Hardened output escaping of extension-provided custom-field markup and wrapper attributes (wp_kses() / esc_attr()), removing all phpcs:ignore escape suppressions.
The Gutenberg block now renders through the escaped TDCF_Form::output() path instead of echoing shortcode output.
SMTP password is stored without sanitize_text_field() so special characters are preserved.
2.0.5
Fixed a fatal error on the Contact Form admin screen caused by an undefined constant when loading script translations.
Replaced PHP short echo tags for WordPress.org coding standards compliance.
2.0.4
Custom fields are no longer capped at 5 — the form supports the full set (up to 50) for everyone.
2.0.3
WordPress.org coding-standards hardening: translators comments for all i18n placeholders (Plugin Check compliance).
2.0.2
Hardened admin output escaping: settings and dashboard output now run through wp_kses()/esc_attr()/(int) casts, and TDCF_Form gains an output() method for direct escaped rendering (WordPress.org coding-standards compliance).
2.0.1
Added the required “External services” section to readme.txt documenting Google reCAPTCHA, Cloudflare Turnstile, webhook destinations and mailing-list providers (WordPress.org guideline 6 compliance).
Removed the load_plugin_textdomain() call; translations are auto-loaded by WordPress.org since WP 4.6.
