The assets\/build\/<\/code> files shipped in this plugin (builder.js, frontend.js, and their CSS) are compiled by webpack from real, unminified source \u2014 nothing here is obfuscated, only minified for production the same way every WordPress admin ships its own JS. That source ships in this same plugin package: see assets\/src\/<\/code> for the real, readable JavaScript, and webpack.config.js<\/code>\/webpack.vue.config.js<\/code> plus package.json<\/code> for the exact build configuration and tooling versions used to produce assets\/build\/<\/code> from it. To rebuild it yourself: npm ci<\/code> followed by npm run build<\/code> (the admin builder and public front-end bundle) and npm run vue:build<\/code> (the Vue-based Forms List screen).<\/p><\/dd>\nWhat external services does this plugin use?<\/h3><\/dt>\nGoogle Fonts (optional, off by default).<\/strong> Turned on under Global Settings > General, this plugin loads the Poppins typeface from Google Fonts (fonts.googleapis.com<\/code>\/fonts.gstatic.com<\/code>) on ChargeForms' own wp-admin screens only (never on your site's front end, never on a visitor-facing page) so the admin UI matches its own design. No request to Google happens until you enable it; the admin UI uses your system font stack otherwise. While enabled, this sends the logged-in admin's IP address and browser info to Google on every admin page load, the same as any page that embeds a Google Fonts stylesheet. Google's terms: https:\/\/developers.google.com\/fonts\/faq and privacy policy: https:\/\/policies.google.com\/privacy.<\/p>\n\nreCAPTCHA \/ hCaptcha \/ Cloudflare Turnstile \/ CleanTalk.<\/strong> Entirely optional, off by default. If you turn one on (Global Settings > Security) to add spam protection to your forms, the corresponding third-party service's own script loads on your front-end forms and processes the visitor's IP\/browser data per that service's own terms \u2014 Google (reCAPTCHA): https:\/\/policies.google.com\/privacy, hCaptcha: https:\/\/www.hcaptcha.com\/privacy, Cloudflare (Turnstile): https:\/\/www.cloudflare.com\/privacypolicy\/, CleanTalk: https:\/\/cleantalk.org\/privacy.<\/p>\n\nStripe \/ PayPal (optional).<\/strong> Only active on a form where you've added a Payment field and connected your own Stripe or PayPal account (Global Settings > Payment Settings). When a visitor pays, the payment amount and the payer's billing details they entered are sent directly to Stripe (https:\/\/stripe.com\/privacy) or PayPal (https:\/\/www.paypal.com\/privacy) to process the charge \u2014 standard for any WordPress payment plugin. Nothing is sent to either service on a form with no Payment field.<\/p>\n\nYour own configured integrations (Webhook, Mailchimp, Slack, Discord, Telegram, Notion, HubSpot, Google Sheets).<\/strong> Only ever send data if you explicitly connect them yourself (Integrations screen) \u2014 nothing is sent to any of these unless you've entered your own API key\/URL for that specific service. When connected, every submission's data is sent to that service at the time of submission: Mailchimp (subscriber added to your list) \u2014 https:\/\/mailchimp.com\/legal\/terms\/ \/ https:\/\/mailchimp.com\/legal\/privacy\/; Notion (a page created in your database) \u2014 https:\/\/notion.notion.site\/Terms-and-Privacy-28ffdd083dc3473e9c2da6ec011b58ac \/ https:\/\/www.notion.com\/trust\/privacy-policy; HubSpot (a contact created\/updated in your CRM) \u2014 https:\/\/legal.hubspot.com\/terms-of-service \/ https:\/\/legal.hubspot.com\/privacy-policy; Telegram (a message sent via your bot) \u2014 https:\/\/telegram.org\/tos \/ https:\/\/telegram.org\/privacy.<\/p>\n\nAddress autocomplete (optional).<\/strong> If a form uses the Address field's autocomplete feature, each keystroke in the address box is sent to OpenStreetMap's Nominatim search API (nominatim.openstreetmap.org<\/code>) to fetch matching addresses. Nominatim usage policy: https:\/\/operations.osmfoundation.org\/policies\/nominatim\/ \u2014 OSM Foundation privacy policy: https:\/\/wiki.osmfoundation.org\/wiki\/Privacy_Policy.<\/p>\n\nLicense validation (Pro only).<\/strong> If you activate a Pro license key, that key and your site URL are sent to chargeforms.com to verify it. Nothing is sent if you're on the free plan. Terms: https:\/\/chargeforms.com\/legal\/terms \u2014 Privacy: https:\/\/chargeforms.com\/legal\/privacy.<\/p><\/dd>\n\n<\/dl>\n\n\n0.270.13<\/h4>\n\n\n- Fixed: removed
chargeforms<\/code> from the Contributors header \u2014 not a registered WordPress.org username, so it was silently dropped on import. Only uzairrehman<\/code> remains.<\/li>\n- Changed: rewrote the Description section into organized feature sections (Form Builder, Payments, Entry Management, Email Delivery, Integrations, Spam & Security) and expanded the FAQ with questions on performance, conditional logic, multi-step forms, entry export\/import, and migrating from Contact Form 7, WPForms, or Ninja Forms.<\/li>\n
- Changed: updated plugin tags to better reflect the plugin's actual differentiators (payment form, multi-step form, conditional logic).<\/li>\n<\/ul>\n\n
0.270.12<\/h4>\n\n\n- Fixed: escape generated form markup, SVG icons, and report output at the point of rendering for WordPress.org security compliance.<\/li>\n
- Changed: CSV entry import, all bundled templates, Save & Resume, multiple SMTP connections, and every implemented builder field are available without a paid license.<\/li>\n
- Improved: the readme and license screen now state clearly that every feature shipped in the WordPress.org plugin is free.<\/li>\n<\/ul>\n\n
0.268.0<\/h4>\n\n\n- Fix: Keep existing Pro fields editable through MCP when a license expires, while blocking new unlicensed Pro fields.<\/li>\n
- Test: Validate structured AI previews and WordPress identifier placeholders.<\/li>\n<\/ul>\n\n
0.267.0<\/h4>\n\n\n- Fix: Pro access requires a verified paid license activated on this site.<\/li>\n
- Fix: Paid expiry is enforced locally; temporary verification outages have a bounded 72-hour grace period.<\/li>\n
- Fix: Display accurate site limits and retry remote site-slot release after a failed deactivation.<\/li>\n<\/ul>\n\n
0.266.0<\/h4>\n\n\n- Fixed: two function signatures used PHP 8.4's deprecated implicit-nullable form (
array $x = null<\/code>). They are now written explicitly as ?array $x = null<\/code> \u2014 identical behaviour, no deprecation notice. The explicit form still works on the plugin's minimum PHP 7.4.<\/li>\n- Improved: the test suite no longer prints deprecation notices from its own REST request stub when run with full error reporting. No plugin behaviour changed in this release.<\/li>\n<\/ul>\n\n
0.265.0<\/h4>\n\n\n- Fixed: a column's width only ever applied on desktop. The width was printed into the page as an inline flex-basis, which overrides every media query in the stylesheet, so the builder's Tablet and Mobile previews had no effect on the real form and two-column rows did not stack properly on smaller screens. Columns now carry their width as CSS variables and the stylesheet applies the right one per screen size: tablet (up to 1024px) falls back to the desktop width, and mobile (up to 600px) falls back to full width unless you set a specific mobile width.<\/li>\n
- Added: per-device column widths in the builder \u2014 select a column, switch the preview to Tablet or Mobile, and set a width just for that screen size, or choose Inherit to reuse the wider device's width.<\/li>\n
- Fixed: a column could not be selected in the form builder at all. Clicking a column always selected its parent row instead, so the Column Width setting had no way to appear. Columns are now selectable like any other field, including with the keyboard.<\/li>\n
- Improved: verified the plugin still parses cleanly under PHP 7.4+ and that the existing test suite and build stay green.<\/li>\n<\/ul>\n\n
0.264.0<\/h4>\n\n\n- Fixed: form submissions silently stopped working on sites using a page cache or CDN. The form's security nonce is printed into the page, so a cached page kept serving the same nonce until it expired (WordPress nonces last roughly 12-24 hours), after which every submission was rejected with \"Security check failed\" and nothing on the page explained why. The form now refreshes its own nonce when the page loads, so cached pages keep submitting normally.<\/li>\n
- Fixed: the Forms screen loaded about 1.3 MB of JavaScript and CSS it never used. The older Vue version of that screen is retired, but its files were still being loaded on every visit even though the page renders the standard table. They now load only when the Vue screen is explicitly requested, removing that dead weight from every Forms page load.<\/li>\n
- Improved: verified the plugin still parses cleanly under PHP 7.4+ (its declared minimum) and that the existing test suite and build stay green.<\/li>\n<\/ul>\n\n
0.263.0<\/h4>\n\n\n- Fixed: third-round review findings \u2014 Notion's Terms\/Privacy URLs and the license API's chargeforms.com Terms\/Privacy URLs in the readme were broken (401\/404); replaced with verified-working links (chargeforms.com's real paths are under
\/legal\/<\/code>, not \/terms<\/code>\/\/privacy<\/code>). Added HubSpot's Terms\/Privacy links, which the readme had omitted. Removed the admin-notice-suppression feature entirely (Menu and Builder_Page both cleared WordPress core's and other plugins' admin_notices on ChargeForms' own screens) \u2014 not something WordPress.org guidelines allow scoping down, only removing, same as the earlier Custom CSS\/JS removal.<\/li>\n<\/ul>\n\n0.262.0<\/h4>\n\n\n- Fixed: WordPress.org's automated submission scan rejected 0.261.0 outright (
PluginCheck.CodeAnalysis.Heredoc.NotAllowed<\/code>) \u2014 the wp_add_inline_script()<\/code>\/wp_add_inline_style()<\/code> conversions in 0.261.0 used heredoc\/nowdoc (<<<<\/code>) syntax to hold the JS\/CSS strings, which this scanner disallows entirely regardless of content. All 18 heredoc\/nowdoc blocks rewritten as plain quoted PHP strings (multi-line single-quoted strings, or string concatenation where a translated value needed to be inserted) with identical JS\/CSS content \u2014 no behavior change, just different PHP string syntax.<\/li>\n<\/ul>\n\n0.261.0<\/h4>\n\n\n- Fixed: addressed the WordPress.org directory's second review pass \u2014 text domain renamed to match the reviewed plugin slug (
chargeforms<\/code>), the Custom CSS\/JS feature removed entirely (arbitrary code insertion isn't permitted, only removing it satisfies the guideline), every remaining inline <script><\/code>\/<style><\/code> block converted to wp_enqueue_script<\/code>\/wp_add_inline_script<\/code>\/wp_add_inline_style<\/code>, two unused core-file includes removed, Google Fonts changed from always-on to an explicit opt-in toggle (Global Settings > General, off by default), four previously-undisclosed external services documented (Mailchimp, Notion, Telegram, Nominatim\/OpenStreetMap), and the built JS\/CSS source now ships inside the plugin package itself (assets\/src\/<\/code>, webpack.config.js<\/code>, package.json<\/code>) since this plugin's repository stays private.<\/li>\n<\/ul>\n\n0.260.0<\/h4>\n\n\n- Fixed: the live Plugin Check scan's remaining 18
WordPress.DB.PreparedSQL.NotPrepared<\/code> errors (entries\/forms\/form-starts data layer). Two earlier restructuring attempts failed (0.255.0's variable-held query text, 0.257.0's single-ternary-of-literals both still tripped the check); the actual fix the scanner accepts is duplicating each conditional branch so $wpdb->prepare()<\/code>'s query-text argument is a genuine inline literal at every call site, with zero variable indirection of any kind \u2014 verified against the live scanner one method at a time before applying it everywhere.<\/li>\n<\/ul>\n\n0.254.0<\/h4>\n\n\n- Fixed: every remaining direct-SQL \"prepared statement\" warning from the site's live Plugin Check scan (table names built from string concatenation, even though every value was already placeholdered) \u2014 rewritten to use
$wpdb->prepare()<\/code>'s %i<\/code> identifier placeholder (WP 6.2+) across the entries, activity log, drafts, subscriptions, form starts, notification log, API log, email log, forms, install migration, and legacy-importer data layers. Minimum required WordPress version raised from 6.0 to 6.2 for %i<\/code> support.<\/li>\n<\/ul>\n\n0.253.0<\/h4>\n\n\n- Fixed: a few more nonce-recommended\/sanitization warnings caught after re-running the site's own live Plugin Check tool (its results don't match the automated pre-review email's tool 1:1), plus mixed line endings in class-email-log.php.<\/li>\n<\/ul>\n\n
0.252.0<\/h4>\n\n\n- Fixed: a second, larger round of WordPress.org Plugin Check findings caught by the tool's live in-admin scan after 0.251.0's release \u2014 more escaping gaps in field-rendering helpers, a genuine i18n string wrapped in raw HTML,
ini_set()<\/code> sniff coverage, an unprefixed global in uninstall.php, and every remaining direct-database-query\/prepared-SQL warning across the data layer (verified safe \u2014 each is a fixed internal table-name constant alongside properly placeholdered values, not user input) is now explicitly annotated with its reasoning instead of silently triggering the scanner.<\/li>\n<\/ul>\n\n0.250.0<\/h4>\n\n\n- Fixed: a batch of WordPress.org Plugin Check findings from the plugin's first directory submission review \u2014 nonce unslashing\/sanitization (18 spots), $_FILES name\/type sanitization, missing translators comments, corrected phpcs:ignore sniff codes on file operations, Stripe billing-portal redirect now uses wp_safe_redirect(), removed load_plugin_textdomain()\/Domain Path header (unneeded since WP 4.6), dropped hotlinked third-party icons from the Migrator tool, added an == External services == readme section, and fixed a dead CleanTalk privacy-policy link.<\/li>\n<\/ul>\n\n
Older versions<\/h4>\n\n
The full changelog going back to 0.208.0 (including 0.244.0 and earlier) is in CHANGELOG.md<\/code>, shipped in this plugin's own files (this section is capped at 5000 characters).<\/p>\n\nAdditional opt-in contact integrations<\/h3>\n\n
Brevo and ActiveCampaign: when configured and enabled for a form, send visitor email and configured name values to the selected list. Brevo terms\/privacy: https:\/\/www.brevo.com\/legal\/termsofuse\/ and https:\/\/www.brevo.com\/legal\/privacypolicy\/. ActiveCampaign terms\/privacy: https:\/\/www.activecampaign.com\/legal\/terms-of-service and https:\/\/www.activecampaign.com\/legal\/privacy-policy. No requests run until connected and enabled, except an explicitly requested read-only connection test.<\/p>","raw_excerpt":"A fast, free drag-and-drop form builder for WordPress with conditional logic, entry management, and email notifications built in.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/371377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=371377"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/uzairrehman"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=371377"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=371377"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=371377"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=371377"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=371377"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=371377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}