Changelog

Version 2.8.0 Current

Released: October 9, 2026

• New: A GF Utility settings page under Forms → Settings, with a switch and a short description per tool. A tool that is switched off is removed from Gravity Forms; its form, field, notification and feed settings are kept for when it's switched back on. Every tool is on unless it's switched off, and switches saved by versions before 2.6.0 are used again.
• New: Create Page for Form. A Create Page action per form in Forms → Forms creates a draft page with the form, titled after it, and opens it in the editor.

Version 2.7.4

Released: October 8, 2026

• Fixed: WP-CLI commands could stop with a PHP fatal error when run from a directory with its own Composer autoloader (vendor/autoload.php), as on Composer-managed sites. The plugin now always loads its own.
• Fixed: The "Visit plugin website" link on the Plugins page now goes to the plugin's current website.

Version 2.7.3

Released: October 8, 2026

• Security: The manual "Process Feeds" bulk action only checked a security token. It now also requires permission to edit entries in Gravity Forms, like Resend Notifications, and only processes feeds and entries that belong to the form.
• Security: The "Process on Entry Update" toggle didn't check the add-on's own permission, which Gravity Forms' Active toggle on the same feed list does. Changing it now also requires permission to manage that add-on's feeds.
• Security: The form title lookup for the admin bar "Edit Forms" menu could be called by logged-out visitors. It now requires a valid security token and permission to view entries or edit forms.
• Security: Page names and add-on titles and icons on the forms list are now escaped. The "Notification sent" entry note now escapes the notification name, subject and addresses: the subject can contain values submitted in the form. It no longer lists BCC addresses, which everyone who can view entry notes could see.
• Security: The pages listed for a form on the forms list and in the Utility toolbar included drafts, pending and scheduled posts of every author, and private posts the user can't read. Only published posts and private posts the user can read are listed now.
• Security: "Hide form if logged-in user already submitted this form" only hid the form: a page that was still open, an AJAX or API submission could submit it again. A second submission by the same user is now refused.
• Security: Fields set to Redact were still stored in Save and Continue drafts, and their submitted value could show up in another entry read in the same request (e.g. in its notification). Drafts no longer contain redacted values, and the value is only available to the entry it was submitted with.
• Security: Hardening from a security audit: the plugin's PHP files stop when opened directly, database queries and output are escaped where they're used, the admin bar menu and the Process Feeds messages insert text instead of HTML, and Toggle All Fields Required uses an up-to-date minified script.
• Security: The log no longer contains the full "Entry is updated" notification settings (email addresses, message text) or the add-on list on every entry update, only IDs and counts.
• Fixed: The "Process on Entry Update" toggle wasn't shown on add-on feed lists in WordPress 7.1, which also showed an extra empty column. It now looks like Gravity Forms' own Active toggle.
• Fixed: Feeds with "Process on Entry Update" now run on entry update even when they already ran for the entry, e.g. on submission. Since Gravity Forms 2.9.19 they were skipped. This also works for add-ons that process feeds in the background.
• Fixed: After an entry update, later feed processing in the same request (e.g. a payment callback) no longer skips feeds without "Process on Entry Update".
• Fixed: An entry update no longer erases which feeds already ran for the entry, so those feeds aren't sent again the next time the entry is processed.
• Fixed: Feeds run once per entry update, also when both entry update hooks fire for the same entry.
• Fixed: Manual "Process Feeds" didn't work when Forms > Entries was opened from the menu without a form selected. Errors are now shown in the modal, and "Select all N entries" gets a clear message instead of failing silently.
• Fixed: The admin bar "Edit Forms" menu now appears for administrators, and its menus open in WordPress 7. Edit Form and Form Settings require permission to edit forms, a user with a single link gets a working link instead of "#", and a multi-page form is listed once.
• Fixed: "Entry is updated" notifications were only sent for the first entry updated in a request, e.g. a GP Nested Forms parent and its child entries updated together by a payment callback. Every updated entry now gets its notifications.
• Fixed: The "Notification sent" entry note now looks like Gravity Forms' own notification notes. Its text was shown in columns next to each other, with an empty line and a double space when the notification has no From name.
• Fixed: On the forms list, users who can't edit a page with the form got empty page links and a PHP notice per link. The page title now links to the page itself, without an Edit link.
• Fixed: The "Process Feeds" bulk action could be missing from the entries list, depending on the order in which WordPress loads the plugins.
• Updated Freemius SDK to the latest version.

Thanks to Bohdan Smaha for pointing out security issues and bugs.

Version 2.7.2

Released: October 5, 2026

• Security: The "Process on Entry Update" feed setting could be changed by any logged-in user, including subscribers. Changing it now requires a valid security token and permission to edit forms in Gravity Forms.
• Fixed: Saving the "Process on Entry Update" setting with an unchanged value no longer reports an error.

Thanks to Bohdan Smaha for pointing out security issues and bugs.

Version 2.7.1

Released: August 17, 2026

• Updated the Freemius SDK.
• Tested with WordPress 7.1.0.

Version 2.7.0

Released: March 13, 2026

• New: Added custom HTML placeholder support to the "Hide Form from User Once Submitted"
• Improved: Introduces composer for class loading and package management
• Fixed: Issue where "toggle all required" would not immediately reflect the update
• UI: Improved interface for "toggle all required" modal

Older versions

Versions before 2.7.0 were maintained by Gravity+. We do not have records of these changes.