Releases: WordPress/secure-custom-fields
6.6.0
Release Date 19 Nov 2025
Features
- Backported features up to 6.6.0.
- Abilities API integration. Post Type abilities.
- JSON schemas validation infrastructure.
Fixes
- Fixed Function in network.php
- SCF label in "More" menu.
- Get the formatted_value from the original field value.
- Blocks V3: Fix flexible content not working in sidebar - modal.
- Use specific entity prefixes for key generation when duplicating entities.
6.5.7
Release Date 28 Aug 2025
Features
- Flexible Content layouts can now be renamed in the post editor, giving content editors better clarity when managing layouts.
- Flexible Content layouts can now be disabled, preventing them from rendering on the frontend without needing to delete their data.
- Flexible Content layouts can now be collapsed and expanded in bulk for faster content editing.
- Editing a Flexible Content layout now highlights the layout being edited, making it easier to identify.
- The Date and Date Time Picker fields can now be configured to default to the current date.
- Custom Icon Picker tabs now work correctly when used inside an ACF Block.
- Duplicating a Field Group no longer causes a fatal error when using Russian translations.
- ACF classes no longer use dynamic class properties, improving compatibility with PHP 8.2+.
- Field group metabox collapse and expand buttons are no longer misaligned in the post editor.
- HTML is now escaped from field validation errors and tooltips.
- Added a new source parameter to the /wp/v2/types REST API endpoint that allows filtering post types by their origin: core (WordPress built-in), scf (for SCF managed types), or other for the rest of CPTs.
Security
– Unsafe HTML in field group labels is now correctly escaped for conditionally loaded field groups, resolving a JS execution vulnerability in the classic editor.
– HTML is now escaped from field group labels when output in the ACF admin.
– Bidirectional and Conditional Logic Select2 elements no longer render HTML in field labels or post titles.
– The acf.escHtml function now uses the third party DOMPurify library to ensure all unsafe HTML is removed. A new esc_html_dompurify_config JS filter can be used to modify the default behaviour.
– Post titles are now correctly escaped whenever they are output by ACF code. Thanks to Shogo Kumamaru of LAC Co., Ltd. for the responsible disclosure.
– An admin notice is now displayed when version 3 of the Select2 library is used, as it has now been deprecated in favor of version 4.
6.5.6
Warning
Release discarded due to SVN errors.
6.5.5
Features
- Connect block attributes with custom fields via UI.
- Remove the word 'New' from default
add-new*label values.
Bug Fixes
- Bug fix: Prevent fatal if class does not exist on Beta Features.
6.5.4
6.5.4
Release Date 30 Jul 2025
Revert from 6.5.2.
6.5.2
Release Date 30 Jul 2025
Features
- Connect block attributes with custom fields via UI.
- Remove the word 'New' from default
add-new*label values.
6.5.1
6.5.0
Enhancements & Features
- Added Command Palette support.
- Added editor preview to acf-field source.
- Added an endpoint to retrieve the custom fields of a post type.
- Added nav menu as field type.
- Added compatibility with Woo HPOS for order fields and subscriptions. ( Ported from ACF )
- Create new options when editing a fields value on Selector. ( Ported from ACF )
- The “Escaped HTML” warning notice is now disabled by default. ( Ported from ACF )
- Added new
acf/fields/icon_picker/{tab_name}/iconsfilter ( Ported from ACF )
Bug Fixes
- Update initialization of the acfL10n object to ensure it's available globally.
- SCF Blocks are now forced into preview mode when editing a synced pattern. ( Ported from ACF )
- SCF no longer causes an infinite loop in bbPress when editing replies. ( Ported from ACF )
- Changing a field type no longer enables the “Allow Access to Value in Editor UI” setting. ( Ported from ACF )
- Blocks registered via acf_register_block_type() with a
parentvalue ofnullno longer fail to register. ( Ported from ACF ) - Fix AJAX repeater pagination. ( Ported from ACF )
- Paginated Repeater fields no longer save duplicate values when saving to a WooCommerce Order with HPOS disabled ( Ported from ACF )
Testing
- Added an initial batch of e2e tests.
6.4.2
- Uses a more stable function to validate an URL on field admin. (#106) by @cbravobernal
- Revert text domain change for the shortcode attr filter. (#101) by @pkevan
- Correct the release date in the changelog for 6.4.1 (#75) by @YanMetelitsa
Full Changelog: 6.4.1...6.4.2
6.4.1
What's Changed
- License and readme updates by @kraftbj in #2
- Update tested to version to 6.7 by @kraftbj in #4
- Update text domain and add WPCS for i18n by @kraftbj in #10
- Move the main plugin file by @kraftbj in #11
- Update language files by @kraftbj in #12
- Fixes old json in acf-json folder not showing in Sync available by @cyberwani in #30
New Contributors
- @cbravobernal made their first contribution in #28
- @cyberwani made their first contribution in #30
Full Changelog: 6.4.0-beta1...6.4.1
6.4.1-beta7
What's Changed
- Build Tools: Add NVM file and wp-env dev tools by @cbravobernal in #28
- Fixes old json in acf-json folder not showing in Sync available by @cyberwani in #30
- Docs: Add initial docs and tooling for import into developer.wordpress.org by @kraftbj in #35
- Add basic PHPUnit testing setup by @kraftbj in #29
- Tools: Add pre-release scripting by @kraftbj in #42
New Contributors
- @cbravobernal made their first contribution in #28
- @cyberwani made their first contribution in #30
Full Changelog: 6.4.1-beta6...6.4.1-beta7