ChargeForms

Changelog

0.270.13

• Fixed: removed chargeforms from the Contributors header — not a registered WordPress.org username, so it was silently dropped on import. Only uzairrehman remains.
• Changed: rewrote the Description section into organized feature sections (Form Builder, Payments, Entry Management, Email Delivery, Integrations, Spam & Security) and expanded the FAQ with questions on performance, conditional logic, multi-step forms, entry export/import, and migrating from Contact Form 7, WPForms, or Ninja Forms.
• Changed: updated plugin tags to better reflect the plugin’s actual differentiators (payment form, multi-step form, conditional logic).

0.270.12

• Fixed: escape generated form markup, SVG icons, and report output at the point of rendering for WordPress.org security compliance.
• Changed: CSV entry import, all bundled templates, Save & Resume, multiple SMTP connections, and every implemented builder field are available without a paid license.
• Improved: the readme and license screen now state clearly that every feature shipped in the WordPress.org plugin is free.

0.268.0

• Fix: Keep existing Pro fields editable through MCP when a license expires, while blocking new unlicensed Pro fields.
• Test: Validate structured AI previews and WordPress identifier placeholders.

0.267.0

• Fix: Pro access requires a verified paid license activated on this site.
• Fix: Paid expiry is enforced locally; temporary verification outages have a bounded 72-hour grace period.
• Fix: Display accurate site limits and retry remote site-slot release after a failed deactivation.

0.266.0

• Fixed: two function signatures used PHP 8.4’s deprecated implicit-nullable form (array $x = null). They are now written explicitly as ?array $x = null — identical behaviour, no deprecation notice. The explicit form still works on the plugin’s minimum PHP 7.4.
• Improved: the test suite no longer prints deprecation notices from its own REST request stub when run with full error reporting. No plugin behaviour changed in this release.

0.265.0

• Fixed: a column’s width only ever applied on desktop. The width was printed into the page as an inline flex-basis, which overrides every media query in the stylesheet, so the builder’s Tablet and Mobile previews had no effect on the real form and two-column rows did not stack properly on smaller screens. Columns now carry their width as CSS variables and the stylesheet applies the right one per screen size: tablet (up to 1024px) falls back to the desktop width, and mobile (up to 600px) falls back to full width unless you set a specific mobile width.
• Added: per-device column widths in the builder — select a column, switch the preview to Tablet or Mobile, and set a width just for that screen size, or choose Inherit to reuse the wider device’s width.
• Fixed: a column could not be selected in the form builder at all. Clicking a column always selected its parent row instead, so the Column Width setting had no way to appear. Columns are now selectable like any other field, including with the keyboard.
• Improved: verified the plugin still parses cleanly under PHP 7.4+ and that the existing test suite and build stay green.

0.264.0

• Fixed: form submissions silently stopped working on sites using a page cache or CDN. The form’s security nonce is printed into the page, so a cached page kept serving the same nonce until it expired (WordPress nonces last roughly 12-24 hours), after which every submission was rejected with “Security check failed” and nothing on the page explained why. The form now refreshes its own nonce when the page loads, so cached pages keep submitting normally.
• Fixed: the Forms screen loaded about 1.3 MB of JavaScript and CSS it never used. The older Vue version of that screen is retired, but its files were still being loaded on every visit even though the page renders the standard table. They now load only when the Vue screen is explicitly requested, removing that dead weight from every Forms page load.
• Improved: verified the plugin still parses cleanly under PHP 7.4+ (its declared minimum) and that the existing test suite and build stay green.

0.263.0

• Fixed: third-round review findings — Notion’s Terms/Privacy URLs and the license API’s chargeforms.com Terms/Privacy URLs in the readme were broken (401/404); replaced with verified-working links (chargeforms.com’s real paths are under /legal/, not /terms//privacy). Added HubSpot’s Terms/Privacy links, which the readme had omitted. Removed the admin-notice-suppression feature entirely (Menu and Builder_Page both cleared WordPress core’s and other plugins’ admin_notices on ChargeForms’ own screens) — not something WordPress.org guidelines allow scoping down, only removing, same as the earlier Custom CSS/JS removal.

0.262.0

• Fixed: WordPress.org’s automated submission scan rejected 0.261.0 outright (PluginCheck.CodeAnalysis.Heredoc.NotAllowed) — the wp_add_inline_script()/wp_add_inline_style() conversions in 0.261.0 used heredoc/nowdoc (<<<) syntax to hold the JS/CSS strings, which this scanner disallows entirely regardless of content. All 18 heredoc/nowdoc blocks rewritten as plain quoted PHP strings (multi-line single-quoted strings, or string concatenation where a translated value needed to be inserted) with identical JS/CSS content — no behavior change, just different PHP string syntax.

0.261.0

• Fixed: addressed the WordPress.org directory’s second review pass — text domain renamed to match the reviewed plugin slug (chargeforms), the Custom CSS/JS feature removed entirely (arbitrary code insertion isn’t permitted, only removing it satisfies the guideline), every remaining inline <script>/<style> block converted to wp_enqueue_script/wp_add_inline_script/wp_add_inline_style, two unused core-file includes removed, Google Fonts changed from always-on to an explicit opt-in toggle (Global Settings > General, off by default), four previously-undisclosed external services documented (Mailchimp, Notion, Telegram, Nominatim/OpenStreetMap), and the built JS/CSS source now ships inside the plugin package itself (assets/src/, webpack.config.js, package.json) since this plugin’s repository stays private.

0.260.0

• Fixed: the live Plugin Check scan’s remaining 18 WordPress.DB.PreparedSQL.NotPrepared errors (entries/forms/form-starts data layer). Two earlier restructuring attempts failed (0.255.0’s variable-held query text, 0.257.0’s single-ternary-of-literals both still tripped the check); the actual fix the scanner accepts is duplicating each conditional branch so $wpdb->prepare()‘s query-text argument is a genuine inline literal at every call site, with zero variable indirection of any kind — verified against the live scanner one method at a time before applying it everywhere.

0.254.0

• Fixed: every remaining direct-SQL “prepared statement” warning from the site’s live Plugin Check scan (table names built from string concatenation, even though every value was already placeholdered) — rewritten to use $wpdb->prepare()‘s %i identifier placeholder (WP 6.2+) across the entries, activity log, drafts, subscriptions, form starts, notification log, API log, email log, forms, install migration, and legacy-importer data layers. Minimum required WordPress version raised from 6.0 to 6.2 for %i support.

0.253.0

• Fixed: a few more nonce-recommended/sanitization warnings caught after re-running the site’s own live Plugin Check tool (its results don’t match the automated pre-review email’s tool 1:1), plus mixed line endings in class-email-log.php.

0.252.0

• Fixed: a second, larger round of WordPress.org Plugin Check findings caught by the tool’s live in-admin scan after 0.251.0’s release — more escaping gaps in field-rendering helpers, a genuine i18n string wrapped in raw HTML, ini_set() sniff coverage, an unprefixed global in uninstall.php, and every remaining direct-database-query/prepared-SQL warning across the data layer (verified safe — each is a fixed internal table-name constant alongside properly placeholdered values, not user input) is now explicitly annotated with its reasoning instead of silently triggering the scanner.

0.250.0

• Fixed: a batch of WordPress.org Plugin Check findings from the plugin’s first directory submission review — nonce unslashing/sanitization (18 spots), $_FILES name/type sanitization, missing translators comments, corrected phpcs:ignore sniff codes on file operations, Stripe billing-portal redirect now uses wp_safe_redirect(), removed load_plugin_textdomain()/Domain Path header (unneeded since WP 4.6), dropped hotlinked third-party icons from the Migrator tool, added an == External services == readme section, and fixed a dead CleanTalk privacy-policy link.

Older versions

The full changelog going back to 0.208.0 (including 0.244.0 and earlier) is in CHANGELOG.md, shipped in this plugin’s own files (this section is capped at 5000 characters).

Additional opt-in contact integrations

Brevo and ActiveCampaign: when configured and enabled for a form, send visitor email and configured name values to the selected list. Brevo terms/privacy: https://www.brevo.com/legal/termsofuse/ and https://www.brevo.com/legal/privacypolicy/. ActiveCampaign terms/privacy: https://www.activecampaign.com/legal/terms-of-service and https://www.activecampaign.com/legal/privacy-policy. No requests run until connected and enabled, except an explicitly requested read-only connection test.