{"id":334611,"date":"2026-07-16T15:19:49","date_gmt":"2026-07-16T15:19:49","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/palette-form-builder\/"},"modified":"2026-07-16T15:19:38","modified_gmt":"2026-07-16T15:19:38","slug":"palette-form-builder","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/palette-form-builder\/","author":23524750,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.4.1","stable_tag":"1.4.1","tested":"7.0.1","requires":"5.6","requires_php":"7.2","requires_plugins":null,"header_name":"Palette Form Builder","header_author":"Palette Agency","header_description":"A modern multi-step form builder with drag & drop, live preview, RTL support, and email\/SMS notifications.","assets_banners_color":"","last_updated":"2026-07-16 15:19:38","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/palette.agency","rating":0,"author_block_rating":0,"active_installs":0,"downloads":30,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.4.1":{"tag":"1.4.1","author":"paletteagencyy","date":"2026-07-16 15:19:38"}},"upgrade_notice":{"1.4.0":"<p>Maintenance release addressing WordPress.org Plugin Review feedback: documented the MeliPayamak external service, upgraded SortableJS, and lengthened all prefixes to 4+ characters. Recommended for all users.<\/p>","1.3.0":"<p>Major update: drag &amp; drop builder, live preview, visual type selector, and full WordPress.org Plugin Guidelines compliance (all CDN dependencies removed, HTTP API used for SMS). Recommended for all users.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.4.1"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"The form builder interface with drag &amp; drop, collapsible cards, and visual type selector.","2":"Live preview modal showing the form as users will see it.","3":"The icon picker with searchable grid of 2,000+ Bootstrap Icons.","4":"Entries inbox with pagination, filtering, and CSV export.","5":"Single entry detail view with all submitted answers.","6":"Settings page with General, Footer, and Notifications tabs."}},"plugin_section":[],"plugin_tags":[361,2253,127662,1260,5811],"plugin_category":[42],"plugin_contributors":[271908],"plugin_business_model":[],"class_list":["post-334611","plugin","type-plugin","status-publish","hentry","plugin_tags-form","plugin_tags-form-builder","plugin_tags-multi-step","plugin_tags-persian","plugin_tags-rtl","plugin_category-contact-forms","plugin_contributors-paletteagencyy","plugin_committers-paletteagencyy"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/palette-form-builder.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>Palette Form Builder<\/strong> is a lightweight yet powerful WordPress plugin for creating beautiful multi-step (wizard-style) forms and questionnaires. Built with an object-oriented architecture and following WordPress.org Plugin Guidelines, it ships with a modern admin UI featuring drag &amp; drop reordering, live preview, a visual type selector, and a color palette picker.<\/p>\n\n<h4>Key Features<\/h4>\n\n<ul>\n<li><strong>Multi-Step Forms<\/strong> \u2014 Break long forms into digestible steps with a progress bar and smooth transitions.<\/li>\n<li><strong>Drag &amp; Drop Builder<\/strong> \u2014 Reorder questions instantly with SortableJS. No page reloads required.<\/li>\n<li><strong>Live Preview<\/strong> \u2014 See exactly how your form will look before publishing.<\/li>\n<li><strong>Visual Type Selector<\/strong> \u2014 Choose between text, radio, and checkbox question types with clear visual buttons.<\/li>\n<li><strong>Color Customization<\/strong> \u2014 Per-form primary color with a WordPress color picker and preset palette.<\/li>\n<li><strong>Icon Picker<\/strong> \u2014 Search and select from 2,000+ Bootstrap Icons for the welcome screen.<\/li>\n<li><strong>Email Notifications<\/strong> \u2014 Receive an email with full submission details. Customizable subject and body templates.<\/li>\n<li><strong>SMS Notifications<\/strong> \u2014 Optional SMS alerts via MeliPayamak (REST API) when a new entry is submitted.<\/li>\n<li><strong>Entries Management<\/strong> \u2014 View, filter, paginate, delete, and export submissions to CSV.<\/li>\n<li><strong>Login Required<\/strong> \u2014 Optionally restrict form submission to logged-in users.<\/li>\n<li><strong>RTL &amp; Persian<\/strong> \u2014 Full RTL support with the Vazirmatn font and complete Persian (fa_IR) translation.<\/li>\n<li><strong>100% Local Assets<\/strong> \u2014 All CSS, JS, and fonts are bundled locally. No external CDN dependencies.<\/li>\n<li><strong>Secure<\/strong> \u2014 Nonce-based CSRF protection, input sanitization, output escaping, and SSL-verified HTTP requests.<\/li>\n<\/ul>\n\n<h4>Question Types<\/h4>\n\n<ol>\n<li><strong>Text (Descriptive)<\/strong> \u2014 Single-line or multi-line text input.<\/li>\n<li><strong>Radio (Single Choice)<\/strong> \u2014 Select one option from a list.<\/li>\n<li><strong>Checkbox (Multiple Choice)<\/strong> \u2014 Select one or more options, with optional maximum selection limit.<\/li>\n<\/ol>\n\n<h4>Privacy<\/h4>\n\n<p>This plugin stores form submissions (entries) in the WordPress database as custom post types. Each entry may include:<\/p>\n\n<ul>\n<li>The answers provided by the user.<\/li>\n<li>The submitter's IP address (<code>REMOTE_ADDR<\/code>).<\/li>\n<li>The submitter's User-Agent string.<\/li>\n<li>The submission timestamp.<\/li>\n<\/ul>\n\n<p>If the \"Login Required\" option is enabled, the submitter's WordPress user ID is associated with the entry via the logged-in session.<\/p>\n\n<p>No data is sent to external services except:<\/p>\n\n<ul>\n<li><strong>Email<\/strong> \u2014 via <code>wp_mail()<\/code> to the configured recipient (default: site admin).<\/li>\n<li><strong>SMS<\/strong> \u2014 only if you explicitly enable and configure the MeliPayamak SMS integration in Settings.<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>This plugin optionally connects to the <strong>MeliPayamak<\/strong> SMS gateway API to send SMS notifications to the site administrator when a new form submission is received.<\/p>\n\n<ul>\n<li><strong>What the service is and what it is used for:<\/strong> MeliPayamak (melipayamak.com) is an Iranian SMS service provider. The plugin uses its REST API to deliver a short text notification (the configured SMS template) to the admin's phone number after each new entry, so the admin is instantly aware of new submissions.<\/li>\n<li><strong>What data is sent and when:<\/strong> The request is sent <strong>only<\/strong> when SMS notifications are explicitly enabled in <strong>Palette Form Builder \u2192 Settings \u2192 Notifications<\/strong> and a new form entry is submitted. The data sent to <code>https:\/\/api.melipayamak.com\/post\/send.asmx\/SendSms<\/code> includes: your MeliPayamak account username, your MeliPayamak account password, your sender number, the admin recipient phone number, and the SMS text (which may contain the site name, form title, entry ID, and a short summary of the submitted answers). No visitor data (such as IP address or User-Agent) is transmitted to MeliPayamak. The plugin also optionally calls <code>https:\/\/api.melipayamak.com\/post\/credit.asmx\/GetCredit<\/code> to check your account balance, sending only your username and password.<\/li>\n<li><strong>Service terms and privacy policy:<\/strong>\n\n<ul>\n<li>MeliPayamak Terms of Service: https:\/\/melipayamak.com<\/li>\n<li>MeliPayamak Privacy Policy: https:\/\/melipayamak.com<\/li>\n<\/ul><\/li>\n<\/ul>\n\n<p>By enabling SMS notifications you acknowledge that the submitted form answers (as configured in your SMS template) will be transmitted to MeliPayamak's servers.<\/p>\n\n<h4>Data Removal<\/h4>\n\n<p>When the plugin is deleted via the WordPress admin, <code>uninstall.php<\/code> removes:<\/p>\n\n<ul>\n<li>All <code>palette_form<\/code> posts and their meta.<\/li>\n<li>All <code>palette_entry<\/code> posts and their meta.<\/li>\n<li>The <code>palette_form_builder_settings<\/code> option.<\/li>\n<li>Cached transients.<\/li>\n<\/ul>\n\n<h3>Credits<\/h3>\n\n<p>This plugin bundles the following open-source libraries (all MIT licensed):<\/p>\n\n<ul>\n<li><a href=\"https:\/\/getbootstrap.com\/\">Bootstrap 5.3.3<\/a> \u2014 CSS framework.<\/li>\n<li><a href=\"https:\/\/icons.getbootstrap.com\/\">Bootstrap Icons 1.11.3<\/a> \u2014 Icon set.<\/li>\n<li><a href=\"https:\/\/github.com\/rastikerdar\/vazirmatn\">Vazirmatn<\/a> \u2014 Persian font.<\/li>\n<li><a href=\"https:\/\/sortablejs.github.io\/Sortable\/\">SortableJS 1.15.6<\/a> \u2014 Drag &amp; drop library.<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>palette-form-builder<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Go to <strong>Palette Form Builder<\/strong> in the admin sidebar to create your first form.<\/li>\n<li>Add questions using the drag &amp; drop builder, then publish.<\/li>\n<li>Use the shortcode <code>[palette_form id=\"123\"]<\/code> on any page or post (or use the \"Place on Page\" action).<\/li>\n<li>Configure email\/SMS notifications under <strong>Palette Form Builder \u2192 Settings<\/strong>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20use%20any%20external%20cdn%3F\"><h3>Does this plugin use any external CDN?<\/h3><\/dt>\n<dd><p>No. All assets (Bootstrap, Bootstrap Icons, Vazirmatn font, SortableJS) are bundled locally inside the plugin's <code>assets\/vendor\/<\/code> directory. This complies with WordPress.org Plugin Guidelines and ensures your forms work even if external services are down.<\/p><\/dd>\n<dt id=\"is%20the%20plugin%20rtl-compatible%3F\"><h3>Is the plugin RTL-compatible?<\/h3><\/dt>\n<dd><p>Yes. The plugin is fully RTL-aware and ships with the Vazirmatn Persian font. The admin interface and all strings are translated into Persian (fa_IR).<\/p><\/dd>\n<dt id=\"how%20do%20i%20enable%20sms%20notifications%3F\"><h3>How do I enable SMS notifications?<\/h3><\/dt>\n<dd><ol>\n<li>Go to <strong>Palette Form Builder \u2192 Settings \u2192 Notifications<\/strong>.<\/li>\n<li>Check \"Enable SMS notifications\".<\/li>\n<li>Enter your MeliPayamak username, password, sender number, and recipient number.<\/li>\n<li>Save settings. SMS will be sent via the MeliPayamak REST API using <code>wp_remote_post()<\/code>.<\/li>\n<\/ol><\/dd>\n<dt id=\"can%20i%20require%20users%20to%20log%20in%20before%20submitting%3F\"><h3>Can I require users to log in before submitting?<\/h3><\/dt>\n<dd><p>Yes. Each form has a \"Login Required\" checkbox in the Access Settings metabox. You can also set a global default in Settings \u2192 General.<\/p><\/dd>\n<dt id=\"how%20are%20submissions%20exported%3F\"><h3>How are submissions exported?<\/h3><\/dt>\n<dd><p>Go to <strong>Palette Form Builder \u2192 Inbox<\/strong>, optionally filter by form, then click \"Export CSV\". The file includes entry ID, date, form name, and all answers in UTF-8 (with BOM for Excel compatibility).<\/p><\/dd>\n<dt id=\"is%20my%20data%20removed%20when%20i%20uninstall%20the%20plugin%3F\"><h3>Is my data removed when I uninstall the plugin?<\/h3><\/dt>\n<dd><p>Yes. Deleting the plugin triggers <code>uninstall.php<\/code>, which removes all forms, entries, settings, and cached transients from your database.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.4.1<\/h4>\n\n<ul>\n<li>SECURITY: Fixed an XSS vulnerability in the client-side <code>escapeHtml()<\/code> helper where HTML entities were stripped during development, leaving title\/description\/options unescaped when rendered into the DOM.<\/li>\n<li>SECURITY: Sanitized the dynamic inline CSS output (<code>wp_add_inline_style<\/code>) with <code>sanitize_hex_color()<\/code> and <code>safecss_filter_attr()<\/code> so the per-form primary color meta value can no longer inject malicious CSS rules.<\/li>\n<li>SECURITY: Escaped the intro\/outro text in the frontend JavaScript output with the new <code>escapeHtmlMultiline()<\/code> helper (late escaping at the point of output).<\/li>\n<li>SECURITY: Applied \"escape late\" to all dynamic output \u2014 IDs are cast with <code>absint()<\/code>, colors validated as hex, icon classes sanitized with <code>sanitize_html_class()<\/code>, and the settings tab state no longer echoes a variable.<\/li>\n<li>SECURITY: Hardened the CSV export filename against header injection by whitelist-filtering the date value.<\/li>\n<\/ul>\n\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>NEW: Documented the MeliPayamak external SMS service in the readme (External services section).<\/li>\n<li>UPDATE: Upgraded bundled SortableJS from 1.15.2 to 1.15.6.<\/li>\n<li>FIX: Removed leftover template content (\"Arbitrary section\" \/ \"A Brief Markdown Example\") from the readme.<\/li>\n<li>FIX: Moved inline <code>&lt;style&gt;<\/code> output to <code>wp_add_inline_style()<\/code> per WordPress.org guidelines.<\/li>\n<li>FIX: Lengthened all plugin prefixes from <code>pf<\/code>\/<code>PF<\/code> to the 4+ character <code>palefobu<\/code>\/<code>PALEFOBU<\/code> prefix to avoid naming collisions.<\/li>\n<li>FIX: Corrected the Contributors list to match the WordPress.org account username.<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>NEW: Drag &amp; drop question reordering (SortableJS 1.15.2, bundled locally).<\/li>\n<li>NEW: Live preview modal for forms.<\/li>\n<li>NEW: Visual type selector replacing dropdown.<\/li>\n<li>NEW: Color palette presets in the color picker.<\/li>\n<li>NEW: Collapsible question cards with type badges.<\/li>\n<li>NEW: Sticky toolbar and empty state.<\/li>\n<li>NEW: Keyboard shortcuts (Ctrl+Enter to add question).<\/li>\n<li>FIX: Question type not changing when switching between text\/radio\/checkbox.<\/li>\n<li>SECURITY: WordPress.org Plugin Guidelines audit \u2014 removed all CDN dependencies, replaced SoapClient with wp_remote_post, removed SSL verification bypass, added per-field sanitization of form data, added dismissible admin notices.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>NEW: Email notification system with customizable subject\/body templates.<\/li>\n<li>NEW: SMS notification via MeliPayamak.<\/li>\n<li>NEW: CSV export of entries.<\/li>\n<li>NEW: Entry filtering by form and pagination.<\/li>\n<li>NEW: Login-required option per form.<\/li>\n<li>NEW: Footer customization in settings.<\/li>\n<li>FIX: Improved nonce verification and output escaping.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>NEW: Multi-step form wizard with progress bar.<\/li>\n<li>NEW: Toast notifications and double-submit prevention.<\/li>\n<li>NEW: Autosave answers to localStorage.<\/li>\n<li>NEW: Required field validation.<\/li>\n<li>NEW: Accessibility improvements (ARIA, focus management, keyboard nav).<\/li>\n<li>FIX: Mobile responsiveness and RTL layout fixes.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<li>Form builder with text, radio, and checkbox question types.<\/li>\n<li>Shortcode rendering with Bootstrap 5 RTL.<\/li>\n<li>Entries storage as custom post type.<\/li>\n<li>Settings page with general, footer, and notification tabs.<\/li>\n<\/ul>","raw_excerpt":"A modern, multi-step form builder with drag &amp; drop, live preview, RTL support, email &amp; SMS notifications, and a fully localized admin interface.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/334611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=334611"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/paletteagencyy"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=334611"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=334611"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=334611"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=334611"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=334611"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=334611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}