Gravity Forms XML Submissions

A WordPress plugin that creates configurable XML attachments from Gravity Forms submissions and attaches them to the form's email notifications.

Features

• Per-form configuration on a dedicated settings screen (under Forms → Settings → XML Submissions)
• Choose exactly which notifications receive the XML attachment
• Map XML elements to values from six sources:
  • Form field — any field or sub-field ID on the form
  • Fixed text — a constant string
  • Entry ID — the Gravity Forms entry ID
  • Generated reference — a text prefix + entry ID (e.g. APP-1042)
  • Form title — the form's title
  • Submission date and time — entry creation time in DATE_ATOM format
• Custom XML root element name per form (defaults to submission)
• Up to 100 mappings per form

Security

• Generated XML files are written to a protected uploads/gfxs-attachments/ directory:
  • .htaccess denies all web access (Apache); index.html prevents listing on other servers
  • Files are created with 0600 permissions and unpredictable names
• Files are deleted at the end of the request that generated them
• An hourly WP-Cron sweep removes any files left behind by a crashed request
• Settings are stored without autoloading, so they don't load on every frontend request
• All settings input is whitelisted and validated against the forms, notifications, and fields that actually exist
• Configurations for forms missing from a settings save (truncated POST, race with form creation) are preserved rather than wiped
• Uninstalling removes all plugin data: settings, cron event, and generated files

Requirements

• WordPress 6.5+
• PHP 7.4+ with the DOM extension
• Gravity Forms

Installation

1. Copy the plugin folder to wp-content/plugins/gravity-forms-xml-submissions/
2. Activate the plugin in WordPress admin
3. Go to Forms → Settings → XML Submissions

Usage

1. Tick Enable XML attachments for this form
2. Set the XML root element name (letters, digits, _, -, .; must start with a letter or underscore)
3. Tick the notifications that should carry the attachment
4. Click Add mapping and configure each row:
   • XML element — the element name to create
   • Value source — where the value comes from
   • The third column adapts: a field picker for Form field, a text input for Fixed text / Generated reference, nothing for the rest
5. Save Changes

Changelog

1.1.0

• Security: attachments now written to a protected, non-web-accessible uploads sub-directory with 0600 permissions and unpredictable filenames (was: predictable names in the shared temp directory)
• Security: hourly cron sweep removes orphaned attachment files left by crashed requests
• Fixed: saving settings no longer wipes configurations of inactive, trashed, or absent forms
• Fixed: settings saves cut off by PHP's max_input_vars limit (large installs with many forms/mappings) are detected via a per-form rendered-row integrity counter — affected forms keep their stored configuration instead of losing mappings, and an admin warning explains what happened
• Fixed: enabled-but-incomplete form configurations are no longer saved (previously attached empty XML skeletons)
• Fixed: control characters illegal in XML 1.0 are stripped from values, preventing malformed XML from pasted content
• Performance: XML is generated once per entry per request and reused across multiple matching notifications
• Performance: settings option no longer autoloaded on every request
• Added: size guard — XML above 8 MB is not attached (most mail servers reject it anyway); failure is logged via Gravity Forms logging
• Added: log entry when a mapped field is missing from an entry (e.g. deleted form field)
• Added: uninstall.php removes all plugin data on deletion
• Accessibility: all mapping controls labelled; individually-labelled Remove buttons; real tooltip button with aria-describedby, focus support, Escape dismissal; focus preserved after row removal; live-region announcements; horizontally scrollable mapping table; 24 px help target
• Fixed: double-submit guard no longer leaves the form permanently disabled after using the browser back button

1.0.0

• Initial release