Editor canvas, so the Core Form block preview matches the published page instead of rendering unstyled.

Changed

• The License Issuing Server no longer takes over an existing /checkout/ page it does not own. When that slug is already taken it provisions /core-checkout/ instead, leaving WooCommerce and hand-built checkout pages untouched.
• Replaced every DOING_AJAX constant check with wp_doing_ajax(), which is filterable and the supported API.
• Removed the orphaned AllSubmissionsTable::forms_dropdown() and ::date_filters() methods.

Fixed

• Fixed the form builder preview pane painting unstyled before restyling itself. Its stylesheets were enqueued from a wp_head callback at priority 10, after core prints styles at priority 8, so they only ever reached the footer's late-style pass.
• Fixed the form builder preview request not being recognised as containing a form, which let the unused-asset cleanup dequeue the preview's own stylesheets.
• Corrected several inaccurate PHPDoc return types reported to callers and tooling, and declared Form::$id as the read-only alias __get() already served.
• The licensing maintenance cron callback no longer returns its summary array to do_action().

Note: 4.6.1 was prepared but never published, so its changes are folded into this release and no v4.6.1 tag exists.

Requires: WordPress 6.4+ · PHP 8.1+ · Tested up to WordPress 6.8

Core Forms 4.6.0 connects forms, payments, digital products, and software licensing in one native WordPress workflow.

• Rebuilt Products & Licensing around searchable product, license, and order tables, product workspaces, setup checks, operational alerts, activity timelines, and validated plugin or theme release ZIPs.
• Added product icons, sample-product generation, and optional purchase and renewal form generation for every active plan.
• Added currency-to-gateway routing with multiple compatible gateways and a preferred gateway for each currency, plus native product checkout without a stored Core Form.
• Expanded purchase templates for Stripe, PayPal, Razorpay, and Polar with optional business, tax, billing, phone, website, and order-note fields.
• Added permissioned commerce REST endpoints and WordPress 6.9+ MCP-discoverable abilities for products, plans, releases, orders, licenses, subscriptions, downloads, gateways, and sample data.
• Added blocks and shortcodes for product catalogs, product lists, single products, prices, buy buttons, checkout, and the customer dashboard, grouped in the Core Forms block category.
• Removed customer emails and full license keys from newly generated renewal and package URLs, added enumeration-safe dashboard access requests, and recorded non-secret commerce activity events.
• Corrected the plugin and installation-documentation product URL to core-forms.com.

Requires WordPress 6.4+ and PHP 8.1+.

Core Forms 4.5.0 makes standalone forms easier to share and stops unrelated pages from paying the CSS cost of features they do not use.

Highlights

• Add clean, configurable standalone URLs such as /collect/form-slug/, while preserving legacy ?cf-form links.
• Load frontend assets from each rendered form’s actual capabilities; basic forms no longer load Smart Forms CSS.
• Support native Post/Redirect/Get submissions when AJAX is disabled.
• Add global and per-form analytics controls, explicit partial-entry capture, consent filtering, runtime diagnostics, and form-usage discovery.
• Fix SQLite activation migrations, poll-cookie scope, and AJAX validation responses.

Verification

• 190 PHPUnit tests / 386 assertions
• PHPStan and ESLint clean
• WordPress Studio clean activation and upgrade tests on WordPress 7.0.2, PHP 8.2, SQLite
• Playwright coverage for AJAX success/error, asset gating, calculations, native submissions, and no-form pages

The licensed updater serves the immutable 4.5.0 package with SHA-256 fc8759e85d4a841556311a2c670e1de7c4e4bd42dcc0e684449acc7cadd3f2d5.

Fixed

• Send Email, Auto-Responder, and Emailit action cards now show variables for the current form fields on the Actions tab.
• Field variables are rendered server-side instead of depending on Fields-tab JavaScript.
• Added regression coverage for named, array, duplicate, and internal field handling.

Security

• Enforces the 254-character email limit and each field's declared maxlength on the server.
• Rejects nested form values and encoded submission metadata above 60 KiB before hooks, storage, or notifications.
• Keeps uploaded file bytes outside that metadata ceiling; upload size remains controlled by the field and PHP limits.

Fixed

• Restores single and multiple multipart file uploads by normalizing PHP's $_FILES data into the submission pipeline.
• Prevents invalid and spam submissions from moving files or persisting temporary upload paths.
• Fixes per-form rate-limit settings, hourly expiry, and AJAX error visibility.

See CHANGELOG.md for the full release history.

Fixed

• Fixed the Gutenberg Core Form block preview taking about 60 seconds to load on busy editor screens by replacing the generic WordPress server-render request with a focused Core Forms preview endpoint, a summary-only form selector, and shared request caching.