WP Manifestindependent plugin directory
manifest / forms / gf-external-choices

Gravity Forms External Choices WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Populate Gravity Forms Multiple Choice fields from external CSV, JSON, or XLSX data sources.

★ 0stars
11release downloads
v1.0.2latest · 6mo ago

Install

Download gf-external-choices.zip From the v1.0.2 release on GitHub, Mar 31, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/guilamu/gf-external-choices/releases/download/v1.0.2/gf-external-choices.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Populate Gravity Forms Multiple Choice fields from external CSV, JSON, or XLSX data sources.

Manage External Data

  • Populate choices from CSV files with auto-detection of delimiters and encoding
  • Populate choices from JSON files (flat object arrays)
  • Populate choices from XLSX (Excel) files using native PHP parsing
  • Load data from external URLs or WordPress Media Library

Caching & Performance

  • Automatic caching with configurable refresh frequency (Hourly, Daily, Weekly)
  • Manual cache refresh option
  • Fallback to cached data if external source is unavailable

Live Preview & Validation

  • Live preview of choices within the Gravity Forms editor
  • Status indicators for data health and connectivity
  • Full validation to ensure data compatibility with Gravity Forms

Key Features

  • CSV Support: Auto-detects delimiters (comma, semicolon, tab) and encoding (UTF-8, ISO-8859-1)
  • JSON Support: Supports flat object arrays with custom property mapping
  • XLSX Support: Native PHP parsing using ZipArchive (no external libraries required)
  • Multilingual: Works with content in any language
  • Translation-Ready: All strings are internationalized
  • Secure: Strict validation ensures only safe data is rendered
  • GitHub Updates: Automatic updates from GitHub releases

Requirements

  • Gravity Forms (latest version recommended)
  • WordPress 5.0 or higher
  • PHP 7.4 or higher

Installation

  1. Upload the gf-external-choices folder to /wp-content/plugins/
  2. Activate the plugin through the Plugins menu in WordPress
  3. Go to any Form, add a Multiple Choice field (Dropdown, Radio, or Checkbox)
  4. In the field settings, look for External Choices to configure your source

FAQ

What file formats are supported?

CSV, JSON, and XLSX (Excel) files are supported. The format is auto-detected based on file extension. Note: XLS (older Excel format) is not supported.

What are the limits?

Files can be up to 10MB with a maximum of 1000 choices.

Can I use nested JSON?

No, this version only supports flat object arrays. Nested objects are not supported.

Why don't my choices show immediately after configuration?

The Gravity Forms editor loads choices from saved data. After configuring external choices, save the form and reload the page to see the updated choices in the editor.

Project Structure

.
├── gf-external-choices.php       # Main plugin file
├── class-gf-external-choices.php # Main add-on class
├── readme.txt                    # WordPress.org readme
├── includes
│   ├── class-cache-manager.php   # Caching logic
│   ├── class-choice-validator.php # Data validation
│   ├── class-csv-parser.php      # CSV parsing
│   ├── class-data-fetcher.php    # Remote data fetching
│   ├── class-field-settings.php  # Admin UI settings
│   ├── class-github-updater.php  # GitHub auto-updates
│   ├── class-json-parser.php     # JSON parsing
│   └── class-xlsx-parser.php     # XLSX parsing
└── assets
    ├── css
    │   └── admin.css             # Admin styles
    └── js
        └── field-settings.js     # Admin scripts

Changelog

1.0.2

  • Improved: Rewritten GitHub updater with README.md parsing, Parsedown integration, and "View details" modal support
  • New: Added "View details" thickbox link in plugin row meta
  • New: Added Gravity Forms version requirement in plugin details sidebar

1.0.1

  • New: Added Guilamu Bug Reporter integration for easy bug reporting

1.0.0

  • New: Initial release
  • New: CSV support with auto-detection of delimiters and encoding
  • New: JSON support for flat object arrays
  • New: XLSX support using native PHP parsing
  • New: URL and Media Library data sources
  • New: Automatic caching with configurable refresh frequency

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) - see the LICENSE file for details.


Made with love for the WordPress community

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.2 latest
Mar 31, 2026 6mo ago
gf-external-choices.zip
5
Jan 14, 2026 9mo ago
gf-external-choices.zip
5
Jan 14, 2026 9mo ago
gf-external-choices.zip
1
C- grade

Security

Gravity Forms External Choices 1.0.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.2
Findings
1
Worst severity
high
Content hash
0dfd8301470eb13af8a988ed…

Findings

  • high SSRF via Gravity Forms external choices AJAX refresh

    ssrf

    ajax_force_refresh and ajax_get_columns require only edit_posts and a nonce, then pass attacker-controlled source_url into Data_Fetcher::fetch → fetch_from_url → wp_remote_get with no allowlist or block of private/link-local hosts. A Contributor/Author who can reach the form editor nonce can force the site to request internal URLs (cloud metadata, localhost services) and observe outcomes via error/success responses.

    class-gf-external-choices.php:476-494

    Recommendation

    Restrict to manage_options or gform_full_access; validate URLs against an allowlist / block private IP ranges before wp_remote_get.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.