Meta Box – A Framework for Dynamic Websites

Changelog

5.15.3 – 2026-10-20

• Fix stored XSS in background field via unexpected array keys
• Sanitize block editor field content on save
• Fix a permission bypass in the [rwmb_meta] shortcode. The shortcode now checks whether the current user can read the object before it prints a value. Credit Mohammed Dsleman.
  • Public posts and terms stay readable. Password-protected posts need read_post until the visitor enters the password
  • User meta needs edit_user
  • Use rwmb_meta_shortcode_permission to override the check when needed
• Only allow predefined keys to be used for block bindings (#1707)
• Declare the text fields of blocks to WPML

5.15.3

• Fix a permission bypass in the [rwmb_meta] shortcode. The shortcode now checks whether the current user can read the object before it prints a value.
  • Public posts and terms stay readable. Password-protected posts need read_post until the visitor enters the password
  • Settings pages, network settings pages, and models use their own capability
  • User meta needs edit_user
  • Use rwmb_meta_shortcode_permission to override the check when needed

5.15.2 – 2026-10-07

• Show feature image for post field (if post type supports), and avatar for user field

5.15.1 – 2026-09-17

• Fix multibyte IDs breaking WordPress 7.1 meta box tooltips
• Fix focus handling for hidden validation error elements

5.15.0 – 2026-09-03

Highlights:

This version adds support for WooCommerce HPOS that allows you to use Meta Box fields to WooCommerce orders (with WooCommerce’s High-Performance Order Storage (HPOS) feature). For more information, see our blog post.

5.14.1 – 2026-08-16

• Tighten security for Abilities: users now need the edit_post capability (or equivalent) to read custom field values, so sensitive data is only accessible to users who can edit content
• Improve the readme with a link to the source code on GitHub, plus documentation for the Google Maps and OpenStreetMap fields, including terms of use and privacy policy links
• Fix minor issues found in the WordPress.org plugin review (PHP syntax in the dashboard, plugin package contents)

5.14.0 – 2026-07-30

Highlights:

This release introduces Block Bindings for Meta Box fields, allowing you to bind field values directly to blocks in the WordPress editor. Meta Box fields now appear as a source in the block bindings panel, making it easy to use custom field data inside blocks without shortcodes or PHP.

See our blog post for an overview or the documentation for usage details.

Other changes:

• Update select2 library to fix missing placeholder

5.13.1 – 2026-07-14

• Fix missing authorization check in ajax_delete_file for enhanced security
• Allow HTML in switch on/off and button group labels (e.g., Dashicons)

5.13.0 – 2026-07-06

Highlights:

This release introduces Abilities, enabling you to manage custom post types and taxonomies, as well as create, retrieve, update, and delete posts and terms.

See our blog post for an overview or the documentation for usage details.

Other changes:

• Fix unable to scroll in full screen mode for the block_editor field (#1689)
• Use WP_Query‘s search_columns instead of custom search_by_title filter
• Fix autocomplete dropdown z-index in map/osm field inside MB Blocks

5.12.1 – 2026-06-10

• Update style to match WordPress 7
• Fix wp_style_add_data issue for OSM field
• Fix: prevent invalid JSON in media field data attributes
• Fix: escape $object->label with esc_html() in input-list walker

5.12.0 – 2026-04-22

• New field type link that allows you to add a link with native WordPress experience (similar to ACF)
• Auto add child blocks for allowed blocks for the block_editor field

5.11.4 – 2026-03-30

• Add an internal hook for enqueuing custom blocks’ assets for block_editor field

5.11.3 – 2026-03-24

• Add toolbar_position option for the block editor field, which accepts value top (default) or contextual. This option is for where to display editing toolbar for blocks.
• Fix saving an empty paragraph in the block editor field
• Fix validation error persisting after removing duplicate blocks
• Fix extra empty clone saved when calling set_post_data() during validation

5.11.2 – 2026-03-05

Improvements for the block editor field:

• Add breadcrumbs
• Fix compatibility with Block Visibility plugin
• Fix not loading 3rd-party blocks
• Improve the CSS

Other changes:

• Fix save time format for the datetime field
• Fix icon field dropdown broken display when SVG contains double quotes
• Fix path traversal in ajax_delete_file for security
• Fix timestamp should not be set for the time picker field

5.11.1 – 2026-02-02

Improvements for the block editor field:

• Add block inspector sidebar
• Add structure panel to show the list view of blocks
• Add fullscreen mode
• Add height settings (default is 300px) and allow resizing the editor

Fixes for the block editor field:

• Fix cannot upload images for the image block
• Fix blank site editor when using the block editor field
• Fix custom rich text formats not working
• Fix conflicts with image_advanced and file_advanced fields

Other changes:

• Fix cannot create new terms with required date/time fields

5.11.0 – 2026-01-15

• Add new field type: block_editor. See more details on our blog post and documentation.

5.10.19 – 2025-11-24

• Fix the use statement with non-compound name has no effect

5.10.18 – 2025-11-24

• Fix deprecation message for datetime field

5.10.17 – 2025-11-07

• WPML integration: fix error when filtering value for helper functions when no fields are found.

5.10.16 – 2025-11-05

• WPML integration: filter helper functions to get the translated IDs for post field
• Fix cloning post field not clearing the value

5.10.15 – 2025-10-06

• Add marker_draggable option for map/osm fields to disable changing the pin on the map.

5.10.14 – 2025-09-15

• Update dependencies

5.10.13 – 2025-08-14

• Fix get_current_screen() error for term meta

5.10.12 – 2025-08-13

• Fix Open Street Maps field not showing (sometimes) with conditional logic
• Enqueue assets for the iframed editor, to make all fields are rendered properly in the iframed editor

5.10.11 – 2025-07-15

Fix validation for blocks

5.10.10 – 2025-05-21

• Fix datetime field returns null
• Fix single image field not working with Polylang Pro
• Fix reveal password icon not working

5.10.9 – 2025-05-08

• Add button to toggle password (#1630)
• Add gesture handling support for OSM field (#1631)
• Datetime & select2: use user’s locale instead of site’s locale

5.10.8 – 2025-03-14

• Redesign the dashboard

5.10.7 – 2025-02-25

• Fix: max clone with clone empty start

5.10.6 – 2025-01-11

• Fix validation for dash ids
• Fix datetime fields not showing inline picker inside groups
• Fix label_description not working for fieldset_text
• Fix field label div still show when no field name but with label_description
• Remove image_select field’s JS, styling with CSS only
• Add gap for key value inputs

5.10.5 – 2024-12-16

• Make validation for add new terms work
• Improve styling of meta boxes on the sidebar in the block editor
• Improve style of input with prepend and append
• Fix maps/osm fields and geolocation not working with subfields in groups
• Fix select advanced becomes normal select with cloneable setting
• Fix validation

5.10.4 – 2024-11-20

• OSM/Map fields: add support for select field type
• Add $url to rwmb_oembed_not_available_string filter
• Small CSS improvements for file input, background & button group
• Fix not returning value for helper functions for images saving in a custom folder and using a custom table

5.10.3 – 2024-10-30

• fix: std after saving
• fix: field set text save empty values
• fix: subfield’s id

5.10.2 – 2024-09-26

• Fix issue with conditional logic
• Fix error when removing default taxonomy meta box in the front end or with the block editor
• Fix missing .hidden on the front end for checkbox_tree
• Fix required attribute for select_tree

5.10.1 – 2024-09-07

• Fix issue with clone_empty_start (validation, now showing data for the 1st clone, broken text_list field, etc.)

See full changelog here.