Ninja Forms

Security Enhancements:

• verify the license server's certificate when checking and activating licenses
• apply the site's unfiltered HTML restriction to the Not Logged-In and Limit Reached messages
• show option labels in form builder dropdown settings as plain text
• harden merge tag handling of submitted values, visitor IP address, referring page and post details
• enforce the "Require user to be logged in" setting when a form is submitted

Bug Fixes:

• keep hand-coded tables intact in the Email action message editor
• load the Email action rich text editor correctly when a message contains older table markup
• keep Checkbox List calculations working when an option has a blank calc value
• count only typed characters toward the character limit on fields with an input mask
• show an error when a favorite field could not be deleted instead of appearing to remove it
• keep a form's display name when it is imported
• fill in {submission:sequence} in emails re-sent from the Submissions page
• keep date values in the correct format when editing a submission
• keep calculated values in an HTML field when an unrelated field in it changes
• let Date fields created before date modes existed pass required validation
• register the first keystroke or paste in an empty rich text Paragraph Text field
• remove PHP warnings when a form contains a field from a deactivated add-on
• prevent a fatal error on submission when a Collect Payment action's payment add-on is inactive
• keep spacing intact when Paragraph Text reaches its word limit
• remove PHP warnings when exporting submissions with an empty Repeatable Fieldset
• stop the form builder freezing when adding or moving fields in a large Repeatable Fieldset
• prevent a page error when a {querystring:} merge tag receives a list value

Security Enhancements:

• protect HTML fields against script injection through query string merge tag values
• block shortcode execution through submitted field values in Success Message merge tags
• block shortcode execution through the {wp:user_display_name} merge tag
• protect stored submission data against cross-site scripting
• give each Email action CSV attachment its own private file
• always escape field values in Email and Success Message actions, regardless of how the action was saved

Bug Fixes:

• restore the Quote Request form template
• make the resize handle work in the Email action HTML source editor
• return the correct URL from {wp:post_url} when a form is on the home page
• remove the "Undefined variable $errors" PHP warning from Confirm fields
• show Repeatable Fieldset values on the Submissions page after switching forms
• keep List field values from being copied into new entries when a form has more than one Repeatable Fieldset
• keep the page at the new entry after adding another Repeatable Fieldset entry
• keep field values containing special characters intact in emails and success messages
• leave out deleted Repeatable Fieldset fields when re-sending an email action
• handle merge tags in Email action To, CC and BCC fields as valid address lists
• make "Add New Terms" work on the front end for Terms List fields
• show term names instead of term IDs in Terms List submissions
• show field labels that contain HTML as readable text on the New Submissions page
• use one translatable message for required-field errors
• return a 404 for public link URLs with invalid keys
• keep forms loading when another script replaces the page's Underscore library
• show Time Only and Date & Time values inside Repeatable Fieldsets correctly when editing a submission
• use Single Checkbox custom values in Email action CSV attachments and remove the related PHP warnings
• remove the legacy ninja_forms_load_deprecated option
• regularly clean up expired session data
• look up newsletter lists only in the form builder instead of on every page view
• improve reliability of opt-in usage data and limit how much is stored when reports are not acknowledged

Security Enhancements:

• strengthen sanitization of Paragraph Text (Rich Text) field submissions against stored cross-site scripting

Bug Fixes:

• save File Upload and other fields inside a Repeatable Fieldset correctly
• remove "Undefined array key fields-save-toggle" PHP warning when saving submissions
• remove foreach() PHP warnings when a repeatable fieldset is left blank
• display calculation values with the correct locale separator in form actions
• stop embedded-page forms from reflecting unsaved builder changes
• hide unknown fields from merge tag name search results
• stop the "Congratulations" popup from appearing after every builder action
• send opt-in telemetry only once
• fix the AM/PM indicator for long date/time formats
• prevent an unnecessary redirect with GET parameters on a second submission
• fix the broken Front End Posting documentation link
• support reCAPTCHA v3 when the same form is embedded multiple times on a page
• show copied fields in the merge tag list
• allow number fields to be pre-populated via query strings
• add the {other:formatted_date} merge tag to core
• rename the "Disable Browser Autocomplete" setting for clarity and note that browsers may still autofill
• reject list fields created without options through the abilities API

Security Enhancements:

• strengthen output escaping in admin submission edit screen; responsibly reported by Venkateswara Reddy Challa
• protect CSV export against object injection in stored submission data
• enforce server-side option validation for list fields

Bug Fixes:

• add CSS class setting to Hidden fields
• make Select Image field mobile responsive
• use relative paths for image URLs in Select Image field
• fix JavaScript error when deleting forms in dashboard
• resolve PHP warning for undefined reCAPTCHA settings key
• display form title correctly when heading level is unset
• return proper error when submission abilities reference nonexistent submission
• prevent fatal memory error on Get Help page with large debug logs
• silence PHP 8 warning from add-on update checker when store returns no record

Security Enhancements:

• strengthen input validation for unserialize() operations

Bug Fixes:

• preserve newsletter action list selection when provider connection is temporarily unavailable
• encode special characters correctly in CSV submission exports
• allow optional and hidden Date/Time fields to pass validation
• keep rich text editor scrollbar visible and functional in all views

Security Enhancements:

• enforce granular two-tier permission model in Abilities API, responsibly reported by ChinhNguyen
• neutralize shortcode brackets in IP address and referer URL merge tags, responsibly reported by Jakub Herman
• validate repeater child field entries against server-side definitions
• apply context-correct output escaping in legacy submissions admin
• ensure shortcode neutralization callback is accessible for array inputs

Bug Fixes:

• fix fatal error when Date/Time field is included in a CSV email attachment
• show correct Developer Mode status notice in form builder settings drawer

Security Enhancements:

• strengthen input validation for list field option imports

Bug Fixes:

• allow non-Latin characters and special symbols in list field option values
• preserve HTML formatting in checkbox and radio list option labels after editing
• capture time values correctly when Date/Time field is inside a Repeater
• preserve user-authored HTML in rich text editor without restructuring on toggle
• preserve HTML comments in Email Message field through Source/Visual toggles
• keep heading-formatted text inside table cells in rich text editor
• preserve nested div elements in HTML field editor
• prevent editor from marking field as changed on initial load
• display rich text editor toolbar icons for logged-out users
• prevent fatal error when marketing feed data is corrupted
• delay Date/Time required validation until user finishes entering time
• make Date/Time field Hour and Minute placeholder text translatable
• resolve critical error on non-English sites running PHP 8+
• fix TypeError when Custom Input Mask contains only numbers
• show correct AI provider status when Ollama connector is configured

Enhancements:

• add AI Form Builder: generate forms from natural language prompts via the Abilities API

Bug Fixes:

• fix typed signatures with periods appearing incomplete after switching fields
• prevent form from rendering multiple times when using "Append a Ninja Form" with other plugins
• allow terms list field to be set as required

Bug Fixes:

• tables inserted via toolbar now have visible borders and padding
• preserve hand-coded table HTML in Email Message field
• resolve TypeError when nf-behavioral.js file is missing
• validation error on Time Only field now clears correctly
• required field asterisk displays correctly on multi-form pages
• form builder loads correctly when marketing filter is disabled
• repeatable fieldset data now displays in email summaries

Security Enhancements:

• strengthen SQL query parameter handling

Bug Fixes:

• fix CSV export column alignment for fields placed after repeatable fieldsets
• preserve , , and tags in HTML field editor
• clear validation error on Time Only field when user corrects input
• fix ninja_forms_render_options filter breaking form validation

Bug Fixes:

• fix anchor tag URLs breaking when merge tags are used as querystrings in HTML fields
• fix date field required validation not triggering for Date & Time mode
• fix {other:date} merge tag reporting dates in UTC instead of local timezone

Enhancements:

• add banner-led partner cards to Partner Apps & Services tab

Security Enhancements:

• protect against SQL injection in import settings key
• block unauthenticated shortcode execution; responsibly reported by Meher Sudhakar Abbireddi

Bug Fixes:

• restore visibility of "Almost there..." heading in new-form drawer
• add descender allowance for typed signature fonts in PDF

Security Enhancements:

• protect against unauthorized multisite data deletion
• protect against stored XSS in Repeatable Fieldset
• protect against field metadata override
• protect against calc value injection in list fields
• protect against unauthorized access to submissions via block insertion

Bug Fixes:

• fix merge tag picker falsely triggering for calculation tags with slash in name
• fix phone field truncating last digit when browser autofill includes country code
• fix PHP warning for array offset on null in Model.php
• fix opinionated styles CSS not loading for logged-out users
• fix Gutenberg block editor iframe not loading (add API version 3)
• fix personal data export failing with PHP fatal error in UserDataRequests.php
• fix invisible reCAPTCHA v2 not working due to block scope bug
• fix form builder sidebar not closing when screen width expands
• fix {fields_table} incorrectly including unchecked checkbox fields

Bug Fixes:

• fix date field "default to current date" displaying wrong date with conditional logic
• fix date/date-time field value corruption when editing via submissions backend
• fix checkbox fields not being redacted from record submissions
• fix time display on single submission page for date/time fields
• fix decimal precision loss in calculations

Enhancements:

• increase default visible columns in legacy submissions from 5 to 10
• remove survey promo from admin

Security Enhancements:

• protect against PHP object injection in form import

Bug Fixes:

• fix PHP warnings when retriggering emails from submissions page
• fix bulk export returning no results when selecting a single day

Bug Fixes:

• fix Rich Text Editor content displaying as raw HTML in submissions modal
• fix HTML entity decoding in Rich Text Editor fields
• fix Quill Rich Text Editor inline text alignment not being preserved
• fix unordered list content being stripped in Quill Rich Text Editor
• fix ordered list items getting unwanted markup injected in Quill Rich Text Editor
• limit telemetry to admin only

Bug Fixes:

• fix repeater field data showing as "Array" in email CSV attachments
• fix mixed content blocking CSV downloads
• fix CSV export with multiple repeater fields
• fix repeater fieldset data misalignment in CSV exports
• fix phone numbers with plus sign getting apostrophe prefix in CSV
• fix decimal precision loss in number fields
• fix form title showing blank for accessibility compliance
• fix Quill Rich Text Editor placeholder initialization
• fix merge tags with spaces in names not being recognized
• fix PHP 8.4 nullable type deprecation warnings

Bug Fixes:

• fix Quill.js Rich Text Editor table functionality not working properly
• fix HTML being sanitized/stripped when saving Quill.js RTE content
• fix Quill.js CSS conflicts with certain add-ons
• fix ESC key removing HTML content from success messages with calculations
• fix PHP warning for undefined array key "payment_total_type"
• fix radio and checkbox field alignment for RTL languages

Enhancements:

• improve color contrast for form names on dashboard to meet WCAG 2.2 AA standards
• improve color contrast for "Add New" button on dashboard to meet WCAG AA standards
• add ARIA attributes, keyboard navigation, and focus styles to Quill.js RTE

Bug Fixes:

• fix missing payment data and blank CSV issues in submission exports
• prevent premature deletion of submissions less than 24 hours old
• checkbox merge tags now display custom values instead of 1/0
• fix merge tag population when retriggering emails from Submissions page
• decode HTML entities for Rich Text Editor fields in CSV exports
• fix invalid date display in Dashboard for imported/duplicated forms
• fix calculation merge tags with extra text in hidden fields

Security Enhancements:

• protect block token/refresh endpoint against unauthorized access
• add capability check to render_callback for blocks

Bug Fixes:

• fix drawer close button not working after merge tag insertion
• fix token visibility issue in submissions table block
• remove tabindex from radio lists for accessibility compliance

Enhancements:

• replace Summernote with Quill.js for Rich Text Editor
• improve star rating field accessibility sizing

Security Enhancements:

• protect against XSS in Success Message action
• block merge tag injection in repeater field processing
• harden blocks code against unauthorized access

• Features:*

• Add support for Abilities API

Bug Fixes:

• Prevent loading CDN font per GDPR rules

Bug Fixes:

• Check visibility to prevent post spoofing

Bug Fixes:

• Limit submission token generation

Bug Fixes:

• Prevent unserialization of user submitted values

Bug Fixes:

• Ensure submission block token valid only for given page

Features:

• NEW Signature field

Bug Fixes:

• Ensure opt-in popup can be dismissed
• Allow only ExtraDataHandlers into Submission metabox
• Require form id as integer
• Fix an accessibility issue with labels for HTML and Divider fields.

Bug Fixes:

• Limit submission token generation

Bug Fixes:

• fix undefined $outgoing
• accessibility fix to set autocomplete
• fix checkbox field calculation, was showing 0 when checked

Bug Fixes:

• Ensure nonce use in download and telemetry

Features:

• Add hCaptcha field

Bug Fixes:

• Ensure File Upload link in submissions table is clickable

Bug Fixes:

• Limit submission token generation

Bug Fixes:

• Prevent object wakeup from unserialization

Features:

• Adds Cloudflare Turnstile CAPTCHA as a modern, privacy-friendly alternative to traditional CAPTCHAs.
• Adds configurable theme (light/dark/auto) and size options for Turnstile field.
• Improves accessibility with screen reader support for CAPTCHA challenges.

Bug Fixes:

• Fixes submission expiration failing on forms with 50+ fields processed in chunks.
• Fixes Summernote editor dropdown menus not displaying properly in certain themes.
• Fixes JavaScript errors in merge tags functionality with improved function binding.
• Fixes forced marketing email sending for late-reported opt-ins.
• Prevents Turnstile field from being used within repeatable fieldsets.

Performance:

• Replaces full Summernote library with lightweight Summernote Lite version.
• Removes unnecessary Bootstrap dependencies reducing CSS by 4,616 lines.
• Reduces total codebase by ~12,000 lines for improved page load times.

Other:

• Updates build system to Node.js 20 for better compatibility.
• Improves CSS build process with proper source map generation.
• Adds comprehensive E2E tests for RTE settings and Turnstile integration.
• Updates test folder structure for better organization.

Bug Fixes:

• Limit submission token generation

Bug Fixes:

• Fixes value issue with time_only date field.
• Fixes issue with common value for date/time field in repeatable field sets.
• Fixes incorrect value for single checkbox merge tags.

Bug Fixes:

• Fixes rounding error for number fields.
• Resolves a hang on save in certain circumstances.
• Removes an unused uinstall hook method.

Misc:

• Updates several npm dependencies.

Security Fixes:

• Prevent script tag injection into templates via block prefixes. Thanks to Asaf Mozes for responsibly reporting this security issue.

Misc:

• Concatenates the readme changelog to prevent going over the WP.org word limit.

Bug Fixes:

• Fixes an issue with HelpText causing a collision on save with Conditional Logic add-on.
• Fixes an issue with HelpText causing a collision on save with Stripe add-on.
• Fixes an incorrect icon.

Bug Fixes:

• Fixes an issue with the help text for repeater fields.
• Fixes an issue with form processing being slow on forms with many fields.
• Fixes an issue with translations on the date picker field.
• Fixes an issue with saving repeater fields on duplicated forms.
• Fixes an issue with date/time field in repeatable fieldsets.
• Fixes an issue with repeatable field help text.

Features:

• Improved drawer styles with a refreshed look.

Bug Fixes:

• Prevent stored XSS in various fields

Features

• Add a Google Analytics 4 Action.

Bug Fixes:

• Fix an error related to using calculations in payment gateway actions.
• Fix an error related to File Uploads merge tags.
• Required errors should no longer trigger on removed repeater sets.

Bug Fixes:

• Limit submission token generation

Bug Fixes:

• List fields can now be used for determining the payment total in payment collection actions.
• Fixed PHP warnings when using PHP 8.
• Fixed an issue with the Password confirm field.
• Ensure that time field IDs are unique.
• Fixed an issue with the opt-in email.

Features:

• Allows repeatable fieldsets to be editable in the Submissions page.

Bug Fixes:

• Numbers over 10 billion no longer cause validation errors.

Other:

• Add add-on communication status logs to the System Status page.
• Add additional data points for telemetry.
• Build file updates.

Features:

• New user onboarding
• Add delete forms WP-CLI command

Other:

• JS library updates

Bug Fixes:

• Limit submission token generation

Bug Fixes:

• ensure form id value is numeric in shortcodes; responsibly reported by Peter Thaleikis via Wordfence

Bug Fixes:

• Fixed an accessibility issue related to text contrast when using opinionated styles.
• Fixed accessibility errors related to missing field descriptions.

Bug Fixes:

• Ensure only permitted form previews are available to a given user

Bug Fixes:

• Update timing for widget loading on page builders

Bug Fixes:

• Update timing to load translations after init

Bug Fixes:

• Sanitize calculations input

Bug Fixes:

• Remove legacy duplicate field cleanup from render loop
• Convert HTML encoded characters on submissions page
• Verify we are on an nf_sub post type before loading terms list

Other:

• Add behavioural telemetry data
• Add diagnost information to system status
• Update end-to-end test

Bug Fixes:

• Prevent script in Favorite Fields
• Prevent script in calculation name
• Update field HTML for improved accessibility

Bug Fixes:

• Ensure help text is mobile responsive for single checkbox, single line text, paragraph text
• Prevent non-required blank email field failing validation
• Replace hard-coded strings for translation

Bug Fixes:

• Ensure sanitation of email address for merge tag
• Prevent maintenance mode interception

Bug Fixes:

• Ensure "From Address" email warning shows
• Prevent JS error on datepicker inside fieldset repeater

Other:

• Add PHP compatibility tests
• Add usage telemetry data

Bug Fixes:

• Ensure submissions page form filter finds form titles
• Provide PHP 7.4 support for jsonSerialize method call
• Ensure hCaptcha field functions when safe-listed

Other:

• JS library updates

Bug Fixes:

• Prevent mouse scroll wheel from updating currency masked fields - Issues
• Resolved an error where required field validation was not always firing properly on masked fields
• Correct list value tooltip styling error for Safari and Firefox
• A repeatable fieldset that has triggered a required error maintains the error when the repeatable fieldset is deleted
• First Repeated Fieldset's data is not captured when deleting one of the sets
• Ensure form displays in WP Bakery without needing to refresh page

Other:

• Correct deprecation warnings in SCSS files
• Library updates: The updates affect the structure of the components - mounting and data flow - and the blocks and styling
• Set security resolution for Axios as a dependency of our dependencies
• Reorganize cypress tests
• Add unit tests
• Add initial usage data to telemetry
• High impact accessibility factor corrections

Bug Fixes:

• Validate label settings on change event

Bug Fixes:

• Prevent unused key values on Survey Promo link

Bug Fixes:

• Submissions Table block not displayed on published page on some themes
• Phone field not disabled when expected
• calc value option of list fields not set with help text
• Submission page tooltip icon not displayed on environment not using conventional plugins folder path

Other:

• @wordpress dependencies updates

Bug Fixes:

• Submissions Block not showing all submissions data.
• Fix deleted repeater field missing required data halting submission
• Add "Administration" section for all fields
• Add missing check_admin_referrer parameter
• Sort by Shortcode on forms page as numerical
• Accessibility: update field description and screen readers
• Enable hidden fields in the unique field
• Fix display Form iFrame in Elementor editor

Other:

• Refactor telemetry dispatch to add unit tests

Bug Fixes:

• Ensure submissions page and Append Ninja Form block are visible on WP 6.6

Other:

• Update readme 'tested up to' and 'requires at least'

Bug Fixes:

• prevent licensing CSRF

Bug Fixes:

• prevent deprecated false to array notice in preview
• prevent undefined array key 'plugin' warning in class extension updater
• prevent invalid date error when setting default date format to "j F Y" on non-English languages

Other:

• automated test for version number
• update wordpress library packages
• add documentation links to settings in the form builder

Bug Fixes:

• Protect preview query parameters

Bug Fixes:

• Ensure first name field populates only first, not full, name
• Enable personally identifiable setting outside of dev mode
• Add merge tags 'other' for random, year, month, day

Other:

• Set version resolutions for certain packages
• Improve discoverability of available actions
• Update marketing feed

Bug Fixes:

• Ensure fieldset repeaters function on index values ending in 0 (10, 20, etc)

Other:

• Update tests to run on 6.5.2

Bug Fixes:

• Allow default span tags in form labels

Bug Fixes:

• Ensure submission exports can't be called from any unintended pages
• Prevent injected scripts into submit button and advanced labels
• Prevent XSS on image lists

Other:

• Update add-on images

Features:

• Add 'referer URL' merge tag

Bug Fixes:

• Prevent display error when date format is not set
• Ensure current date stored when default is not modified
• Ensure translation of date strings

Other:

• Add user help text and images
• Add automated tests

Bug Fixes:

• Update code for PHP 8.3

Other:

• Add in-app documentation text and links
• Add scroll bar for long vertical content

Bug Fixes:

• Prevent form display on password protected page
• Sanitize email address on data export request; responsibly reported by stealthcopter via Wordfence

Bug Fixes:

• Prevent deprecated warning from license updater
• Ensure date picker calendar view honors date range year limits
• Improved management of submission expiration request
• Prevent autocomplete on fields set to disable autocomplete
• Prevent error when fetching add-on list

Other:

• Add second "Add New Field" control for enhanced user experience
• Update JS libraries
• Update WP scripts and block utilities
• Update UTM links

• Features:*

• Ability to preserve 'extra' data after redirect

• Bug Fixes: *

• Ensure extra data on CSV export is in correct chronological order

• Other: *

• Updated end to end test

• Bug Fixes: *

• Prevent script triggers in field labels
• Ensure needed export data present before action

• Other: *

• Update to country list
• Close notice from bulk export results

• Bug Fixes: *

• Error re-triggering email action when PDF is active
• Display anonymized repeater field data in submissions
• Error on missing class name
• Remove Max-width CSS being applied to form content
• misspelled text fixes

• Other *

• Dependencies bumps

• Bug Fixes: *

• rePrints data on the template for the frontend in order to prevent conflicts with other plugins
• checks if the description of fields in the builder is set before running trim

• Bug Fixes: *

• Fixes form not displaying and form stuck on processing from jQuery trim() failure on non-string

• Other: *

• Remove old promotions banner

• Bug Fixes: *

• Form should now submit properly if submit button label and processing label match.
• Ensure forms display on themes using wp_localize_script

• Other: *

• Remove support for NF 2.9
• JS dependency updates: update to React 18, WordPress block editor/scripts/server side render/i18n, babel-jest, core-js

Bug fixes:

• Fix submission retrieval error missing submissions within time stamp on date
• Ensure 7.4-required functionality doesn't trigger warnings

Other:

• Update library for autonumeric, WP scripts
• Update tested up to, now 6.3 was 6.2.2

Bug fixes:

• Correct issue that prevented form deletion

Bug fixes:

• Use static call for class name for PHP 7 support

Other:

• Ensure minimum required version on packages

Security Enhancements:

• Prevent unauthorized download of submission
• Prevent scripts in dashboard field labels; responsibly reported by Sayandeep Dutta
• Prevent front-facing label scripts; responsibly reported by Jonathon Zamora & WordPress.org
• Prevent excess extra data through automated form submission
• Prevent override access where not permitted

Bug Fixes:

• Remove duplicate radio bubble on opionated styles mobile
• Restrict delete file route to uploads directory

Other:

• Bump @wordpress/jest-preset-default from 10.9.0 to 11.4.0 #6579
• Bump core-js from 3.30.1 to 3.30.2 #6578
• Bump axe-core from 4.7.0 to 4.7.1 #6577
• Bump @wordpress/components from 23.9.0 to 24.0.0 #6576
• Bump @babel/core from 7.21.5 to 7.21.8 #6575
• Prototype Pollution in lodash
• Regular Expression Denial of Service in trim
• glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex
• Uncontrolled Resource Consumption in trim-newlines
• Inefficient Regular Expression Complexity in nth-check

Bug Fixes:

• Prevent bypass of required field with modified data
• Prevent datepicker to break the view when set with 0 minutes increment
• Prevent Submit button to double submit a form

Bug Fixes:

• Ensure HTML fields load merge data
• Add fieldset repeater uploads to CSV and emails

Bug Fixes:

• Prevent possible XSS vulnerability

Bug Fixes:

• Ensure cron_interval value is integer
• Ensure option definition value has fallback value
• Ensure cache update process doesn't break on errant stored data
• Replace deprecated use of self in callable
• Use form Id to filter field searches for faster response

Bug Fixes:

• Error management in Repeater fieldsets (fields inside repeater fieldsets now respond to frontend validation)
• Display repeater field data in HTML field via merge tags
• Include Repeater data in CSVs when the repeater wasn't repeated
• Display repeater data in retrigger email actions (and its CSV)
• Display Correct repeater child fields labels in emails
• Display repeater description on form
• Ensure correct rendering of date field in repeaters
• CSVs now display repeaters data as one row for each fieldset

Fixes for extensions:

• Save progress display repeater field without errors
• Multi-part compatibility display repeater field, with merge tags and data saved correctly

Bug Fixes:

• Migrate/update jBox library
• Ensure language filter results are passed to downstream filters
• Prevent non-string math error

Other:

• Add version checks for extensions

Bug Fixes:

• Prevent deprecated warning null preg_match_all
• Ensure empty form does not throw error on preview
• Ensure array for currency doesn't throw fatal error
• Declare previously undeclared properties (PHP 8)
• Prevent undefined array key error
• Ensure missing key in recaptcha field doesn't fail

Bug Fixes:

• Ensure HTML injected in label is sanitized
• Correct typo in date format for option DD/MM/YYYY
• Ensure GMT offset setting does not prevent submissions page display
• Prevent deprecated notice on empty merge tag "other"
• Prevent deprecated notice for jsonSerialize
• Prevent deprecated notice for passing null value

Bug Fixes:

• Import buffer class to re-enable download as PDF Other Enhancements:
• Add code coverage reporting

Bug Fixes:

• Resolves add-on manager fatal error
• Prevents image in HTML loading error for WP 6.1
• Correct multiple accessibility warnings
• Enables empty step in number field
• Enables default zero value Other Enhancements:
• Update 'tested to'
• Set resolutions to prevent vulnerable child dependencies

Bug Fixes:

• Fixes an issue with trailing commas
• Fixes an issue for some users on PHP7.4 and below. Other Enhancements:
• Update 'tested to'

Bug Fixes:

• Prevent object wakeup in unserialize
• Correct errant variable name is submissions check Other Enhancements:
• Smart suggestions for extensions
• Update 'tested to'

Bug Fixes:

• Fixed naming collision with reCaptcha cookie check
• HTML re-enabled in field labels for users with correct capabilities
• Removed orphaned repeater field setting from advanced settings
• Fixed form imports for non-UTF-8 encoded files

Security Enhancements

• Apply more strict sanitization to merge tag values

Bug Fixes:

• Retrigger emails from Submissions page if form only has 1 Email Action
• Invalid Date message triggered by Date Picker Field
• Typo in Delete Form popup
• Importing a form sets the Step value of any Number field to 1, regardless of the Export value
• Front End Checkbox/Radio lists are not keyboard accessible
• Form Preview Page does not work in themes that enable full site editor
• Public link not working in some themes
• Checkbox Fields with a checked calc value of 0 evaluate to 1 in JS
• Activating Layouts & Styles removes merge tags from email actions until the form is republished
• Trigger error when cookies for reCaptcha v3 were not allowed ( Implemented with hooks )
• Submissions page select dates filter restored

Security Enhancements

• Improve escaping on field template labels and values reported responsibly by Ryan at WP Scan
• Improve sanitization of label values
• Improve authorization check for field imports

Bug Fixes: Restore "Download All Submissions" functionality

Bug Fixes: Correct Repeatable Fieldset CSV output, was Array Array Array Add "Trash" view to React submissions page Fix broken submission view when Date field added to converted CF form

Security Enhancements Remove CSV temp files stored in publicly accessible location, reported responsibly by Agence Web Coheractio - Paris at https://www.coheractio.com

Bug Fixes:

• Fix Danish/Finnish language halts submissions page display
• Exclude confirm field from submission data
• Scroll list fields to prevent extremely tall rows
• Correctly display checkbox value in submission table
• Fix PHP warning on column control
• Remove note, html, submit, confirm fields from CSV export
• Use set date format on CSV export
• Prevent XSS in form title

Bug Fixes:

• Rename 'store submission' to record submission'
• Enable extra data column headers in CSV export
• Use admin labels in tables and export

Bug Fixes:

• Ensure submission column selections are remembered for next viewing
• Ensure date time is properly displayed in submission popup editor
• Display calculations metabox in submissions
• Add temporary submissions page rollback option
• Fix failing search results on submissions page
• Ensure checkbox displays correct value, not always 'checked'

Bugs:

• Prevent data timeout error by reducing size of initial submission request
• Prevent SQL injection from field key
• Prevent overwriting of ConvertKit action name during import
• Ensure forms that don't have email actions appear in submission page list

Bugs:

• Update submission link on form dashboard
• Check for CF database before adding CF data source

Bugs:

• Ensure submissions appear when timezone setting puts submission ahead of current timestamp

Bugs:

• Move sequence id from submission editing to metadata
• Use correct popup for autogenerate Add New modals

Changes:

• Ignore build files from commit

Changes:

• Enable display of Caldera Forms submissions in Ninja Forms submission table

Bugs:

• Prevent button field from being used through search function

Security Enhancements

• Apply more strict sanitization to merge tag values

Bugs:

• Ensure sanitized values enables spaces between classNames

Bugs:

• Ensure cached value of form is stored with sanitized value

Bugs:

• Resolved security vulnerability of admin+ stored XSS on form design

Bugs:

• Resolved security vulnerability in the submissions route. Responsibly reported by Chloe Chamberland at Wordfence.
• Resolved an issue that rarely caused submission to fail on forms containing a multiselect field.

Changes:

• Updated several of our build dependency packages.
• Automated build and deploy to SVN.

Bugs:

• Resolved an error that was causing the plugin to crash on sites using a PHP version below 7.0.

Bugs:

• Bulk resend email should now properly populate the email subject line instead of using a default value.
• Repeatable fieldset data should now display properly in the submission block.
• Corrected an issue that was preventing forms from displaying when repeatable fieldsets contained a date field, a rich text enabled paragraph field, or a field with a custom mask.
• When set, the submission limit should now be properly enforced on submissions made via forms loaded before the limit was reached.
• Move to trash should once more be available in the bulk actions on the submissions page.

Changes:

• Added support for Google Recaptcha V3.
• Added a new option to resend email actions from the submissions table.
• Added the ability to export multiple form submission CSVs at once.
• Escape query args for enhanced security - Responsibly reported by Erwan at WP Scan

Bugs:

• Fixed a bug that caused an extra : to be shown in the date field on older forms.
• Fixed a bug with field settings that caused some settings to not show when they should have.
• Multiple Recaptchas on the same page should work properly.

Changes:

• The Date Field is now the Date/Time Field. This field now allows for Date, Time, and Date & Time selection.

Bugs:

• Fixed a bug that caused ReCaptcha fields to fail if more than one appeared on the page.
• Fixed a conflict with iThemes that was causing a fatal error.

Changes:

• Final deprecation phase of Ninja Forms 2.9x codebase.

Changes:

• Removed some legacy settings that were no longer required for new installs.

Bugs:

• Resolved an issue that was causing errors when Array values were used in API requests.
• The Ninja Forms block should now fill the entire width of the block editor.
• Fixed an error that was causing a depreciated method warning when using the classic editor.
• Forms should now display again in Internet Explorer 11.
• Resolved an issue that was causing the Ninja Forms dashboard to crash if there was an issue with wp_cron.
• Fixed some PHP warnings related to our checkbox list field.

Bugs:

• Resolved an issue that was always causing required checkbox list fields to throw a required error on submission.
• The Ninja Forms block should now properly display the form in the page editor if WordPress has been installed in a subdirectory.
• Cleaned up a few notices and warnings that were displaying on sites running PHP 8.

Changes:

• Repeatable Fieldsets have arrived! For a quick look at how to get those setup, check out our new documenation for them.

Bugs:

• Our block editor code should now only load on pages where it is actually needed, leading to less page load time in the admin dashboard.

Security Enhancements

• Apply more strict sanitization to merge tag values

Security:

• Added a missing permissions check in our services connection manager reported responsibly by Chloe Chamberland at Wordfence.
• Patched a potential XSS vulnerability in our querystring merge tag.
• Added a missing filter that should have been excluding some personal information fields from the CSV attachment on Email Actions.

Bugs:

• Forms should once again load properly in Internet Explorer 11.
• Single checkbox fields should now properly display their values in the submission table.
• Updated our dashboard styling to resolve an issue where some translations were resulting in action buttons being obscured.
• Restored drag and drop functionality for adding fields in the form builder.

Security:

• Patched a couple of vulnerabilities in our services oAuth controller reported responsibly by Chloe Chamberland at Wordfence.

Bugs:

• Cleaned up a few conflicts with WordPress version 5.6.
  • Toggle switches in the form builder should now be working as expected.
  • Pre-selected options for lists should now persist properly in the form builder.
  • Element styling of some buttons should properly reflect the active or inactive status of the button.

Bugs:

• Patched an issue with our new date field library that was causing it to display improperly on some mobile devices.

Changes:

• Our date field library has been updated! For you developer types out there, we’ve switched from pikaday to flatpickr.
• Updated some of our form builder scripts in preparation for WordPress 5.6.

Bugs:

• Fixed a visual issue that sometimes allowed the Ninja Forms Dashboard view to extend beyond the width of the browser window.
• Resolved an error that sometimes caused an error message to appear when loading the Dashboard for the first time on a new installation.
• Resolved an error in our termslist field that caused the form builder to crash if you opened a form that was previously mapped to a term that had been deleted.
• Resolved an error that was sometimes causing PDF exports or emails with PDF attachments to fail.

Bugs:

• Resolved an issue that was causing a fatal error on sites running PHP 5.6 or older.

Bugs:

• Added missing dependency for our blocks.

Changes:

• The Views Table Block has arrived!
• Updated the Ninja Forms Block to be more in-line with current Gutenberg conventions.
• Improved the efficiency of submission limit checks.
• The SendWP service can now be linked to the Ninja Forms dashboard.
• Apps & Integrations are now grouped by category for easier sorting.
• Updated color contrast of the form builder to be WCAG compliant.
• Custom Action now requires developer mode to be enabled.
• Updated the File Upload form template.

Bugs:

• Corrected improperly named filter for save action settings.
• Cleaned up some improperly escaped code on our get help page.
• Updated graphics associated with our add-ons to make them display properly.
• Corrected an issue that was causing the password field on our settings page to not properly save values.
• Increased the priority of our form builder class to ensure it properly loads over other elements on the page.
• Field duplication no longer improperly updates the target of calculations.
• Corrected the order of our submenu items.

Security:

• Added escaping for HTML content of fields in the submissions table.

Security:

• Patched a CSRF vulnerability in our services integration reported responsibly by Slavco Mihajloski.
• Patched a validation bypass vulnerability in our email field.

Bugs:

• Resolved an issue that sometimes caused the merge tag menu to not open properly in the form builder.

Bugs:

• Sites with WP_DEBUG enabled should no longer display a deprecated parent error on PHP version 7.4.
• Resolved an issue that was preventing our Screen Options settings from being saved on the submissions page.

Bugs:

• Resolved an issue that caused settings changed with a toggle switch to not be saved on WordPress 5.5.

Security:

• Patched an HTML injection vulnerability in our deprecated 2.9x codebase reported responsibly by Dave Job.

Bugs:

• Corrected an error in our required field validation that was allowing targeted spam through the submission process.

Security:

• Fixed Cross-Site Request Forgery(CSRF) to stored Cross-Site Scripting(XSS) reported responsibly by Ramuel Gall (Wordfence Threat Intelligence Team).

Security:

• Patched an HTML injection vulnerability in our merge tag system. Many thanks to Tom Standley at ContainCo for practicing responsible disclosure.

Bugs:

• User permission filters should now work as expected.
• Select image fields should now work properly when dev mode is disabled.
• Resolved an error that was causing php warnings on some API calls.
• Email settings should now properly read email addresses surrounded by <> characters.
• Resolved an error that was causing deprecated function warnings in php error logs.
• Forms with calculations should now display properly on sites using a "formal" language setting.
• Export should now properly appear as an option in the bulk actions on the submissions page.
• Resolved an error that was preventing the add-on manager from installing plugins.

Changes:

• Add-on updates will now enforce php requirements if the current version on the installation is below the minimum for the add-on.

Security:

• Patched a delayed XSS vulnerability in our email action.
• Hardened the authorization security on our settings page.
• Patched a stored XSS vulnerability on our settings page.

Bugs:

• Ninja Forms should now properly honor user profile language settings if they are not the site default.
• Opening the form builder should no longer result in a php warning about an invalid argument.
• Cleaned up our publish code to avoid a few other php warnings.

Changes:

• Updated our event registration template to be more accessibility compliant.

Security:

• Hardened the authorization security on several of our form endpoints.
• Audited all translation functions to prevent injection attacks.

Bugs:

• The unique field restriction should no longer block payment actions from completing.
• Corrected an error that was preventing the current list of favorite fields from displaying in any location.
• Updated some of our builder styles to account for updates in WordPress 5.3.
• Corrected an error that sometimes caused the images in the select image field to not be found.
• Disabled an internal error logging function that was sometimes causing bloat in our database tables.

Changes:

• Email actions now support file attachments from the WordPress media library.

Bugs:

• Added a missing label to our honeypot field, in case styling errors somehow make it visible.
• Removed an errant console message from our admin dashboard.
• Resolved an issue that was sometimes resulting in warnings being written to logs on form load.
• Modified our Gutenberg block to prevent it from displaying improperly on Bedrock installations.

Changes:

• The select image field has arrived!
• Added functionality for resetting the public link on a form.
• Forms in the dashboard can now be sorted by shortcode (ID).
• Added merge tags for form title, form id, and username (if authenticated).

Bugs:

• Resolved an issue that was causing public links to fail on duplicated forms.
• The merge tag selector box in the form builder should no longer appear halfway off the page on smaller screen sizes.
• Long field keys should no longer cause the merge tag list to cover up the categories in the merge tag selector box.
• Resolved an issue that was causing some actions to fail after returning from a redirected payment gateway.
• List field options on imported forms should now appear in the correct order in the form builder.

Bugs:

• Resolved an error that rarely caused form import to output as successful, when it had actually failed.
• The unique field restriction should no longer honor "nothing" as a valid value.
• Removed some deprecated dependencies that were throwing notices in the block editor.
• Updated list field item import in the form builder to make it less confusing.

Bugs:

• SendWP registration should no longer cause an error when the SendWP plugin is already installed.
• Resolved an issue that was causing several of our action settings to display improperly in Firefox.
• Corrected a problem that was sometimes causing submission of forms with a PayPal action to fail.

Changes:

• Added currency support for the Chinese Yuan.

Security:

• Removed an outdated template that was localizing a couple server variables.

Bugs:

• Currency masks should no longer prevent text fields from working properly in calculations.
• Cleaned up a few php notices due to older functions.
• Corrected the issue that was preventing required updates from completing. (Required updates remain disabled for the time being.)
• Number fields with a minimum value will now display that value as a placeholder, not a value.
• Switched the first and last name translations in our French translation pack.
• Added a missing attribute that was required by screen readers to the fields on our submission editor page.
• Resolved an error that was causing multi-select lists to not work properly in calculations.
• Submission limits should now be honored for forms that were displayed before the limit was reached.
• Dynamic option values should now work for ALL list types.
• Resolved an issue that was causing forms to display as code in some page builders.

Changes:

• The Advanced tab in the form builder should now communicate that developer mode is disabled, if that is the case.
• Added currency support for the Russian Ruble.

Bugs:

• Temporarily disabled required updates in order to investigate a reported issue with them freezing.

Bugs:

• Resolved an issue that sometimes caused the form dashboard to not display.

Bugs:

• Resolved an issue that sometimes caused required updates to fail due to allowed server memory.
• Public form link should now be more reliable without needing to update site permalinks.
• Corrected a typo in the shortcode output of the Display Your Form settings.
• Dailed back our add-on updater script. It was checking for updates too often.
• Resolved an issue that was sometimes causing form submission to hang on processing, even though it had finished submitting data.
• Corrected a typo in the help text for auto-adding a submit button.
• Dynamic options in lists should now work properly everywhere, not just on form display.
• Fixed a couple of broken links on our Get Help page.
• The public link setting should no longer appear on the dashboard for forms where it is not enabled.

Changes:

• Updated our Details page in the WordPress repo.
• Date fields can no longer be added to calculations.

Bugs:

• Restored the display of some action settings that were being improperly hidden in the form builder. (e.g. Stripe metadata and Update Profile custom meta.)
• Resolved an issue that sometimes caused submission to freeze when a required field was left empty.
• Forms should no longer fail to display when a total field is referenced in a calculation.

Bugs:

• Updated our form load process to better account for reported excessive page load times.
• Resolved an issue that was causing various add-ons to behave strangely when there were multiple forms on a single page.

Changes:

• "Light" opinionated styles are now enabled by default on new Ninja Forms installations.

Bugs:

• Multiple instances of the same form can now be loaded on a page.
• Resolved an issue that sometimes prevented favorite fields from being added to a form.
• Realistic preview of multiselect fields will now render more accurately in the builder.
• Resolved an issue that sometimes caused required updates to miscommunicate completion progress.
• Field keys should once more be accessible in submission filters.
• Querystring merge tags should no longer display their tags when the querystring is not present.
• Builder help texts should no longer contain unrendered HTML elements.

Changes:

• Added currency support for the Malaysian Ringgit.
• Added realistic field support for the save button and password field in the form builder.
• Some settings have been registered as developer options, which will be disabled by default to avoid settings clutter.
• Public links are now available for Ninja Forms! Found next to the publish button, public links provide form access to anyone with the link. Just copy and paste the unique URL and anyone can see and use your form.

Bugs:

• Resolved an issue that caused the form builder to crash when editing forms that had a select list with no options.

Bugs:

• Resolved an issue that sometimes caused submission dates to show inaccurately in the submissions table.

Changes:

• We've upgraded our form building experience with realistic field representations!

Bugs:

• Corrected an issue that sometimes caused forms with large calculations to not display properly.

Bugs:

• Resolved an error that was causing form submission to fail on some php versions.

Bugs:

• Resolved several issues that sometimes caused notices to be logged on newer versions of php.
• Changed the priority of the redirect action so that it should always fire last.
• Calculations should now have more consistent results when numbers are input in international formats.

Changes:

• The following field types have been deprecated: Product, Quantity, Shipping, Total.

Changes:

• Upgrade to THREE for legacy users will no longer immediately trigger additional required updates.
• Introducing SendWP - A dedicated WordPress email solution!

Bugs:

• Resolved an issue that was sometimes causing the submission sequence to reset.

Bugs:

• Resolved an issue that was causing some form imports to fail.
• Submission exports of checkbox fields that have been modified by an admin should now display their proper value in the csv.
• Resolved an issue that was rarely causing actions to fire twice.

Bugs:

• Resolved an issue that sometimes caused fields to not appear on the form after publish. (Special thanks to Tim de Hoog and Sidekick-IT).

Bugs:

• Corrected an error that was causing form duplication to fail.
• Sites with WP_DEBUG enabled should no longer display an undefined 'maintenance' column error on form load.

Changes:

• Implemented a new import process, which should be more reliable with large form imports.
• Upgraded our data structure to reduce loading times for forms and the form builder.

Security Enhancements

• Apply more strict sanitization to merge tag values

Security:

• (2.9x) Duplicated previous blind SQL injection patch for our deprecated 2.9x codebase. Many thanks to Plugin Vulnerabilities for reporting that our initial pass missed this.

Security:

• Patched a blind SQL injection vulnerability in the search filter on our submissions page. Thank you to Samuel Anttila at netsec.expert for practicing responsible disclosure.

Security:

• Patched a reflected XSS vulnerability in our administrative dashboard. Thank you to Samuel Anttila at netsec.expert for practicing responsible disclosure.

Bugs:

• Resolved an issue that caused our Gutenberg Block to not dispaly in the post editor when the Twenty Nineteen theme is active.

Changes:

• Product and quantity field merge tags can no longer be referenced in calculations.

Changes:

• Finalized the Gutenberg block. (No longer a Beta feature.)

Security:

• Patched an open redirect vulnerability using a url parameter in our submission download page. Thank you to Muhammad Talha Khan for practicing responsible disclosure.

Bugs:

• Placeholder text should now be visible in number fields that have a minimum value.
• Corrected an error that was sometimes causing number fields to clear themselves when Multi-part Forms is active.

Changes:

• The rich text editor in the form builder should now wrap lines while in code view.

Security:

• Patched a redirect XSS vulnerability using code injection on our submissions page. Thank you to Muhammad Talha Khan for practicing responsible disclosure.

Bugs:

• Resolved an issue where the WordPress is_search function was being called incorrectly in some cases.
• Custom columns should no longer be added to non-Ninja Forms custom post types with meta values containing '_field'.
• Resolved an issue that sometimes caused error log entries related to an invalid IP.
• The form selector on the submissions page should now be visible on mobile devices.
• Resolved an issue that sometimes caused CSV exports to have multiple header rows.

Bugs:

• Pressing the tab key while in the delete a form modal should now shift focus to the delete button.
• Resolved an issue that could have caused some display issues on the dashboard due to cached scripts.

Changes:

• Updated several of our product images on the apps & integrations tab of the dashboard.
• Our in-app marketing feed will now fetch from a remote site for more swift product updates.
• Ninja Shop has arrived!

Bugs:

• Resolved an issue that was sometimes causing upgrades on multi-site to delete forms from other sites on the installation.
• Corrected a bad reference in our Create a Post template documentation.
• List field values sent in an email via CSV should no longer display as NULL if their value was 0.
• Resolved a couple issues that were causing server warnings.

Changes:

• Removed some outdated objects to improve speed of publish.
• Added modal on downgrade to prevent accidental usage.
• Password fields have been deprecated in Ninja Forms core. Some of our add-ons will still utilize them.

Bugs:

• Fixed an issue causing errors when forms containing checkboxes had csv files attached to Email Actions

Security:

• Corrected patch for CSV injection vulnerability to include a previously overlooked input.

Security:

• Patched an XSS vulnerability that allowed javascript injection into the form import function. Many thanks to Adam Roberts for practicing responsible disclosure.
• Patched a CSV injection vulnerability that allowed user values to run some scripts when opening exported CSV files with Excel.

Bugs:

• The selector in the add a form modal should now scroll properly instead of being cut off by the bottom of the browser when it contains a large number of forms.
• Resolved an issue that sometimes caused the character limit option for paragraph fields to count words instead.

Changes:

• Added the abililty to have no default value for Country and State fields.
• Added the Indian Rupee to the list of available currencies
• Removed unnecessary comments from the main field template

Bugs:

• User Meta Tags will no longer print out the tag when users are not logged in

Bugs:

• Resolved an issue that sometimes caused form titles to not display in dropdown menus.

Changes:

• Updated save methods for form settings to reduce potential encoding errors.

Bugs:

• (Beta) The Ninja Forms Gutenberg block should now work properly on the newest version of Gutenberg.
• Min and max values for number fields should once more accept decimal values.
• Resolved an issue that was sometimes causing a description text block to be output, even if it contained no text.
• Radio lists should now properly display the default value when using our opinionated styles.

Security:

• Patched a vulnerability that could allow certain Export Personal Data requests to retrieve unrelated submission data.

Bugs:

• Fixed a broken image link in the Edit User Profile template.
• Resolved an issue that was very rarely causing the conversion process to run again after upgrade, removing all forms but the default Contact Me.

Bugs:

• The styling of the Ninja Forms settings page has been corrected.
• Forms can once again be previewed before they have been published.
• Resolved an issue that was sometimes causing submission expiration to not register properly on publish.
• The submission expiration setting will no longer accept a negative number as valid input.

Changes:

• Ninja Forms has migrated to GitLab! All repository links should now be updated.
• Added an expired submissions cleanup button to our settings page to supplement cleanup on sites with a large number of submissions.

Bugs:

• Submissions removed by the expired submissions feature should now be moved to the trash instead of completely removed.

Bugs:

• Resolved an issue that sometimes caused the form builder to crash when deleting a field.

Bugs:

• Made some performance updates to several of our popup modals.
• The agency remove marketing hook should now properly hide the new services tab.

Changes:

• Fields now display admin labels (if they exist) instead of labels in the record submission action settings.
• Added a tooltip to the value section of list fields, giving details about allowed characters.
• List field merge tags can now be configured to show labels instead of values by appending ":label" to the merge tag.
• The record submission action can now be configured to remove submissions that exceed a defined timeframe.
• Added a confirm modal to field deletion to prevent accidental removal of data.

Bugs:

• Resolved an issue that was preventing placeholder text from appearing in paragraph text fields.

Chnages:

• Unlocked the services tab.
• (Beta) Ninja Forms Add-on Manager is now available.
• Ninja Mail - Transactional Email is now available.

Bugs:

• Resolved an issue that sometimes caused our opt-in modal to become undismissable.

Bugs:

• Fields that do not actually save data should no longer appear in the include/exclude fields list for the record submission action.
• Improved performance of our Add Form modal in the post editor.
• Resolved an issue that sometimes caused the Submissions page to display as a white screen.

Changes:

• (GDPR) Fields excluded by the record submission action will now show their values as (redacted) in the edit submission screen, rather than displaying nothing.
• (GDPR) The delete data request action now includes a setting to specify anonimization of Ninja Forms data, rather than full deletion.
• (GDPR) Fields now have a setting to specify if they are personally identifiable data.
• Registered a cleanup process to take care of some outdated and unnecessary data we have been storing in various data records.
• Added several ARIA attributes to the fields that were missing them.
• The Delete All Data button now cleans up several additional options that we'd recently added.
• The list of actions in the form builder has been updated, and non-enabled actions now include a short blurb describing their usage.

Bugs:

• Removed a fatal error caused by having a WordPress version below 4.9.6.
• Export personal data requests created by anonymous uers through Ninja Forms should no longer error out in the admin.
• Updated a setting in our submissions to prevent them from being shown in archives created by WordPress.

Bugs:

• Resolved a bug that was sometimes causing clicks to not register in the admin.

Changes:

• Individual fields can now be excluded from the record submission action.
• (GDPR) The delete data request action can now be added to a form, allowing your users to request deletion of their Ninja Forms submissions.
• (GDPR) The export data request action can now be added to a form, allowing your users to request a record of their Ninja Forms submissions.
• (GDPR) Added templates for data removal and data export requests.
• (GDPR) Added a suggested privacy policy content block for the use of Ninja Forms.
• (GDPR) We've updated our Ninja Forms opt-in/opt-out behavior for anonymous usage statistics.
• (Developers) We've added a layout of our database structure to our public repository.

Security Enhancements

• Apply more strict sanitization to merge tag values

Bugs:

• Date fields should no longer fail validation if their format is set to the default setting.

Bugs:

• Resolved an issue that was sometimes causing date fields to always fail validation.

Bugs:

• Date fields should now properly recognize date format for validation purposes.
• Resolved an issue that sometimes caused collect payment actions to fail.
• Removed the random error text that sometimes appeared on form export.
• Resolved an issue that sometimes caused the contents of plain text emails to not display properly in the form builder.

Bugs:

• Hidden fields should no longer be hidden in the form builder.

Bugs:

• Resolved an issue that was causing an error in the console while using Safari.
• Fixed a bug that sometimes caused fields to not display properly when their labels contained non-ASCII characters.
• Resolved an issue that caused an error message to appear in the dashboard on older PHP versions.

Changes:

• New form templates are here!

Bugs:

• List field values will no longer disallow spaces as valid input.
• Options can now be properly added to duplicated list fields.
• Resolved an issue that caused the save table settings in the form builder to display no text in Firefox.
• Fixed a spacing issue for field labels set to be hidden in our opinionated styles.

Changes:

• List fields will now output labels instead of values in the {fields_table} and {all_fields_table} merge tags.

Bugs:

• Resolved an issue with the automatic update process.

Bugs:

• Resolved a bug that was sometimes causing form submission to fail.

Bugs:

• Resolved an issue that was causing the save progress table settings to not display properly in the form builder.
• Resolved a long-standing bug that rarely caused form submissions to fail.

Changes:

• Added Akismet Anti-Spam integration.
• Updated form deletion process to warn admins that all submissions for that form will also be deleted.
• Users below PHP version 5.6 will now be seeing a notice, informing them of the outdated version.

Bugs:

• Resolved an issue that was preventing merge tags from being properly input into some settings.

Bugs:

• Form data should now be properly deleted when rolling back to 2.9x and then re-upgrading.
• Resolved an issue that was causing the first publish after upgrade to fail.
• Forms set to clear but not hide after submission should now properly show reCaptcha fields after the clear.
• Resolved an issue that sometimes caused long forms to not publish properly.
• Removed a rogue plus sign that was causing php warnings in the post editor.
• Resolved an issue that was sometimes causing calculation values to display as 0 in submissions.

Changes:

• Trashed submissions are now visible, allowing them to be deleted permanently before the typical expiration period for trashed posts.
• Added a "Move to Trash" button to the edit submission screen.
• Removed some legacy code in our merge tag system that was contributing to increased admin page load times.
• The "Remove ALL Ninja Forms data upon uninstall" checkbox has been replaced with a button, which allows us to run a more efficient cleanup process.
• Email fields should now do a better job of catching invalid values before submission.
• Form autocomplete is here!
• (Beta) Added filtering to the form selector in the Gutenberg block.
• List values now have a more strict filter to prevent errors caused by special characters.

Bugs:

• Fixed a bug that was sometimes causing no actions to fire upon form submission.
• Resolved an issue that was causing hidden fields to be visible if they contained a calculated value.

Security:

• Patched a potential parameter tampering vulnerability.

Bugs:

• Fixed an issue that was sometimes causing decimal place values to not be honored in calculations after submission.
• Parts should now properly validate individually if the option is enabled in the Multi-part Forms add-on settings.
• User meta merge tags should no longer display at all for logged out users.
• Resolved an issue that was causing the star rating field's label setting to be uneditable.

Changes:

• (Beta) Updated the Gutenberg block to output the selected form within the editor for display purposes.
• Added a form filter to submissions and exports, allowing for more rapid selection of the intended form.

Security:

• Patched a potential XSS vulnerability. Many thanks to Kasper Karlsson at Omegapoint for practicing responsible disclosure.

Bugs:

• Resolved an issue that was sometimes causing code snippets to appear on form display.
• Newly created date fields should now no longer contain a timestamp in their default display setting.
• Star rating fields should now be properly caught by required field validation.
• Default values of star rating fields should no longer be considered "valid" for required field validation.
• Single checkbox fields can now be edited in the submission edit screen again.
• Resolved an issue that sometimes caused single checkbox fields to not display a value in exports.
• Field and calculation merge tags can now be used in the same HTML field.
• Images can once again be used in help text values.

Bugs:

• Resolved an issue that caused recently published forms to not display in Internet Explorer.

Bugs:

• Localized several strings for translation that had previously been missed.
• Radio and checkbox lists will now properly save updates made on the edit submission page.
• Resolved an issue that sometimes caused excessive page load times in the WordPress admin.

Changes:

• (Beta) Added a Gutenberg block to replace the shortcode when Gutenberg is active.

Bugs:

• Resolved an error that sometimes caused PHP warnings on certain admin pages.
• Help text should now display properly again.

Changes:

• Updated translation packs for Spanish (Spain and Mexico), courtesy of Jesus Garcia.

Bugs:

• Fixed an issue that sometimes caused forms to not display after publish.
• Calculations with a decimal setting of 0 should now properly round to 0 decimal places instead of the default 2.
• Fixed a bug that was causing some settings boxes to contain seemingly random snippets of code.

Bugs:

• Resolved an issue that sometimes caused certain Categories to not appear in the terms list field.
• Fixed a visual bug where drop downs in CRM actions were seemingly being reset to the default option on page refresh.

Bugs:

• Resolved an issue that sometimes caused Forms to not load in the Dashboard.

Changes:

• Made some minor tweaks to improve the loading and processing efficiency of certain admin pages.

Bugs:

• Submissions of duplicated forms should now properly increment their sequence number.
• The merge tag selector box should now detect the lower edge of the window and shift upwards accordingly.
• Resolved an issue that was causing input masks on required fields to throw an error on focus.
• Fields with currency input masks should now properly save data upon submission.
• Resolved several lingering PHP errors and warnings.
• Checkbox list and radio list fields with wrapped values should now display properly.
• Wrapped labels for single checkbox fields should now display properly.
• Resolved an issue that was causing strictly numeric custom input masks with more than 12 characters to display improperly.

Changes:

• Added custom checked and unchecked value settings to checkbox fields.
• The calendar in the date field is now translatable.

Bugs:

• Fixed an issue that was breaking form display when multi-select fields had no pre-selected values.

Bugs:

• Submission searching should now work in WordPress version 4.8.3 and above.
• Fixed an issue that sometimes caused forms not to publish after deleting a field.
• Fixed a bug that was causing User Management to sometimes not properly set default user meta values.
• Fixed a compatibility issue with the add a form widget in PHP 7.2.
• Fixed an issue that caused Ninja Forms to crash on activation with a PHP version missing the Parser Functions package.
• Fixed a bug that sometimes caused too many database calls on pages where multiple JavaScript errors were present.
• Fixed a bug that sometimes caused a Request Entity Too Large error on form publish.
• Fixed an issue that caused the Add Form button to sometimes display improperly on smaller screens.

Changes:

• Added an option to ignore UTF-8 encoding on export/import, which can correct forms importing with no field data.
• Updated the format of submission dates to match that of the WordPress install.
• Updated the custom field template file path so that it should now properly pull from child themes when active.

Bugs:

• Multi-select fields can now be updated in the submission edit page.
• Modified number fields to better handle rounding numbers with decimals.

Changes:

• Added the GNU license file.

Bugs:

• Fixed a bug that caused some 2.9.x to 3.0 conversion to fail.

Bugs:

• Required field validation should now work properly with the Layout and Styles add-on.
• The email action now removes extra comma separators from email settings like(To, BCC, CC, reply-to, and from address').
• The date range on the submissions table will now show the correct submissions for the selected dates.
• Fixed a bug that was causing form imports with extra characters at the beginning to break.
• Forms that fail to load on the front-end will now remove the loading animation from the page.
• Calculations will display correctly on the front end in HTML fields if the Save Progress add-on is active on sites.
• The decimal setting in calculations will no longer break if non-numeric values are input into them.
• Unique fields will no longer try to validate deleted submissions.
• Country fields should now be sorted alphabetically in non-English languages.
• Calculations decimal setting now defaults to 2 decimal places if the setting is left empty.
• Fixed "This is not a required field" to read "This IS a required field" in Spanish locales.
• Added translatable text for the (of) in the input limit text.

Changes:

• Created a merge tag for custom user meta. This will allow users to do things like pre-populate fields with custom user meta.
• Added placeholder for date field.
• We now have currency support for South African Rand(ZAR).
• Added support for setting number of rows shown on a multi-select list on the front end.
• Created a confirm field. This will allow users to map another field on their form to it and will validate the input on the front end with the field it is mapped to.
• Added a new merge tag for submission time. This will display the time the form was submitted.
• Added WordPress filter to disable all Ninja Forms in app sales banners.
• The merge tag selector can now be used in the body of HTML fields.

Bugs:

• Fixed a bug that caused opt-ins to show incorrectly.
• Multiple Google reCaptchas on the same page should function properly.
• Fixed the layout of description text for checkbox lists.
• New lines in rich text areas should convert properly from version 2.9.x.
• Merge Tag insertion should maintain the proper cursor position in all cases.
• Form duplication should happen much more quickly.
• Unknown field types will be removed upon upgrade to prevent forms from breaking in 3.0.
• Fixed several issues with converting merge tags from version 2.9.x to 3.0.

Changes:

• A portion of users will begin to see upgrade notices for Ninja Forms 3.0. The number of users who see this notice will increase in future releases.
• "Currency" has been added to the list of input mask options.
• Basic error logging has been added to Ninja Forms; the "Get Help" page will now show the most recently recorded errors.
• Added a setting for changing stat opt-in tracking.
• License activation errors will now show more detail.

Bugs:

• Multiple Google reCaptchas on the same page should function properly.
• Fixed the layout of description text for checkbox lists.
• New lines in rich text areas should convert properly from version 2.9.x.
• Merge Tag insertion should maintain the proper cursor position in all cases.
• Form duplication should happen much more quickly.
• Unknown field types will be removed upon upgrade to prevent forms from breaking in 3.0.
• Fixed several issues with converting merge tags from version 2.9.x to 3.0.

Changes:

• "Currency" has been added to the list of input mask options.
• Basic error logging has been added to Ninja Forms; the "Get Help" page will now show the most recently recorded errors.
• Added a setting for changing stat opt-in tracking.
• License activation errors will now show more detail.

Security Enhancements

• Apply more strict sanitization to merge tag values

Bugs:

• Fixed a bug that caused form submissions to fail with an NF_ESO_PARSER error.
• The nf_sub_seq_num shortcode should now be properly converted when upgrading from 2.9.x to 3.0.
• bcc and cc fields in email actions should convert properly when upgrading from 2.9.x to 3.0.
• Clicking on icons and buttons in the builder should be much more consistent.
• Scrolling in the drawer should work properly when viewing the form builder on a mobile device.
• Fixed a bug that prevented the drawer from opening when editing a duplicated list field.

Features:

• You can now limit form submissions based upon unique fields.

Changes:

• Simplified the collect payment action by making it easier to set a paymen total.
• Form titles should appear in form export filenames.
• Added a filter to submissions table view labels.
• Removed the wrapper class for the ReCaptcha field.
• WordPress date settings are now the default for datepicker fields.
• Condensed admin notices into an easier to dismiss format.
• Links to media files entered into the RTE for actions should now use the title of that media item.
• Added a confirm dialog to the rollback button.
• Term merge tags should use the term label now, rather than the ID.
• Added a minimum WordPress version check to the Get Help->System Status page.

Bugs:

• Fixed a bug that could cause the dashboard to fail to display.
• Updated form templates for consistency.
• Email action errors should only show to admin users who are logged-in.
• Translation of submission labels and text should work properly.
• Password fields should not save in the database.
• Empty h3 tags are no longer output when a form title is empty.
• Merge tags should work more consistently in all contexts.
• The delete animation on the dashboard should be clearer.
• Fixed conflicts with other plugins using our EOS math library.
• Created On dates for imported and duplicated forms should reflect the current date.
• Fixed a bug with calculations that could cause a NaN error in JavaScript.
• Merge tags should work properly when previewing a form with unpublished changes.

Features:

• You can now limit form submissions based upon unique fields.

Changes:

• Simplified the collect payment action by making it easier to set a paymen total.
• Form titles should appear in form export filenames.
• Added a filter to submissions table view labels.
• Removed the wrapper class for the ReCaptcha field.
• WordPress date settings are now the default for datepicker fields.
• Condensed admin notices into an easier to dismiss format.
• Links to media files entered into the RTE for actions should now use the title of that media item.
• Added a confirm dialog to the rollback button.
• Term merge tags should use the term label now, rather than the ID.
• Added a minimum WordPress version check to the Get Help->System Status page.

Bugs:

• Updated form templates for consistency.
• Email action errors should only show to admin users who are logged-in.
• Translation of submission labels and text should work properly.
• Password fields should not save in the database.
• Empty h3 tags are no longer output when a form title is empty.
• Merge tags should work more consistently in all contexts.
• The delete animation on the dashboard should be clearer.
• Fixed conflicts with other plugins using our EOS math library.
• Created On dates for imported and duplicated forms should reflect the current date.
• Fixed a bug with calculations that could cause a NaN error in JavaScript.
• Merge tags should work properly when previewing a form with unpublished changes.

Bugs:

• Fixed a bug that could cause Recurly and Stripe add-ons to fail.
• Fixed a bug with bad form titles that could cause the form dashboard to crash.
• Calculations with whitespaces should be better handled on the front-end.
• Checkbox label positioning should be correct in all setups.
• Form deletion confirmation modal should now be styled correctly.

Bugs:

• Empty Calculation rounding settings should now default to 2.
• Using post meta merge tags should now work with other post merge tags.
• Star Rating fields now have admin key settings.
• Form cache should now be properly removed when a field is deleted.
• The "New Form" button should now show when creating a new post or page.
• HTML fields should now show properly in merge tags.
• Fixed a bug with the LogLevel class.
• Querystring merge tags should now be empty rather than showing {querystring:foo} when no querystring is present.
• Date Created should now be more accurate in all contexts.
• Fixed a bug that could cause forms to fail to render on the front-end when themes passed content through wpautop.

Bugs:

• Fixed a possible memory leak that could cause the builder to crash if the settings drawer was opened multiple times.

Bugs:

• Users should be able to re-submit forms that fail initial anti-spam checks.
• Fixed some bugs related to calculations and submission.

Changes:

• Added sortable icons to the forms dashboard.

Bugs:

• Fixed several possible PHP notices.
• Fixed a possible conflict with the bbPress plugin.
• Editing submissions with Checkbox List fields should work properly.
• Product fields with costs over 1000 should now work properly.
• Fixed a bug that caused duplicate submissions if a form wasn't hidden after submission.

Changes:

• Forms should be sorted by title in the dashboard and the submissions page.

Bugs:

• Fixed bugs in the new Merge Tag UI that prevented it from being opened properly via clicks.

Changes:

• Added a dashboard view for forms, removing the "All Forms" and "Add New" submenus.
• All new Merge Tag UI for inserting Merge Tags into forms and actions.
• Refactored calculations, as well as adding an option to set calculation rounding.
• Updated the WordPress.org readme file.
• Opening the "new form" page should automatically open the drawer to add new fields.

Bugs:

• Fixed several bugs with calculations and locales that use non-American thousands and decimal separators.
• Products with a price over 999 should now render and calculate properly.
• Editing a submission and using a single quote should not break the submission editor.
• Fixed several PHP notices.
• After successful submission, the page should only scroll to the success message if it is not fully visible.
• Inline email validation should work properly for longer email domains, i.e. @liverpool.ac.uk

Security Enhancements

• Apply more strict sanitization to merge tag values

Security:

• Fixed a possible security export related to WP Sessions. Please update as soon as possible.

Bugs:

• Fixed a bug that could cause emails to fail with a 500 internal server error.

Changes:

• Added an admin warning notice if Contact Form 7 is installed.
• Users who upgrade to version 3.0 will now see an admin notice instructing them to check their converted forms.
• Added the TLS version, if installed, to the get help page.
• Fixed a bug that could cause a PHP fatal error with older, insecure versions of PHP.

Bugs:

• Fixed a bug that caused field labels to be output multiple times in submission exports.
• Removed several PHP Warnings related to publishing longer forms.
• Updated inline email check so that it should work on longer domains, i.e. co.uk.
• Editing submissions with single checkboxes should now save properly.
• Fields should be properly sorted in CSV files attached to emails.
• Sequential IDs for submissions on converted or imported forms should not reset.

Changes:

• Added an admin warning notice if Contact Form 7 is installed.
• Users who upgrade to version 3.0 will now see an admin notice instructing them to check their converted forms.
• Added the TLS version, if installed, to the get help page.

Bugs:

• Fixed a bug that caused field labels to be output multiple times in submission exports.
• Removed several PHP Warnings related to publishing longer forms.
• Updated inline email check so that it should work on longer domains, i.e. co.uk.
• Editing submissions with single checkboxes should now save properly.
• Fields should be properly sorted in CSV files attached to emails.
• Sequential IDs for submissions on converted or imported forms should not reset.

Bugs:

• Confirmed password fields should work properly.
• Fixed a bug with List Fields that caused the Import button to overlap the Add New button.
• Closed a possible security vulnerability by escaping HTML in the builder.
• CSV files should now be deleted from the server after they are emailed when attached to an email action.

Changes:

• Added a filter so that add-ons and custom code can add forms to the templates section of the New Form builder.

Bugs:

• Publishing a form should now populate the backup database properly in all environments.
• Editing submissions that have selects or other lists should now work properly.

Changes:

• Added Trello to the available actions list.
• Added a JS exception catcher to help debug when forms don't display because of JS errors.

Bugs:

• Fixed a bug that could cause previewed forms from submitting properly.

Bugs:

• Fixed a JS notice caused by the use of jQuery.attr() instead of jQuery.prop().
• Modified the approach to form publishing to improve performance for larger forms and prevent bugs when saving.
• Google reCaptcha should now work properly when a field has an error.

Changes:

• Added a jQuery event: "nfFormReady" to the document that can be used to fire JS code when a form has loaded.
• Using jQuery.val() should now properly work for Ninja Forms fields.
• Updated the update check URL for add-ons.
• Added a filter for form settings upon form display localization.

Bugs:

• Field data should populate properly in all submission exports.

Bugs:

• Field data should populate properly in submission exports.
• Email errors upon form submission should be clearer.
• Fixed a compatibility bug with other plugins that use the WP List Table.

Changes:

• Increasing the performance of submissions and form builder loading.
• Improved compatibility with popular caching plugins.

Bugs:

• Field tags should now properly populate in calculation merge tags.
• Submission exports should now always order properly.
• Fixed a bug with submissions exporting non-Ninja Forms data.
• Importing forms with non-UTF8 characters should now import properly.
• Fixed a bug with converting forms from 2.9.x to 3.0.

Bugs:

• Fixed a bug with Google reCaptcha and the deprecated, 2.9.x codebase.

Bugs:

• Fixed a bug with form duplication.

Bugs:

• Fixed a bug that caused installations to crash on older, insecure versions of PHP.

Changes:

• Added an import for list options.
• Refactored form submissions so that they are more responsive for longer forms with more submissions.
• Moved the 'reply_to' setting to the primary section in email actions.
• Added error handling for invalid "TO" email addresses.

Bugs:

• Fixed a bug with calculations that caused brackets to appear in calculation fields.
• On/off settings should now save properly in all situations.
• Dragging a field should now properly scroll the screen.

Changes:

• Added a prompt before deleting forms on the all-forms table.
• Added the ability to use: {field:name} <{field:email}> to get Name - Address formatting in email actions CC, BCC, Reply-To Field.
• Updated the third-party EDD libra …

Security:

• Fixed a security issue that could allow macros to be ran in Excel if a CSV with malicious content was exported. Thanks to Smit B. Shah and Hely H. Shah for the report.

Bugs:

• Fixed a bug that could cause bulk downloads to fail.
• Google reCaptcha should now work properly with AJAX submissions.
• Calculations in regions that don't use decimals as separators shouldn't fail.

Bugs:

• Fixed a bug that could prevent the metaboxes from being dragged properly on the post/page edit screen.

Security:

• Removed a possible security vulnerability.

Bugs:

• The "Text" tab toolbar should no longer disappear on the post/page edit screen.

Security:

• Removed a possible security vulnerability.

Bugs:

• The "Download All Submissions" button should now function properly.

Features:

• Honeypot fields are now added by default to help protect your forms from spam.

Bugs:

• Legacy honeypot fields should display properly.

Features:

• Add a form easily while editing a post, page, or custom post type using a form selector.

Security:

• Fixed a minor security issue within the WordPress admin.

Bugs:

• Fixed a few PHP notices within the WordPress admin.

Features:

• Added built-in support for Google reCAPTCHA.

Changes:

• Added South Sudan to the country list.

Bugs:

• Fixed a bug that could cause multiple forms on a page to add an empty DIV when one was successfully completed.
• Ampersands (&) should now encode properly when using them in the redirect action.
• The "Today's Date" option should now use the WordPress time rather than GMT.

Security:

• Fixed a possible cross-site scripting issue. We recommend updating as soon as possible to this version.

Changes:

• Added RTL support for radio and checkbox wraps with left or right labels

Changes:

• Removed usage of PHP session variables in favour of an implementation of WP Session Manager.

Bugs:

• The use of WP Session manager should fix any bugs related to session_start() or headers already sent messages related to Ninja Forms.
• Fixed a bug that could cause form caching to prevent new form settings from appearing.

Security:

• Hardened form display to protect against certain cross-site scripting methods.

Bugs:

• Fixed a bug that could prevent licenses from being activated properly.
• Submission #'s should now be properly assigned.

Bugs:

• Fixed a bug with major calculations that could cause them to fail in some situations.

Bugs:

• Fixed a bug with form caching that could cause fatal errors.

Bugs:

• Fixed a bug that could cause issues using Ninja Forms with a multi-site installation.

Bugs:

• Fixed a bug that could cause the "download all submissions" button to fail.

Bugs:

• Fixed a bug that could prevent licenses from being deactivated properly.
• Fixed some styling issues with the password field.
• Fixed several PHP notices.

Changes:

• Added a new upgrade handler to make upgrading a smoother, more stable process.
• Added support for European thousands separators in currency masks and calculations.
• Added form caching to speed up installations with large numbers of forms.
• Added support for using multi-select or checkbox lists as the recipient of email actions.

Security:

• Fixed a security vulnerability that could allow users to inject scripts if they were logged in as administrators.

Bugs:

• The "Download All" button should now work properly for submissions.

Changes:

• Added support for populating a text or hidden field from a querystring.
• Added a reset form conversions button to allow users to re-convert forms in the case of an error.

Bugs:

• Fixed a bug that could cause forms to not submit properly.
• Fixed a bug that could cause a PHP crash on earlier versions of PHP.
• The user profile setting of "Disable rich text editor" should no longer cause problems when editing forms.
• Credit Card errors should now show properly when submitting the form via AJAX.
• The submission limit should now only count properly submitted forms.
• Fixed a bug with email fields and the inline label position.

Bugs:

• Fixed a bug that could cause a crash with older versions of PHP.

Changes:

• Added support for populating a text or hidden field from a querystring.
• Added a reset form conversions button to allow users to re-convert forms in the case of an error.

Bugs:

• The user profile setting of "Disable rich text editor" should no longer cause problems when editing forms.
• Credit Card errors should now show properly when submitting the form via AJAX.
• The submission limit should now only count properly submitted forms.
• Fixed a bug with email fields and the inline label position.

Bugs:

• Fixed a browser caching bug.
• Fixed a possible, very minor security concern.

Bugs:

• Fixed a bug that could prevent field settings dropdowns from being clicked on in FireFox.
• Fixed a bug that could prevent the preview page from showing properly.

Bugs:

• Deleting Ninja Forms from the plugins page should now work in all instances.

Changes:

• Added placeholders for text fields.

Bugs:

• Fixed a bug that could prompt users to run unnecessary updates on their site.

Bugs:

• Preview pages should now always display properly.
• Success messages should now always be shown after submission properly.

Bugs:

• Fixed a bug that could cause a PHP notice to show in placeholders.
• Fixed a bug that could cause forms not to display properly when added via the "append to page" option.

Changes:

• Simplified the form creation interface by adding a "Build Your Form" tab, an "Emails & Actions" tab, and a "Settings" tab. All other tabs have been removed.
• Form Preview and Submissions are now buttons that can be clicked at any stage of editing a form.
• Field settings have been simplified by introducing a series of new, expandable settings sections. These sections house more advanced or less-common settings.

Bugs:

• Fixed a major bug that could prevent longer forms from saving properly. Previous fixes required modifying a php.ini file.
• Creating a new action should now show the proper saved message.
• Updated the Ninja Forms translation file with several new strings and cleaned up existing strings.
• Modified the way that options are grabbed from the database to make them more effecient and prevent errors.
• Fixed a bug that caused post meta to be added to a post/page even if no form was selected.

Bugs:

• Fixed a bug introduced in the previous version that could prevent javascript from working properly on the front-end.

Bugs:

• Fixed a bug that could cause field settings to appear incorrectly on WordPress version 4.1.
• Fixed several PHP notices.
• Fetching a form over AJAX from the frontend via the shortcode should now work properly.
• Fixed a bug that prevented the NL translation from working properly.
• Fixed issues that could be caused by sending blank CC and BCC headers.

Changes:

• Added a rating request at the bottom of Ninja Forms pages in the admin area.
• Added filters for the datepicker args so that it is more easily customisable.

Bugs:

• Fixed a bug that could cause submissions to view improperly.
• Appending forms to a post or page from the post/page edit screen should now work properly in all instances.
• Importing form from versions previous to 2.8 should no longer create a phantom email.
• Importing or duplicating a form that has submissions shouldn't cause the sequential numbers for the new form to start with the same number.

Security Update:

• This version includes a fix for a potential security vulnerability for admin users.

Bugs:

• Fixed a bug that can throw JS errors if multiple forms are on the same page.
• Fixed typos in the welcome screen.

Security Update:

• This version includes a fix to a security vulnerability. Please take the time to update to this version.

Bugs:

• Fixed a bug with conversions from older versions of Ninja Forms.
• Fixed a bug that could cause two forms on the same page to behave improperly.

Changes:

• Credit card field labels and descriptions can now be edited on the field settings tab.

Bugs:

• Fixed a bug with importing the initial contact form.
• BCC and CC fields should now send to multiple addresses properly.
• Fixed several instances where strings weren't internationalized properly.

Changes:

• The redirect notification type now works with AJAX enabled.

Bugs:

• Fixed a security issue within the wp-admin.
• The Custom First Option setting for country fields now works properly with required fields.
• BCC and CC fields should now work properly in all cases.
• Negative numbers should be properly represented in emails when using calculation fields.
• Fixed errors with some internationalization strings.
• Deleting a form should now properly delete notifications attached to that form.
• Changed number field settings to allow non-integer step values.

Changes:

• Added a new nf_init action that allows developers to run functions when Ninja Forms loads.
• Added hooks and filters to allow notifications to be more easily extended.

Bugs:

• Fixed a bug with converting notifications from previous versions of Ninja Forms.
• Re-Added the password mismatch label to the label settings tab.
• The [ninja_forms_all_fields] short code should now function properly in plain text emails.
• Submitted forms that are set to clear upon completion should now properly re-populate default values that are based upon logged-in user information.
• Fixed an issue with doubles slashes on Windows servers.
• Importing forms should now work properly in all instances.

Bugs:

• Fixed a bug with notifications that could prevent notifciations from converting properly in some instances.
• Fixed a bug with changing email message content via the filter.
• Properly included minified JS files.

Security:

• Version 2.8 fixes a minor security issue that could allow non-admins and other forms to delete Ninja Forms. This won't affect all users, but we encourage everyone to update.

Changes:

• Moving reply to, cc, and bcc to an advanced settings section for email notifications.
• Any field can now be inserted into the from name, address, to, subject, reply to, cc, and bcc fields.
• Added a custom short code parser that will prevent other plugins from tampering with email and success message ninja forms short codes.

Bugs:

• Fixed an issue where short codes were being parsed in the admin.
• Fixed a bug that could cause phantom emails to be sent to users who filled out forms.
• Settings labels should now populate correctly upon activation.
• New installs should not see upgrade notices.
• Favourite fields can now be removed properly in all installations.
• Fixed PHP notices.

Security:

• Version 2.8 fixes a minor security issue that could allow non-admins and other forms to delete Ninja Forms. This won't affect all users, but we encourage everyone to update.

Bugs:

• Fixed a bug that could cause notification conversion to crash.

Security:

• Version 2.8 fixes a minor security issue that could allow non-admins and other forms to delete Ninja Forms. This won't affect all users, but we encourage everyone to update.

Bugs:

• Fixed a bug that could cause emails to be sent to the user's email address, even if a notification wasn't active.
• Fixed a bug that could prevent emails from being sent if the message was empty.
• Fixed a bug with upgrades that caused submission conversion to fail.
• Fixed PHP notices.

Security:

• Version 2.8 fixes a minor security issue that could allow non-admins and other forms to delete Ninja Forms. This won't affect all users, but we encourage everyone to update.

Changes:

• Added a filter for success message notifications: nf_success_msg.
• Added a filter for CSV exports after labels have been added but before fields: nf_subs_csv_label_array_before_fields.
• Deprecated the old version of the success message filter.

Bugs:

• Fixed a bug that could cause emails to be sent to the user's email address, even if a notification wasn't active.

Security:

• Version 2.8 fixes a minor security issue that could allow non-admins and other forms to delete Ninja Forms. This won't affect all users, but we encourage everyone to update.

Features:

• New, simpler system for creating custom notifications.
• Send any number of emails per form submission.
• Easily redirect the user to a page or display a custom success message.

Changes:

• Changed the "Save Form Settings" button to "Save."

Bugs:

• Fixed PHP notices.

Bugs:

• Fixing a bug with editing submissions with specific field combinations.
• Submission CSS should now only enqueue on the submission page.
• Fixed a bug with the submissions permissions filter. It should now function properly.
• Fixed a bug with some servers caused by calling the set_time_limit() function
• The [nf_sub_seq_num] shortcode should now always function properly.
• Fixed an invalid argument error when viewing a the submissions table.
• Rich Text Editors should now render properly when they are added to a form.

Changes:

• Added a new filter to the admin menu capabilities. Deprecated older versions.

Bugs:

• On the submissions table, the filter will now use the earliest date as the begin date.

Changes:

• Added the ability to download all submissions for a particular form.
• Added a step processor that can be extended and used by developers.
• Added new extensions to the add-ons page.

Bugs:

• Fixed a bug with success messages not being displayed for AJAX submissions.

Bugs:

• Fixed HTML breaking issues with the Text field type when something other than div is selected
• Fixed a bug that could cause forms to stop working on Windows (IIS) servers.
• Forms without errors or success messages should no longer see the "response" message div.

Changes:

• Added Portuguese translation files.
• Added Dutch translation files.

Bugs:

• Fixed a bug that caused the text elements to be output with encoded html tags rather than the tags themselves.
• Fixed a bug that caused empty CSV files to be emailed to the admin.

Changes:

• List item labels can now contain HTML.

Bugs:

• Fixed an issue that could cause the submission values to appear as a widget on the submission edit screen.
• Fixed a bug that could cause a direct download if the "send CSV attachment" was checked.

Bugs:

• Fixed an issue with older versions of PHP and the round() function.

Changes:

• Submissions are now stored in a new database, making them easier to search, edit, and display.
• There are new methods for interacting with submissions, which can be found here.
• We're very excited about this new direction for Ninja Forms submissions, and we hope you enjoy using the new submissions system.
• See the plugin welcome screen for more details.

Bugs:

• Fixed several bugs.

Changes:

• Added a filter for setting which field types are shown the input limiter.
• Changed the header( 'Location....') php function with wp_redirect().

Bugs:

• Fixed a bug that could cause the required symbol to be added twice if the label position was set inside.
• Wrapped the $post global in an if check to prevent errors on some WP pages.

Changes:

• Modified CSS styling slightly for default contact forms.

Bugs:

• Removed CSS padding issues for some themes.
• Fixed a bug with short codes on default values.
• Fixed a PHP Notice related to WordPress version 3.9 and $wpdb->prepare().

Changes:

• Added a Finnish Translation (Thanks to ottok).
• Fixed a bug with short codes on default values.

Changes:

• Added some CSS to make forms more responsive and cross browser compatible.

Changes:

• Modified the call to wp_editor on the Field Settings tab so that it is compatible with WordPress 3.9.
• Added more security to prevent forms from being spammed.
• Added additional items to the system status page.

Bugs:

• Fixed a php notice that could occur when using the inside label position.
• Calc fields that use advanced equations should now function properly when referencing other advanced calculation fields.

Changes:

• The "Processing Message" above the form has been removed in favour of changing the text of the submit button and disabling it.
• This change in processing notification will make it easier for users to see that a submission is being processed and prevent them from clicking the "submit" button again.
• Updated the label of the "Processing" label to make it clearer.
• Added a credit card field that can be enabled by extensions that need to use it.

Bugs:

• Fixed a bug introduced in version 2.5.3 which prevented Sessions from starting properly on some server setups.
• Fixed some PHP warnings/notices.
• List items should now properly escape html when displayed.

Bugs:

• Fixed a bug that could prevent AJAX submissions from working properly.

Bugs:

• Fixed various bugs with the default label position. It should now always default to above.
• Fixed a bug that could cause Admin emails to appear to have attachments when they didn't.
• Required fields can now have a value of 0.
• Fixed a bug with list fields and calculations that could cause them not to pre-populate properly.
• Fixed a bug that could cause incomplete submissions to show in the dashboard for those using the Save Progress extension or the Multi-Part Forms extension.

Bugs:

• Fixed a major bug that removed the "Number" field.

Features:

• Submission Limiting - Allows users to limit the number of submissions a form can receive.
• Character Counts - Added a "Character Count" option to textboxes and textareas.

Bugs:

• Fixed a bug that prevented the pagination from working on view submission pages.
• Fixed a bug with the default value filter.
• Fixed a bug that prevented forms from showing when they were on the landing page of another form.
• Fixed a bug that caused required fields to go unprocessed when extensions were deactivated.
• Fixed a bug that caused list fields to pre-populate incorrectly in some instances.
• Removed some console logs that could cause crashes in Internet Explorer.
• Fixed a bug that caused forms to improperly clear when submitted.
• Fixed a bug that prevented empty success messages from being saved.

Changes:

• Add some CSS to help prevent theme from breaking left and right labels when they add display:block to the label element.
• All settings are now fetched via a proxy function.
• Added a wrapper for the entire form display (and everything that goes with it).

Bugs:

• Fixed a bug that caused memory issues when a form has a large number of submissions.
• Fixed a bug with the label inside position that generated a “call to member function…” error.
• Fixed a bug that prevented tax totals from working properly with numbers with thousands separators.
• Fixed a bug that prevented list importing from working with newly created list fields.
• Fixed a bug with list fields that prevented list options from being re-ordered immediately after being added to the form.

Changes:

• Required fields that use the “inside” label position will now show the required symbol inside the field with the label.
• Changed the default value filter to respect fields that shouldn’t be processed.
• Removed code from the field class function that was specific to Conditional Logic. This code should be housed in the extension rather than the core plugin.

Bugs:

• Fixed a bug that prevented the Inside label position from working properly on form load.
• Fixed an issue that could cause the conditional logic extension to function improperly on load.

Features:

• A new method for loading Ninja Forms for display has been created to decrease loading times. Users with extremely large forms (100+ fields) should see a marked improvement in loading speeds. If you use any Ninja Forms extensions, make sure that they are updated to the newest versions to take advantage of this new loading system. Developers can look for the $ninja_forms_loading class for more information about using this powerful new feature.
• Added a new Number field that requires users to enter a number. (Work is currently being done to make this requirement work with non-HTML5 compliant browers.)

Bugs:

• Fixed a bug that prevented Custom default values from working with hidden fields.
• Encoded HTML entities in the help hover so that double quotes don’t break anything.

Changes:

• Default label position is now above the element.
• Added filter 'ninja_forms_export_sub_pre_value' when exporting subs to access user_value before it is processed (stripslashes and if array implode_r).

Bugs:

• Fixed a bug that caused the Ninja Forms option on post/page edit to not save properly.

Changes:

• Simplified some CSS for the star rating field.
• Fixed some 3.8 styling on modal boxes.
• Fixed a few typos.
• Added a default success message to newly created forms.
• Address fields should now how a specific class that can be targeted in JS.

Bugs:

• Input masks should now work without causing Javascript errors.
• "Back to submissions" should now work in IE.

Bugs:

• Fixed a bug in calc filters that could cause infinite loops.
• "Back to submissions" should now work in IE.

Changes:

• Add some CSS for 3.8 compatability.
• Removed the "Save Subs" option. Now all submissions are saved by default. This can be changed by using a WordPress filter.
• Moved the "Forms" admin menu up to the same section as posts and custom post types.
• Changed some CSS selector weights ot make overriding a little easier.
• Changed the mask definition to be stored in a data-attribute rather than the field title.
• Changed the currency mask to use the WordPress defined thousands separator and decimal point.

Bugs:

• Fixed a bug that prevented calculations from working properly in Mulit-Part Forms.
• Fixed a bug that could prevent success messages from showing properly in modal forms.

Bugs:

• Fixed up the extend page. Added some extensions and cleaned up CSS.
• Added url encoding to the form settings saved message so it was no longer without spaces.
• Fixed the get_subs function so that it works properly with dates in formats different than m/d/Y.
• Fixed a bug that caused response message fields to be output if multiple forms were on the same page.
• Fixed a bug that caused hidden fields to not show up on the submission edit screen.

Changes:

• Adding styling to admin metabox textareas so that they have a minimum size.
• Saving a post/page should no longer create an empty Ninja Forms custom post meta.
• Changed the call to sys_get_temp_dir() to the WordPress get_temp_dir() when trying to create a CSV attachment.
• Added a new filter ninja_forms_email_all_fields_array to give users a way to remove unwanted data from being sent in emails.
• Users can now add Calc values to their List Options import CSV.

Bugs:

• Fixed a bug that prevented sidebars from saving properly on the Field Settings tab and producing a PHP warning.
• Forms should now update their “Date Updated” status when a change is made.

Changes:

• Added a default, basic contact form that will be automatically created upon plugin activation.
• Optimized images to make load times faster.
• Changed from underscores to dashes for proper class name of the required fields wrapper.
• Added a new default value for textboxes: Today's Date.
• Increased the number of submissions viewable at once to 300 and 500.
• Minor CSS adjustments for WP 3.8 compatibility.

Bugs:

• Fixed a bug that prevented forms from populated correctly after they had been submitted. i.e. after missing required fields.

Changes:

• Changed the way that Ninja Forms figures out what URL a form lives on.
• The "From Address" used in admin emails can now be filtered using ninja_forms_admin_email_from.
• The delimiter, new line marker, and byte order mark can now all be filtered. See includes/admin/export-subs.php for more information. (Thanks to Jörn Lund!)
• Changed button colors on the submission editing page to be inline with WordPress standards.

Bugs:

• Fixed a bug that prevented "From Email" and "From Name" from saving properly on the Form Settings page.
• Star Ratings fields can now be set to required. The user will be forced to enter at least one star.
• Removed some PHP notices that could appear when using the widget.

Changes:

• The datepicker used in the Ninja Forms admin section should now respect the date settings on the Plugin Settings page.

Bugs:

• Fixed several minor bugs related to saving form fields.

Changes:

• Added a new submit feature called "Timed Submit." This new submit button will force users to wait a certain number of seconds before they can submit your form. Thanks helgatheviking!
• Improved the Form Settings UI by adding a much-requested "Email From Name" field setting. You can use this to more easily define the name that emails appear to be from.
• Added an easier way for developers to troubleshoot JS errors.
• The "Use this as the From Email for Administrators..." setting has been removed in favour of one labelled "Set this as the reply-to email" for the form. We think that this presents a clearer interface and is easier to understand.

Bugs:

• Fixed a bug that prevented bulk actions from working on submissions.
• Duplicating a form should now properly change ninja_forms_field references in the admin and user email subjects.

Changes:

• Added a honeypot field for catching spam bots. Thanks helgatheviking!
• The date input mask should now reflect the settings for date format.
• Added a "button" option type to the admin metabox output.
• Changed the way that Ninja Forms attempts to get a form's URL to the wp_guess_url() function.
• Added the option to give a field type a default label and default value when registering a field type.

Bugs:

• Fixed a security-related bug that prevented pluagin and form settings from saving properly.

Changes:

• Add smtp option output to System Status to assist in approved email issue troubleshooting.

Bugs:

• Fixed a security-related bug that prevented new forms from being created.

Changes:

• Added better input escaping to improve form security.

Bugs:

• Fixed some minor bugs related to default values for hidden and textbox fields.

Changes:

• Added a new resource that will allow users to quickly and easily add their pertinent system information when requesting support for Ninja Forms. The new option can be found underneath the Forms menu: System Status.

Changes:

• Added new options to the default value setting: Post ID, Post Title, and Post URL.
• Changed the date format in ninja_forms_get_subs() to allow 24 hour date selection.
• Improved performance with the MP6 plugin.

Bugs:

• Fixed a bug that prevented advanced calculations from working properly.
• Fixed some bugs with the field descripition.

Changes:

• Added a message to the license tab if no extensions are installed.
• Improved the structure of metaboxes.