Loops & Logic is back on the WordPress.org plugin directory. The listing was restored last week, and version 4.3.2 is the current release there, so updates through your dashboard work the way they did before.
If you read our post from September 15 about why the plugin disappeared, this is the follow-up we promised. If you didn’t, the short version is below.
First, the practical bit
If you’re on 4.3.2 already, there’s nothing to do.
If you downloaded 4.3.1 from GitHub while the listing was down and installed it by hand, you don’t need to do anything special either. The GitHub package uses the same plugin folder as the WordPress.org version, so your dashboard will offer you 4.3.2 as a normal update. Take it when you see it.
If you’re still on anything below 4.3.0, update now. Those versions have the security issue we wrote about, and the fix has been available since September 3.
What happened, briefly
A researcher reported a security vulnerability affecting versions before 4.3.0. We fixed it in 4.3.0 and followed up with a cleanup release, 4.3.1, to satisfy the WordPress.org review. While that review was in progress, the plugin’s listing was taken down, which is standard practice for reports like this. It was never a sign that the plugin was going away, but we know it looked alarming if you went to update and found nothing there.
Version 4.3.2 then closed a second, smaller issue that came up during the same period: a cross-site scripting bug in an ajax error response from the Fields module. Both fixes have CVE numbers, which you’ll find in the changelog at the bottom of this post.
Thank you for your patience while we worked through it with the WordPress.org team, and thank you to the researchers who reported the issues responsibly.
The big picture
The 4.3 line was never meant to be only a security release. There’s a fair amount in here that we’d been working on for a while, and it got somewhat buried under the review. Here’s what we think matters most.
Fewer database requests in post and user loops
Before 4.3.0, a post loop could end up making extra database requests for every item it rendered, one for the post and one for its meta, because the loop’s query optimisation skipped WordPress’s normal cache priming. On a loop of a few hundred posts that added up. Post loops and user loops now prime the post, meta and term caches in bulk before rendering, so the number of queries stays flat no matter how many items the loop returns. Attachment loops get the same fix, since they build on the post loop.
You don’t need to change anything in your templates to benefit from this. If you have a large report-style loop that has always felt slow, this release is worth re-testing on.
Compile templates to PHP (beta)
There’s a new optional setting under Loops & Logic settings called “Compile templates to PHP”. When it’s on, a saved template is compiled once into a PHP file, and later renders include that file instead of parsing the template markup again. The compiled files live in wp-content/tangible-template-cache, and the settings page shows the cache path, its status, and a button to clear it.
This is off by default and marked beta for good reason. It depends on PHP’s opcache being enabled on your server. Without opcache, including the compiled file costs more than parsing the template, so the plugin checks for opcache and falls back to the normal rendering path if it isn’t there. If you’re on a host where opcache is on (most managed hosts), try it on a staging site first and let us know how it goes.
Pagination scroll attributes fixed
The scroll_top and scroll_animate attributes on the PaginateButtons tag weren’t behaving. They’re fixed in 4.3.0. If you’d worked around this with your own scroll script, you can probably take it out now.
ACF group loops and choice-field subfields
Two ACF fixes that came from support threads. The Group loop now handles group field values that ACF returns as arrays, and the Field tag correctly resolves field=label and the other subfields of choice fields like select, radio and checkbox. If either of those had been giving you empty output, this is the release that sorts it.
Fewer fatal errors from bad input
The Format tag used to throw a fatal error if you passed a non-numeric value for length or offset. It now ignores the value instead. Along the same lines, 4.3.2 fixes a fatal in the Math tag when a function was called with the wrong number of arguments. Neither is glamorous, but a template that renders with a wrong value is easier to debug than a white screen.
Full changelog from version 4.3.0
You can update in one of two ways. If you installed the plugin through WordPress, head to Dashboard > Updates (or the Plugins page) and click Update Now when the new version appears. If you installed it from GitHub, download the latest release from the repository’s Releases page and replace your existing plugin folder, or pull the latest changes if you’re tracking the repo directly. Either way, back up your site before updating, just in case.
4.3.2
Release Date: 2026-09-17
- Math tag: Fix fatal error on wrong number of function arguments
- Security: Fields – Fix XSS in ajax error response (CVE-2026-82123)
4.3.1
Release Date: 2026-09-11
- Admin: Welcome notice – Add nonce verification when dismissing
- WordPress:
- Update Tested up to version to 7.1
- Make sure plugin meets required standards
4.3.0
Release Date: 2026-09-03
- ACF Group loop: Support group field values returned as arrays
- Field tag: Fix field=label and other ACF choice-field subfields
- Format tag: Ignore non-numeric length/offset values instead of a fatal error
- Loops: Improve post and user query performance by reducing database requests
- PaginateButtons tag: Fix scroll_top and scroll_animate attributes
- Performance: New optional feature to compile L&L templates to PHP for faster rendering (requires opcache)
- Security:
- Table: Validate requests with a signed hash (CVE-2026-16960 – Thanks Philipp Doblhofer for the report!)
- Sortable post types: Restrict ajax action to admin users
- Development:
- Tests: E2E – Cover AJAX permissions with tests
- Tests: Run existing tests on PHP 8.4 as well
- Workflows: Extend tests support
As always, if something in this release doesn’t behave the way you expect, the community forum is the place to tell us. We read every thread.