atshift Fields (Maintenance for Custom Field Suite)
Custom Field Suite (CFS) is a lightweight WordPress plugin for adding custom fields to posts, pages, and custom post types.
This package is a maintenance build based on the upstream Custom Field Suite 2.6.7 release. It keeps the basic CFS data structure and API compatibility while adding security hardening, admin compatibility fixes, and practical field types for existing CFS sites.
For setup instructions, field value output examples, migration notes, and implementation examples, see the atshift Fields documentation site.
Things to know
- This is a maintenance build, not an official upstream release.
- Always back up your files and database before replacing an existing CFS installation.
- Deactivate the original Custom Field Suite plugin before activating this maintenance build.
- Test on a local or staging site before using it on a production site.
- CFS returns stored values; theme templates should still escape output with WordPress escaping functions.
- Added field types are not available in the original upstream CFS 2.6.7 release.
Field types
- Text
- Textarea
- WYSIWYG
- Phone
- Email Address
- Hyperlink
- URL
- Number
- Select
- Checkbox
- True / False
- Radio Button
- Date
- Time
- File Upload
- Color
- Post Categories (native WordPress categories)
- Post Tags (native WordPress tags)
- Featured Image (native WordPress featured image)
- Term
- Relationship
- User
- Loop (repeatable fields)
- Tab
- Horizontal Group
- Accordion Group (collapsible group)
Added features in this maintenance build
- Security hardening for known CFS 2.6.7 vulnerability classes.
- PHP 8.2+ and WordPress admin compatibility fixes.
- Checkbox and Radio Button fields.
- Phone, Email Address, Number, URL, and Time fields with format validation.
- Time field with hour and minute select menus.
- Native WordPress Post Categories, Post Tags, and Featured Image fields inside CFS field groups.
- Horizontal Group field for arranging multiple fields side by side, with evenly distributed and left-aligned layout options.
- Accordion Group field for organizing child fields into collapsible sections on post edit screens.
- Field Group editor buttons to add a new field directly below an existing field or inside a Loop, Horizontal Group, or Accordion Group.
- Color-coded structure badges and matching range backgrounds for Tabs, Loops, Horizontal Groups, and Accordion Groups.
- Improved drag-and-drop and Tab boundary handling in the Field Group editor.
- Inline validation messages and an error summary that opens the containing Tab, Loop, or Accordion Group and scrolls to the selected invalid field.
- Field type list ordering grouped by common editing workflows.
- Field Group parent / child synchronization to reduce cases where nested fields disappear from the post edit screen.
- Placement rule warnings for field groups that have no placement rules.
- Configurable placeholders for Text, Phone, Email Address, Hyperlink, and URL fields.
Usage
- Browse to the "Field Groups" admin menu.
- Create a Field Group containing one or more custom fields.
- Choose where the Field Group should appear, using the Placement Rules box.
- Use the CFS get method in your theme templates to display custom field values.
Example:
<?php echo esc_html( CFS()->get( 'my_text_field' ) ); ?>
For rich text fields, use an appropriate HTML sanitizer such as wp_kses_post().
Horizontal Group notes
Horizontal Group is a layout field for placing multiple child fields side by side on the post edit screen. On narrow screens, the fields stack vertically.
Horizontal Groups are intended to contain multiple normal fields. Tabs, Loops, Accordions, Conditional Groups, and other Horizontal Groups cannot be placed inside a Horizontal Group.
Accordion Group notes
Accordion Group is a layout field for placing child fields inside a collapsible section on the post edit screen. It can be configured to open by default.
Tabs cannot be placed inside an Accordion Group.
WordPress native field notes
Post Categories, Post Tags, and Featured Image edit the native WordPress objects directly. They are not CFS-only post meta fields.
For Post Categories, child category selection can also select parent categories, and removing a parent selection removes its child selections. If all categories are removed, WordPress' default category is restored.
Security maintenance notes
This package includes local security and compatibility hardening on top of the upstream 2.6.7 codebase.
The maintenance work addresses known vulnerability classes around Loop field code execution, Term field SQL injection, CFS form title / content stored XSS, and existing post updates through CFS forms without normal edit capability checks.
The changes were verified locally against the built-in CFS field types, added field types, and an upgrade path from the original 2.6.7 codebase. These checks are local verification only and are not a third-party security audit.
Redistribution and license
This maintenance build is distributed under the GNU General Public License version 2 (GPLv2), the same license as the upstream plugin. You may use, copy, modify, and redistribute this package, including modified versions, under GPLv2.
When redistributing this package, keep the GPLv2 license notice, preserve the original author attribution, include the source code, and make clear that this is a maintenance build inherited by @shift Yoshiya Tsuchisaka.