15 versions
Meta Box AIO history.
Every release of Meta Box AIO is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
14 of 15 releases scanned clean
v3.13.1Latest
October 20, 20266.8 MBScanned
Other
- Improve views list category filters with status counts
- List active views for the current page in the admin bar
- Cache-bust async webpack chunks to prevent stale builder crashes
- Sanitize block editor field content on save
- Public posts and terms stay readable. Password-protected posts need `read_post` until the visitor enters the password
- User meta needs `edit_user`
- Use `rwmb_meta_shortcode_permission` to override the check when needed
- Only allow predefined keys to be used for block bindings (#1707)
- Declare the text fields of blocks to WPML
Fixed
- custom table lookup when the DB prefix has uppercase letters
- unauthenticated migration reset and export disclosure
- Local JSON ID collisions across object types
- stored XSS in background field via unexpected array keys
- a permission bypass in the `[rwmb_meta]` shortcode. The shortcode now checks whether the current user can read the object before it prints a value. Credit Mohammed Dsleman.
- image metas have special characters in Elementor widget
October 12, 20267.0 MBScanned
Other
- *Highlights:**
- This release adds a **Custom Model** field type and a **Model** object type for relationships, so you can select and relate custom table rows in the builder (requires MB Custom Table). See our [blog post](https://metabox.io/custom-model-field/) for an overview or [documentation](https://docs.metabox.io/fields/model/) for details.
- Local JSON now supports settings pages and relationships.
- *Other changes:**
- Suggest SQL column types from field settings in the schema modal
Fixed
- column name detection treating SQL types as column names
- bug with Elementor carousel widget and image advanced
- group skin in Elementor doesn't work when activating WPML
September 17, 20267.0 MBScanned
Other
- *Highlights:**
- This release lets you create **custom models** in the builder, instead of registering them in PHP with the MB Custom Table extension. Local JSON supports models as well.
- See our [blog post](https://metabox.io/create-custom-model-with-builder/) for an overview.
- *Other changes:**
- Include the WordPress table prefix by default for new custom tables
- Transliterate accented characters in table names instead of dropping them
- Report custom table create and update failures when saving, instead of reporting success
- Report Local JSON sync failures when saving, and reject an ID that another JSON file already owns
- Rebuild editor settings when importing settings pages and blocks, so icons and menu settings survive the round trip
Added
- a column schema editor for field group custom tables, with column types, indexes, and automatic columns for new fields
- authorization check in frontend's `Form::process()` to prevent unauthorized post edits
Removed
- stale Local JSON files after renaming a field group
Improved
- the existing object when importing a JSON file with the same ID, instead of creating a duplicate
Fixed
- multibyte IDs breaking meta box tooltips in WordPress 7.1
- admin column position suggestions missing the field ID prefix
- select advanced field preview not showing and not clearing
- error when trashing a post
- focus handling for hidden validation error elements
- image advanced in a cloneable group not displayed correctly in Elementor
- error with Slim SEO on All Pages screen when adding a view shortcode in a page
September 3, 20266.7 MBScanned
Other
- *Highlights:**
- This version adds support for WooCommerce HPOS that allows you to use Meta Box fields to WooCommerce orders (with WooCommerce's High-Performance Order Storage (HPOS) feature). For more information, see our [blog post](https://metabox.io/hpos-support/).
- Also, frontend forms and user forms now support for Cloudflare Turnstile for captcha verification.
- *Other changes:**
- Tighten security for Abilities: users now need the `edit_post` capability (or equivalent) to read custom field values, so sensitive data is only accessible to users who can edit content
Added
- info columns to post type and taxonomy list tables
Fixed
- security bug with migration from CPT UI
- icon picker not showing for existing post types
July 30, 20266.7 MBScanned
Other
- *Highlights:**
- This release introduces **Block Bindings** for Meta Box fields, allowing you to bind field values directly to blocks in the WordPress editor. Meta Box fields now appear as a source in the block bindings panel, making it easy to use custom field data inside blocks without shortcodes or PHP. See our [blog post](https://metabox.io/introducing-block-bindings/) for details.
- *Other changes:**
Fixed
- password strength showing for login/forgot password forms
- `querySelector` errors with numeric IDs and missing DOM elements
- conflict style of the ajax message with WPEngine on Extensions page
Improved
- select2 library to fix missing placeholder
- description text for `max_clone` in relationship Fields tab for clarity
- Twig to v3.11.3
July 17, 20266.7 MBScanned
Other
- *Highlight:**
- Introducing `has_one_relationship` option — configure it per side (`from`/`to`) to limit an item to a connect to only one item on the other side. Combined on both sides it creates a one-to-one relationship; on one side only, it creates one-to-many without duplicates.
- Read more on [our blog](https://metabox.io/has-one-relationship) or [documentation](https://docs.metabox.io/extensions/mb-relationships/)
- *Other changes:**
- Allow HTML in switch on/off and button group labels (e.g., Dashicons)
- Disable autoload for form config options to reduce alloptions bloat.
Fixed
- missing authorization check in `ajax_delete_file` for enhanced security
- fatal error when post content (of mb-custom-post-type) contains invalid JSON
- not displaying term meta in the Elementor taxonomy loop
- deprecated notice in GroupField in Elementor
- missing authorization on frontend post delete.
v3.8.0Unavailable
July 7, 20266.7 MBScanned
Other
- *Highlights:**
- This release introduces **Abilities**, enabling you to manage custom post types and taxonomies, as well as create, retrieve, update, and delete posts and terms.
- See our [blog post](https://metabox.io/introducing-abilities/) for an overview or the [documentation](https://docs.metabox.io/abilities/) for usage details.
- *Other changes:**
- Use `WP_Query`'s `search_columns` instead of custom `search_by_title` filter
Fixed
- stale block lists when switching between block editor fields (#195)
- conflict with `tax_query` in `each_connected` for relationships
- unable to scroll in full screen mode for the `block_editor` field (#1689)
- autocomplete dropdown z-index in map/osm field inside MB Blocks
- image fields not displaying in Divi blurb and image fields
v3.7.2Unavailable
June 16, 20266.7 MBScanned
Improved
- style to match WordPress 7
- translations
Other
- Improve admin menu width detection
- Improve check for creating relationships table
- Make conditional logic work for Meta Box blocks added in block_editor field
- Improve conditional logic check for blocks in normal mode
Added
- support for Divi 5
- conditional logic support for media modal
Fixed
- missing Pods Migration extension
- error when taxonomies contain null or empty values for term meta boxes
- showing block json path in admin columns when it's not enabled
- prefix in field ids when importing
- error when creating block with block.json and render_callback
- missing tabs, sub-groups, default_state when importing
v3.7.1Unavailable
May 13, 20266.6 MBScanned
Other
- Show Cmd+S/Ctrl+S shortcut in the Save button in the builder
Removed
- cache for block rendering
Fixed
- conditional logic not working if switching between Post and Block panels and the dependent field is on the sidebar (#19)
- conditional logic detecting featured image in classic editor and block editor not working
- JS error if block icon is null
- nested same-type blocks all rendering first block's data
- InnerBlocks allowedBlocks/template not working
- mb.get_posts() in views not respecting relationship order
- text limiter not working with WYSIWYG fields on settings pages
- error in FieldKeys::all()
- reorder posts not clearing object cache
v3.7.0Unavailable
April 22, 20266.6 MBScanned
Added
- field type `link` that allows you to add a link with native WordPress experience (similar to ACF)
- allowed blocks callback that must return a list of blocks for the `block_editor` field
- missing `class`, `before`, `after` controls for the `custom_html` field
- time format support for the `datetime` field
Other
- Auto add child blocks for allowed blocks for the `block_editor` field
- Improve the UX of allowed block lists for the `block_editor` field
Removed
- all tabs settings when there are no fields
Improved
- the React app to React 18
Fixed
- detecting title and name changes
- missing `sprintf` import for date time field preview
- custom settings not available in the builder after import
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Meta Box AIO to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.