Skip to content

Releases: WordPress/secure-custom-fields

6.5.7

19 Sep 16:39

Choose a tag to compare

Release Date 28 Aug 2025

Features

  • Flexible Content layouts can now be renamed in the post editor, giving content editors better clarity when managing layouts.
  • Flexible Content layouts can now be disabled, preventing them from rendering on the frontend without needing to delete their data.
  • Flexible Content layouts can now be collapsed and expanded in bulk for faster content editing.
  • Editing a Flexible Content layout now highlights the layout being edited, making it easier to identify.
  • The Date and Date Time Picker fields can now be configured to default to the current date.
  • Custom Icon Picker tabs now work correctly when used inside an ACF Block.
  • Duplicating a Field Group no longer causes a fatal error when using Russian translations.
  • ACF classes no longer use dynamic class properties, improving compatibility with PHP 8.2+.
  • Field group metabox collapse and expand buttons are no longer misaligned in the post editor.
  • HTML is now escaped from field validation errors and tooltips.
  • Added a new source parameter to the /wp/v2/types REST API endpoint that allows filtering post types by their origin: core (WordPress built-in), scf (for SCF managed types), or other for the rest of CPTs.

Security

– Unsafe HTML in field group labels is now correctly escaped for conditionally loaded field groups, resolving a JS execution vulnerability in the classic editor.
– HTML is now escaped from field group labels when output in the ACF admin.
– Bidirectional and Conditional Logic Select2 elements no longer render HTML in field labels or post titles.
– The acf.escHtml function now uses the third party DOMPurify library to ensure all unsafe HTML is removed. A new esc_html_dompurify_config JS filter can be used to modify the default behaviour.
– Post titles are now correctly escaped whenever they are output by ACF code. Thanks to Shogo Kumamaru of LAC Co., Ltd. for the responsible disclosure.
– An admin notice is now displayed when version 3 of the Select2 library is used, as it has now been deprecated in favor of version 4.

6.5.6

19 Sep 16:37

Choose a tag to compare

Warning

Release discarded due to SVN errors.

6.5.5

31 Jul 13:53

Choose a tag to compare

Features

  • Connect block attributes with custom fields via UI.
  • Remove the word 'New' from default add-new* label values.

Bug Fixes

  • Bug fix: Prevent fatal if class does not exist on Beta Features.

6.5.4

31 Jul 11:46
a5f3705

Choose a tag to compare

6.5.4

Release Date 30 Jul 2025

Revert from 6.5.2.

6.5.2

Release Date 30 Jul 2025

Features

  • Connect block attributes with custom fields via UI.
  • Remove the word 'New' from default add-new* label values.

6.5.1

02 Jul 12:57
0703320

Choose a tag to compare

Bug Fixes

  • Command Palette: Use @wordpress\icons instead of Dashicons. #189

6.5.0

23 Jun 10:23

Choose a tag to compare

Enhancements & Features

  • Added Command Palette support.
  • Added editor preview to acf-field source.
  • Added an endpoint to retrieve the custom fields of a post type.
  • Added nav menu as field type.
  • Added compatibility with Woo HPOS for order fields and subscriptions. ( Ported from ACF )
  • Create new options when editing a fields value on Selector. ( Ported from ACF )
  • The “Escaped HTML” warning notice is now disabled by default. ( Ported from ACF )
  • Added new acf/fields/icon_picker/{tab_name}/icons filter ( Ported from ACF )

Bug Fixes

  • Update initialization of the acfL10n object to ensure it's available globally.
  • SCF Blocks are now forced into preview mode when editing a synced pattern. ( Ported from ACF )
  • SCF no longer causes an infinite loop in bbPress when editing replies. ( Ported from ACF )
  • Changing a field type no longer enables the “Allow Access to Value in Editor UI” setting. ( Ported from ACF )
  • Blocks registered via acf_register_block_type() with a parent value of null no longer fail to register. ( Ported from ACF )
  • Fix AJAX repeater pagination. ( Ported from ACF )
  • Paginated Repeater fields no longer save duplicate values when saving to a WooCommerce Order with HPOS disabled ( Ported from ACF )

Testing

  • Added an initial batch of e2e tests.

6.4.2

14 Apr 14:52
0801bb0

Choose a tag to compare

  • Uses a more stable function to validate an URL on field admin. (#106) by @cbravobernal
  • Revert text domain change for the shortcode attr filter. (#101) by @pkevan
  • Correct the release date in the changelog for 6.4.1 (#75) by @YanMetelitsa

Full Changelog: 6.4.1...6.4.2

6.4.1

07 Mar 19:11
0db92f2

Choose a tag to compare

What's Changed

New Contributors

Full Changelog: 6.4.0-beta1...6.4.1

6.4.1-beta7

03 Mar 18:49
3609f7c

Choose a tag to compare

6.4.1-beta7 Pre-release
Pre-release

What's Changed

  • Build Tools: Add NVM file and wp-env dev tools by @cbravobernal in #28
  • Fixes old json in acf-json folder not showing in Sync available by @cyberwani in #30
  • Docs: Add initial docs and tooling for import into developer.wordpress.org by @kraftbj in #35
  • Add basic PHPUnit testing setup by @kraftbj in #29
  • Tools: Add pre-release scripting by @kraftbj in #42

New Contributors

Full Changelog: 6.4.1-beta6...6.4.1-beta7

6.4.1-beta6

13 Jan 00:20
9815acc

Choose a tag to compare

6.4.1-beta6 Pre-release
Pre-release

What's Changed

  • Resolve issue with option pages no longer displaying by @kraftbj in #25
  • Resolve missing function from clone field by @kraftbj in #26

Full Changelog: 6.4.1-beta5...6.4.1-beta6