Loops & Logic is back on the WordPress.org plugin directory. The listing was restored last week, and version 4.3.2 is the current release there, so updates through your dashboard work the way they did before.
If you read our post from September 15 about why the plugin disappeared, this is the follow-up we promised. If you didn’t, the details are below.
First, the practical bit
If you’re on 4.3.2 already, there’s nothing to do.
If you downloaded 4.3.1 from GitHub while the listing was down and installed it by hand, you don’t need to do anything special either. The GitHub package uses the same plugin folder as the WordPress.org version, so your dashboard will offer you 4.3.2 as a normal update. Take it when you see it.
If you’re still on anything below 4.3.0, update now. Those versions have the security issue we wrote about, and the fix has been available since September 3.
What happened
Two security issues were reported to us over the summer, by two independent researchers. Both are resolved in 4.3.2, and neither affects you once you’re on that version.
Information disclosure in the Table tag (CVE-2026-16960)
Affects versions before 4.3.0. Fixed in 4.3.0, released September 3.
The Table tag loads its rows in the background when you page, sort or filter. In older versions, the plugin didn’t check that background request closely enough against the table an author had actually placed on the page. A visitor could take advantage of that to read information they weren’t meant to see, such as user email addresses or site settings. They could not change anything.
Version 4.3.0 signs each table’s configuration with a key that only your site holds, and refuses any request that doesn’t carry a matching signature. The plugin’s main template rendering already worked this way; the Table tag now does too.
Cross-site scripting in an error message (CVE-2026-82123)
Affects versions before 4.3.2. Fixed in 4.3.2, released September 17.
This one was in the Fields library that Loops & Logic bundles. If a request asked for a field name that didn’t exist, the error message repeated that name back without cleaning it first, which meant a specially crafted link could run a script in the browser of whoever opened it while logged in. Nothing happens unless someone with access opens such a link, but it needed fixing regardless.
One more thing tightened in 4.3.0
The action that saves the drag-and-drop order of sortable post types was available to any logged-in user. It’s now limited to administrators. Nobody reported this and it has no CVE. We tightened it while we were in there.
Why the plugin was pulled from WordPress.org
When a report like the first one is confirmed, the WordPress.org plugin team closes the listing until they’ve reviewed the fix. That’s what happened here. The listing went down on September 8, we shipped 4.3.1 on September 11 to satisfy the review, and the listing came back once the review completed. It was never a sign that the plugin was going away.
What we’ve done since
Beyond the fixes themselves, the end-to-end test suite now checks the permissions on every AJAX action the plugin exposes. If an endpoint ever answers to the wrong audience again, a test fails before the release goes out. Those tests also run on PHP 8.4 now.
What you should do
Update to 4.3.2. That closes both issues, and there’s nothing else to configure. If you’d rather not think about it again, turn on auto-updates for the plugin from the Plugins page.
Thank you to Philipp Doblhofer and Joshua Martinelle for reporting these responsibly, and to everyone who waited patiently while we worked through the review with the WordPress.org team.
The big picture
The 4.3 line was never meant to be only a security release. There’s a fair amount in here that we’d been working on for a while, and it got somewhat buried under the review. Here’s what we think matters most.
Fewer database requests in post and user loops
Before 4.3.0, a post loop could end up making extra database requests for every item it rendered, one for the post and one for its meta, because the loop’s query optimisation skipped WordPress’s normal cache priming. On a loop of a few hundred posts that added up. Post loops and user loops now prime the post, meta and term caches in bulk before rendering, so the number of queries stays flat no matter how many items the loop returns. Attachment loops get the same fix, since they build on the post loop.
You don’t need to change anything in your templates to benefit from this. If you have a large report-style loop that has always felt slow, this release is worth re-testing on.
Compile templates to PHP (beta)
There’s a new optional setting under Loops & Logic settings called “Compile templates to PHP”. When it’s on, a saved template is compiled once into a PHP file, and later renders include that file instead of parsing the template markup again. The compiled files live in wp-content/tangible-template-cache, and the settings page shows the cache path, its status, and a button to clear it.
This is off by default and marked beta for good reason. It depends on PHP’s opcache being enabled on your server. Without opcache, including the compiled file costs more than parsing the template, so the plugin checks for opcache and falls back to the normal rendering path if it isn’t there. If you’re on a host where opcache is on (most managed hosts), try it on a staging site first and let us know how it goes.
Pagination scroll attributes fixed
The scroll_top and scroll_animate attributes on the PaginateButtons tag weren’t behaving. They’re fixed in 4.3.0. If you’d worked around this with your own scroll script, you can probably take it out now.
ACF group loops and choice-field subfields
Two ACF fixes that came from support threads. The Group loop now handles group field values that ACF returns as arrays, and the Field tag correctly resolves field=label and the other subfields of choice fields like select, radio and checkbox. If either of those had been giving you empty output, this is the release that sorts it.
Fewer fatal errors from bad input
The Format tag used to throw a fatal error if you passed a non-numeric value for length or offset. It now ignores the value instead. Along the same lines, 4.3.2 fixes a fatal in the Math tag when a function was called with the wrong number of arguments. Neither is glamorous, but a template that renders with a wrong value is easier to debug than a white screen.
Full changelog from version 4.3.0
You can update in one of two ways. If you installed the plugin through WordPress, head to Dashboard > Updates (or the Plugins page) and click Update Now when the new version appears. If you installed it from GitHub, download the latest release from the repository’s Releases page and replace your existing plugin folder, or pull the latest changes if you’re tracking the repo directly. Either way, back up your site before updating, just in case.
4.3.2
Release Date: 2026-09-17
- Math tag: Fix fatal error on wrong number of function arguments
- Security: Fields – Fix XSS in ajax error response (CVE-2026-82123)
4.3.1
Release Date: 2026-09-11
- Admin: Welcome notice – Add nonce verification when dismissing
- WordPress:
- Update Tested up to version to 7.1
- Make sure plugin meets required standards
4.3.0
Release Date: 2026-09-03
- ACF Group loop: Support group field values returned as arrays
- Field tag: Fix field=label and other ACF choice-field subfields
- Format tag: Ignore non-numeric length/offset values instead of a fatal error
- Loops: Improve post and user query performance by reducing database requests
- PaginateButtons tag: Fix scroll_top and scroll_animate attributes
- Performance: New optional feature to compile L&L templates to PHP for faster rendering (requires opcache)
- Security:
- Table: Validate requests with a signed hash (CVE-2026-16960 – Thanks Philipp Doblhofer for the report!)
- Sortable post types: Restrict ajax action to admin users
- Development:
- Tests: E2E – Cover AJAX permissions with tests
- Tests: Run existing tests on PHP 8.4 as well
- Workflows: Extend tests support
As always, if something in this release doesn’t behave the way you expect, the community forum is the place to tell us. We read every thread.