Changelogs

FluentCart correlation fixes

Tested live against gauravtiwari.org's FluentCart 1.3.27 — beta2's correlation path was wrong:

• Cart model uses cart_hash as its primary key, not id. Beta2 referenced $cart->id (always null), so the metadata-fallback path could never run. Removed it.
• Order → Cart link goes through wp_fct_order_operations.cart_hash, not a direct $order->cart_id (no such column). The order_paid_done listener now walks Order → orderOperation → cart_hash → Cart and reads checkout_data['core_forms']['submission_id'].
• Variations have no per-row currency; FluentCart is single-currency. Currency is now read from FluentCart\Api\CurrencySettings.
• Per-form preview chip formats price using FluentCart's currency sign + position, surfaces subscription billing summary, trial days, and physical-fulfillment hints.

Form settings UI redesign

Six sections in the Settings tab now use <details>/<summary> accordions matching the Payment and Headless tabs. Each summary carries useful at-a-glance state:

• Submissions — "rate limit 60/h" or "not stored" badges
• After submission — confirmation type badge; redirect URL row only renders when redirect is selected
• Anti-spam — honeypot on/off badge
• Save & resume — on/off badge
• Scheduling — "window set" / "always open" badge
• Advanced — CSS / JS badges when custom code is present

New UI primitives: - Pill-style Yes/No radios with hover/checked state - Number inputs with trailing unit hints (e.g. "submissions / IP / hour") - From → To range pairs for date and time - Day-of-week segmented picker — checked days fill blue - Monospace inset-shadow code textareas for Custom CSS/JS - Tightened form-table spacing inside accordions - Stacks to single column under 1100px viewport

Messages tab redesign

Same accordion pattern. Four core messages grouped under "Submission outcomes" with an explanatory header. Extension-injected <tr> rows get their own accordion when present, otherwise the section is omitted entirely.

Headless / REST API

External sites (Astro, Next.js, plain HTML, anywhere) can now render and submit Core Forms over REST.

• New endpoints under /wp-json/core-forms/v1:
• GET /forms/{id} — schema (HTML + structured fields)
• POST /forms/{id}/submit — runs the same validation/captcha/action pipeline as on-site submissions
• GET /embed.js — drop-in vanilla JS widget
• Site-wide API key (Settings → Headless) gates submissions; per-form Headless tab toggles exposure on/off and shows copy-paste snippets (widget, native fetch, cURL) pre-filled with the actual key.
• Reveal/generate/copy controls on the API key field, status banners on the per-form tab.
• CORS reflected per-origin; captcha is force-recommended since cross-origin submits can't use WP nonces.

FluentCart integration

Hosted-checkout handoff via FluentCart's own checkout — works on free + Pro, one-time + subscriptions.

• New FluentCart payment gateway slots into the existing payments orchestrator alongside Stripe/PayPal/Razorpay/Polar.
• Per-form Variation ID picker with live preview (title, price, payment type, link to FluentCart).
• Listens to fluent_cart/order_paid_done to mark submissions paid and fire the post-payment action loop. order_status_changed_to_refunded syncs refunds back.
• Pricing/currency come from the FluentCart variation — the form's Pricing fields are bypassed when this provider is selected.
• Subscription variations work transparently on FluentCart Pro (FluentCart owns the recurring billing).

UI polish

• Per-form Payment tab sections converted to native <details>/<summary> accordions matching the global Payments gateway list.
• New Headless tab in the form editor with status banners, monospace code blocks, floating copy buttons, color-coded HTTP method tags.
• Same-site gateways (FluentCart) skip the irrelevant Webhook URL row in global settings and explain why no credentials are needed.

What's Changed

• Add payment gateway integration (Stripe, PayPal, Razorpay, Polar)

Improvements

• Convert per-form Payment tab (Provider / Pricing / After payment) to native <details>/<summary> accordions, matching the global Payments gateway list

Fixes

• Fix undefined $form_id in submissions list tab (use $form->ID)

Dashboard navigation, dashboard chrome, submissions polish, and updated documentation links.

Navigation

• New shared views/admin-subnav.php — a tab bar (Forms · Add New · Submissions · Settings · Spam) included from every Core Forms dashboard page, with dashicons and an active-tab underline.
• Old breadcrumb markup hidden via CSS so legacy includes degrade silently.

Page chrome — Form Theme Customizer card style

.cf-page-hero rebuilt as a clean white card matching the Form Theme Customizer: - 1px solid #dcdcde, 8px radius, subtle 0 1px 2px rgba(0,0,0,.04) shadow. - No gradients, no eyebrow pill, no chrome competing with the content. - Heading scales back to 18px / 600 / #1d2327; sub-text 13px / #50575e.

Stat tiles recoloured to the same restrained palette (32×32 icon chip, 18px/600 number, 12px label).

.cf-btn family tightened to native WordPress scale: 7×14 padding, 13px/500, no brand shadow, no lift transform. .cf-btn--secondary uses the standard WP secondary palette so buttons sit comfortably next to native admin chrome.

Submissions

Friendly action labels — new cf_friendly_action_label() helper maps stored WordPress AJAX action keys to human-readable labels: - cf_form_submit → Form Submission - cf_save_draft → Form Draft Saved

Extensible via the cf_action_value_labels filter. Applied in the per-form submissions table and the All Submissions cards.

Strip action from new submissions — action is now in the default cf_ignored_field_names, so future submissions never store the AJAX router key. Existing rows still resolve through the friendly-label map.

Hide column — the Data Management extension grows a non-destructive Hide Column toggle alongside Rename Column and Delete Column. Hidden columns are persisted per-form in _cf_hidden_columns post meta and merged with WordPress's get_hidden_columns(). Rename and Delete handlers keep that meta in sync.

Documentation links

All in-app docs links now point to gauravtiwari.org/course/core-forms-training/ (the previous /core-forms/ subdirectory was defunct). The /product/core-forms/ landing page is reserved for marketing CTAs only.

Upgrade notes

• No data or schema migrations.
• Pure UI / chrome refresh plus opt-in column hiding — fully backwards compatible.
• Existing submissions that already contain the action field stay intact and now render as friendly labels.

Visual refresh — the admin dashboard and the default front-end form theme now share the design language of core-forms.com, with no webfonts loaded anywhere.

Admin design system

New assets/css/design-system.css declares the brand / ink / surface / radius / shadow tokens lifted directly from the marketing site, scoped to Core Forms admin pages so other plugins are untouched.

New components: - .cf-page-hero — gradient page header with eyebrow pill, heading, sub-text, CTA row - .cf-btn family — primary / secondary / ghost in sm / lg sizes, with the marketing-site shadow + lift-on-hover - .cf-stat — KPI tile with brand-tinted icon chip

WordPress chrome inside Core Forms pages picks up the new look: - .wp-list-table, .form-table inputs, .button-primary, .tablenav, .subsubsub, .notice - Brand-blue 4-step focus ring, 8px corner radii, layered shadow scale

Page redesigns

• Forms overview opens with the hero plus four KPI stat cards (active forms, total submissions, submissions today, caught as spam) before the forms list.
• Settings gets the same hero treatment with a Documentation CTA.

Default front-end form theme

Rewrote form-theme.css against the same tokens: - Brand-blue submit buttons with lift-on-hover and the marketing-site shadow (0 4px 12px rgba(47,99,245,.25)) - 8px input radii, hover state on inputs, brand-blue focus border with 4-step focus ring - Soft-tint success / error / warning messages with proper border colors - Secondary buttons for multi-step \"back\" - Dashed brand-tinted drop-zone styling for <input type=\"file\"> - Headings get proper letter-spacing and weight scale

No webfonts

• The admin design system uses the WordPress system stack (-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, …).
• The front-end form theme sets --cf-font: inherit, so each form picks up the host theme's font.
• No fonts.googleapis.com requests anywhere.

Upgrade notes

• No data or schema migrations.
• Pure CSS / template chrome refresh — fully backwards compatible.
• Custom form theme tokens (cf_form_theme_tokens option) keep working unchanged.

Polish release on the 4.x line.

Actions tab — clean card redesign

Every configured action is now a single, unified .cf-action-card: - Icon sits inside the header where it belongs (no more orphan icon stranded to the left of the panel). - Header is a real button with aria-expanded; click to toggle, chevron rotates. - Remove action with confirmation; first card opens by default if there's only one. - Replaces the old dual chrome (PHP ::before blue title bar + JS-wrapped .cf-accordion) with a single source of truth rendered directly by PHP. - Works uniformly across all 28 action types (email, twilio_sms, slack, mailchimp, webhook, notion, airtable, autoresponder, hubspot, etc.).

New template variables for actions

cf_replace_data_variables() now resolves:

Submission source - [CF_REFERRER_URL], [CF_REFERRER_HOST], [CF_REFERRER_PATH] - [CF_POST_ID], [CF_POST_TITLE], [CF_POST_URL] (resolved via url_to_postid() on the referrer)

Logged-in user - [CF_USER_ID], [CF_USER_LOGIN], [CF_USER_EMAIL], [CF_USER_DISPLAY_NAME]

Submission & timing - [CF_SUBMISSION_ID], [CF_DATE], [CF_TIME] (formatted with the site's date/time format)

Site - [CF_SITE_NAME], [CF_SITE_URL], [CF_ADMIN_EMAIL]

Click-to-insert in the variables reference

The Actions tab → "Available Variables" panel is now four columns (Form Fields, Submission Source, User & Session, Form & Site) with a tooltip on every token.

Click any [TOKEN] to insert it at the cursor of the most recently focused input or textarea inside the Actions tab. Brief green pulse confirms the insert. Works on the per-action help text codes too.

Per-action help lines updated

Email, Emailit and Autoresponder now document the most useful new tokens ([CF_REFERRER_URL], [CF_POST_TITLE], [CF_USER_EMAIL] / [CF_SITE_NAME]).

Upgrade notes

• No data or schema migrations.
• Pure UI / template-variable additions — fully backwards-compatible.
• If a third-party extension still emits the legacy .cf-accordion markup around an action, it will keep rendering as before (no-op transitional CSS rule kept).

First stable release on the 4.x line.

Highlights

• Stylesheet bug fix. The Gutenberg block no longer auto-loads form-theme.css regardless of settings. The block now respects the global "Default form theme" toggle and the per-form override, matching the shortcode behavior. (Cause: style field in block.json was force-enqueueing the theme stylesheet on any page that used the block.)
• Block inspector overhaul. New panels in the block sidebar:
• Form — pick a form, jump to its admin editor.
• Header — toggle to show the form title as a heading, choose H1–H6.
• Layout — alignment toolbar (left/center/right), max-width (px/em/rem/%/ch), HTML anchor id, custom CSS class.
• Stylesheets — per-block overrides ("use form/global setting", "force load", "force disable") for both form-theme.css and forms.css.
• Stable version. Bumped from 4.0.0-b9 → 4.0.0 across the plugin header, block.json, package.json, and readme.txt.

Upgrade notes

• No schema or data migrations.
• If you previously relied on the block always loading form-theme.css, make sure your global "Default form theme" setting is enabled, or use the new per-block "Force load" override.
• The max-width block attribute is validated against a strict CSS-length regex (px, em, rem, %, ch, vw, vh); other values are ignored.

Files changed

block.json, render.php, assets/js/src/blocks/form/edit.js, assets/js/build/block-form.js, core-forms.php, package.json, readme.txt.

What's Changed

• Added: Character range (unicode-range) support per font in the Fonts module — limit which characters trigger a font download for faster page loads
• Added: Quick-pick presets in the admin UI for common subsets (Latin, Latin Extended, Greek, Cyrillic, Vietnamese, Punctuation/Symbols)
• Added: unicode-range is also emitted into the theme.json fontFace data layer so it propagates to the block editor
• Security: Login Security no longer trusts X-Forwarded-For / Client-IP headers by default — these were spoofable on direct connections, allowing IP-based lockouts to be evaded or weaponized. Sites behind a trusted reverse proxy or CDN can opt in via the new "Trust Proxy Headers" setting.
• Security: Login Security now validates client IPs through FILTER_VALIDATE_IP when proxy headers are in use, dropping malformed values rather than hashing them into transient keys.
• Fixed: Block Cleanup XPath query now safely escapes class names via a proper XPath 1.0 string-literal builder (addcslashes was the wrong escape function and silently failed on classes containing quotes).
• Fixed: Snippets kses_with_styles() placeholder collision — <style> extraction now uses a per-call random token so a snippet body containing the literal placeholder string can no longer corrupt the output.
• Fixed: Fonts module admin badge now reflects the Style field (free-text input) instead of looking for a <select> that doesn't exist.
• Fixed: Fonts module options static cache is invalidated automatically on update_option_functionalities_fonts, preventing stale font lists when the option is updated mid-request.
• Fixed: Task Manager AJAX handlers (Export, Delete, etc.) now register whenever in admin, so existing projects remain manageable even when the module is toggled off.
• Fixed: Task Manager card layout — widget badge now sits above the action row, so Open/Export/Delete align consistently across cards.
• Fixed: Help & Support buttons now have higher CSS specificity to defeat WP 7.0's button reset.

Commits

• v1.4.6: unicode-range fonts, security & correctness fixes (00223a7)

No detailed release notes were provided for this version.

No detailed release notes were provided for this version.

No detailed release notes were provided for this version.

No detailed release notes were provided for this version.