formflow v4.2.1

Release 4.2.1. See CHANGELOG.

formflow v4.2.0

Release 4.2.0. See CHANGELOG.

formflow v4.1.0

Release 4.1.0. See CHANGELOG.

FormFlow Pro v4.0.8

Delivery fix: the updater now trusts the GitHub-release host the unified update endpoint serves (4.0.7 would have refused its own updates). Adds Ed25519 update-package signature verification. Signed release.

FormFlow Pro v4.0.7

Security release. Microscope remediation: admin submission-detail stored-XSS escaping, CSV formula-injection neutralization, handoff redirect validation + rate-limit, trusted-proxy client-IP, IntelliSource SSRF guard + updater host-pin. Removed the hardcoded FFTEST-ADMIN-DEV-MODE license-bypass key (kept the wp-config FORMFLOW_ADMIN_KEY operator path) and the tester-bridge harness. Includes the accumulated 4.0.x line (canary-validated 3.3.0→4.0.7 upgrade). See CHANGELOG.md.

FormFlow Pro v3.3.0

FormFlow Pro v3.3.0

This is a cleanup release on top of v3.2.0 (which fixed the hourly get_due_reports() cron fatal). Three days of post-audit hygiene rolled up.

v3.3.0 — Phase 3 — Dead-code purge

Removed ~5,000 lines and 17 files of unreachable code, flagged by the 2026-05-28 audit (CAT / MAX / PHIL):

• ISF\ML\FormPrediction + ISF\ML\FormPredictionApi (~460 LOC + REST routes + weekly cron) — phantom ML microservice that was never operational
• ISF\PWAHandler (539 LOC + classmap + FeatureManager + feature-config) — class never instantiated; users could toggle PWA support and configure phantom defaults that did nothing
• ISF\ABTesting (543 LOC) — get_variation() was UI-referenced but no application path applied variations
• ISF\ChatbotAssistant (909 LOC) — settings panel configured a chatbot that never rendered
• ISF\FraudDetection (707 LOC) — risk-score logic never invoked from any submission handler
• ISF\Platform\BusinessIntelligence (1,464 LOC) — instantiated only from its own orphan stub view that had no menu registration
• Various orphan trait / JS files

Each removal verified against the Phase 5 regression suite (25/25 green after every kill).

v3.2.2 — Phase 1 — Form Builder unblocked

• Form Editor Beta "Form fields" task page now renders field cards. Removed dead $content.sortable('refresh') call left over from the HTML5 drag-and-drop migration that was throwing cannot call methods on sortable prior to initialization.

v3.2.1 — Phase 2 audit cleanup

• wp_isf_deliveries table missing on upgraded sites — destinations subsystem now migrates the table via dbDelta for sites that activated before destinations existed
• Multisite / HyperDB migration safety — run_migrations() now uses $wpdb->dbname instead of the DB_NAME constant
• Removed dead nested formflow/ directory — 3.5MB duplicate of the plugin source tree that nothing referenced

v3.2.0 — Hourly wp-cron fatal fix

• Database::get_due_reports() signature is now ?string $frequency = null — the cron at HH:55 was throwing every hour because the method required an arg the caller never passed. Scheduled reports start running again.

Installation

1. Download formflow-3.3.0.zip below
2. Upload to WordPress via Plugins → Add New → Upload Plugin
3. Choose "Replace current with uploaded" — do not deactivate-and-delete; uninstall.php drops your form-builder tables

FormFlow Pro v3.2.0

FormFlow Pro v3.2.0

Fixed

• Hourly wp-cron fatal: Database::get_due_reports() argument-count error has been throwing every hour at HH:55 since the signature was tightened. class-plugin.php::send_scheduled_reports() calls the method with no args; the signature required one. Result: scheduled reports never ran and the WP error log got a fresh fatal every hour. Method now accepts ?string $frequency = null — when null, returns all active reports (matches the cron's actual intent). When called with a specific frequency, behaviour is unchanged.

Installation

1. Download `formflow-3.2.0.zip` below
2. Upload to WordPress via Plugins → Add New → Upload Plugin
3. Choose "Replace current with uploaded" when prompted (overwrite-install — do not delete the previous version first; FormFlow's uninstall.php drops your form-builder tables)

Sites currently affected

Any installation that has FormFlow Pro active will have been throwing this fatal hourly. Update at your convenience — no data is at risk; the only impact has been WP error log noise and scheduled reports not delivering.

FormFlow Pro v2.8.6

2.8.6 (2026-05-15)

• Fix fatal — move ABSPATH guard after namespace declaration in 100 namespaced files (cd6f378 regression that 500'd sites). Prod hotfixed 2026-05-15; durable release.

Durable fix for the ABSPATH/namespace 500 regression; prod hotfixed 2026-05-15.

FormFlow Pro v2.8.5

Security

• Fix unprepared SQL queries in deactivator and diagnostics
• Add rate limiting to 7 public endpoints (address, geocoding, bundler)

FormFlow Pro v2.8.4

Changes

• Fix syntax error in white-label.php (namespace keyword)
• Fix SQL injection in uninstall.php
• Split large admin/database classes into focused traits
• Add $wpdb->prepare to SHOW TABLES queries