WP Manifestindependent plugin directory
manifest / forms / gravityforms-repeater-field

Gravity Forms Repeater Field Add-on WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

A robust repeater field add-on for Gravity Forms that allows grouping and repeating form sections.

★ 0stars
15release downloads
≈10active sites
v1.0.3latest · 7mo ago

Install

Download gravityforms-repeater-field-1.0.3.zip From the v1.0.3 release on GitHub, Mar 3, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/solepixel/gravityforms-repeater-field/releases/download/v1.0.3/gravityforms-repeater-field-1.0.3.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A robust repeater field add-on for Gravity Forms that allows grouping and repeating form sections.

Features

  • Group Field: Create logical groupings of form fields with built-in repeater functionality
  • Repeater Functionality: Allow users to add/remove multiple instances of groups
  • Fieldset Management: Automatic opening/closing of HTML fieldsets
  • Slider Animation: Smooth transitions between repeater instances
  • Conditional Logic: Full support for conditional logic on repeated fields
  • Admin Display: View submission data grouped by repeater instances
  • Responsive Design: Mobile-friendly controls and layout

Installation

  1. Upload the plugin files to /wp-content/plugins/gravityforms-repeater-field/
  2. Activate the plugin through the 'Plugins' screen in WordPress
  3. Ensure Gravity Forms is installed and activated

Usage

Creating a Repeater Group

  1. In the Gravity Forms form editor, go to the "Advanced Fields" section
  2. Add a "Group" field from the Advanced Fields
  3. The Group field is automatically repeatable - no additional settings needed
  4. Add your form fields after the group field
  5. The group will automatically wrap fields in a fieldset

Repeater Controls

When a Group field is added, users will see:

  • Add (+): Create a new instance of the group
  • Remove (-): Delete the current instance (if more than one exists)
  • Previous (←): Navigate to the previous instance
  • Next (→): Navigate to the next instance

Field Management

  • All fields within a repeater group are automatically duplicated
  • Field names are updated to use array notation (field_name[])
  • Field IDs are updated to include instance index for uniqueness
  • Conditional logic is preserved across all instances

Development

File Structure

gravityforms-repeater-field/
├── src/
│   ├── Classes/
│   │   ├── Core.php
│   │   ├── SectionField.php
│   │   ├── Assets.php
│   │   └── AdminDisplay.php
│   ├── Assets/
│   │   ├── css/
│   │   │   ├── frontend.css
│   │   │   ├── form.css
│   │   │   └── admin.css
│   │   └── js/
│   │       ├── frontend.js
│   │       ├── form.js
│   │       └── admin.js
│   └── Views/
│       └── repeater-setting.php
├── composer.json
└── gravityforms-repeater-field.php

Hooks and Filters

Actions

  • gf_repeater_field_init - Fired when the plugin initializes
  • gf_repeater_field_before_render - Before rendering a repeater field
  • gf_repeater_field_after_render - After rendering a repeater field

Filters

  • gf_repeater_field_settings - Modify repeater field settings
  • gf_repeater_field_display_value - Customize how repeater data is displayed
  • gf_repeater_field_validation - Add custom validation for repeater fields

Requirements

  • WordPress 5.0 or higher
  • Gravity Forms 2.5 or higher
  • PHP 7.4 or higher

Changelog

1.0.3

  • Another file upload field fix.
  • File attachment fix.

1.0.2

  • Enhancements to admin rendering and email display.
  • Fix issue with file upload fields.

1.0.1

  • Added Merge Tag Formatting

1.0.0

  • Initial release
  • Section field with repeater functionality
  • Fieldset management
  • Slider animations
  • Admin display integration
  • Conditional logic support

Support

For support and feature requests, please contact Briantics, Inc. at https://b7s.co

License

GPL v2 or later - https://www.gnu.org/licenses/gpl-2.0.html

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.3 latest
Mar 3, 2026 7mo ago
gravityforms-repeater-field-1.0.3.zip
3
Feb 26, 2026 7mo ago
gravityforms-repeater-field-1.0.2.zip
10
Feb 26, 2026 7mo ago
gravityforms-repeater-field-1.0.1.zip
2

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Gravity Forms Repeater Field Add-on 1.0.3 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.3
Findings
1
Worst severity
high
Content hash
6ec0a999a01b68eaa947e506…

Findings

  • high Unauthenticated stored XSS in admin entry detail and {all_fields} HTML via unescaped repeater JSON values

    xss_stored

    Repeater instances are packed by frontend JS into a hidden input named input_{repeater_start_id} and saved as a JSON string on the Gravity Forms entry. RepeaterStartField::sanitize_entry_value returns that string unchanged, so an unauthenticated submitter fully controls the blob (they can also POST it directly, bypassing the packer). Display goes through gf_repeater_field_get_formatted_instance_rows → gf_repeater_field_format_field_value_for_display. For every non-fileupload type the formatter returns implode(strval($value)) with no esc_html; radio/checkbox even escape the 'Other' box but not regular choice values. AdminDisplay::modify_field_content (gform_field_content, entry-detail only) then sprintf's $row['value'] into a <td> in wp-admin. That is a full HTML document context, so a payload such as <script>alert(document.domain)</script> in a Single Line Text / Paragraph / Name / Email / etc. field inside the repeater executes when an administrator opens admin.php?page=gf_entries&view=entry — the normal post-submit workflow. The same unescaped $display is interpolated into the HTML table built by gf_repeater_field_format_merge_tag_value, which MergeTagFormatting installs on gform_merge_tag_filter for all_fields and all_fields_display_empty (default admin notification body). Gravity Forms' own GF_Field::get_value_entry_detail would have called esc_html when allowable_tags is false; this add-on replaces that path. Labels are escaped, values are not.

    src/helpers.php:128-149

    Recommendation

    Escape every non-HTML field value with esc_html() (and esc_attr() for URL contexts) inside gf_repeater_field_format_field_value_for_display before returning. For fileupload, keep using GF_Field_FileUpload::get_value_entry_detail (it already esc_attr/esc_html the href and basename). Do not treat the Repeater Start JSON as trusted HTML. Optionally JSON-decode on save and sanitize each leaf with sanitize_text_field, but output-escaping is the required fix because GF's own default for allow_html()===false is escape-on-output.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.