Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

LeadConnector · Version history

LeadConnector changelog and version history

Latest version
4.0.7
Nov 4, 2026 (5 days ago)
Releases
68
since 2020
In the last year
28
about one every 13 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 20202 releases
  • 20219 releases
  • 20221 release
  • 20243 releases
  • 202530 releases
  • 202623 releases

202623 releases

  1. LeadConnector 4.0.7Latest

    • Changed
    • Documentation: LeadConnector admin UI source repository is now https://github.com/leadconnector-org/leadconnector-fe (previously https://github.com/LeadConnectorHQ/leadconnector-fe).

  2. LeadConnector 4.0.6

    • Security
    • Security patch. Recommended for all sites. Safe to upgrade.

  3. LeadConnector 4.0.5

    • Fixed
    • Funnel forms using Cloudflare Turnstile captcha (replacing Google reCAPTCHA) now load and validate correctly. Added challenges.cloudflare.com to the native-mode Content-Security-Policy script-src and frame-src directives so the Turnstile script can execute and its challenge iframe can render.
    • Reputation Hub review widget iframe no longer blocked by CSP on native-mode funnel pages — added *.reputationhub.site and reputationhub.site to the frame-src directive.
    • Google Ads conversion tracking and remarketing scripts (*.googleadservices.com, *.doubleclick.net) added to the script host allowlist so they are no longer blocked by CSP on funnel pages.

  4. LeadConnector 4.0.4

    • Added
    • Universal AI Pages editing in the platform preview: any Elementor text or image widget can be selected and customized.
    • AI page edit contract versioning via post meta _leadconnector_ai_page_version. Newer pages use the universal widget path; older pages without the meta (or below version 2) keep the legacy CSS-class hover and edit targets.

  5. LeadConnector 4.0.3

    • Added
    • Added support for AI pages in Draft mode.
    • Draft AI pages can be previewed in the platform before going live.
    • Publish or unpublish changes in WordPress Admin now stay in sync with the platform dashboard.
    • Improved
    • Custom values with HTML formatting (links, bold text, etc.) now display correctly on your site instead of showing raw markup.

  6. LeadConnector 4.0.2

    • Added
    • Added Rocket.net, HighLevel, and LeadConnector as selectable options in the hosting provider dropdown on the support request form so site owners can identify their hosting environment more accurately when reporting an issue.
    • Changed
    • Renamed the Send feedback header button to Support and replaced its chat-bubble icon with a headset icon for clearer intent.
    • Repositioned the Submit feedback or report an issue link on the pre-connection auth wall from the bottom-left footer to the top-right of the white panel, added a matching headset icon, and restyled it as an outlined button so it visually pairs with the connected-state Support button.

  7. LeadConnector 4.0.1

    • Improved
    • Two-way sync for AI-generated pages keeps create, update, and delete events aligned between LeadConnector and WordPress throughout the page lifecycle.
    • AI Pages customizations now apply more efficiently, with reduced operational overhead when syncing style and content changes.

  8. LeadConnector 4.0.0

    • Added
    • Added a Send feedback button to the logged-in LeadConnector admin header. It opens the WordPress plugin support portal at https://wordpress.leadconnectorhq.com/pg/support in a new browser tab so site owners can submit feedback or report issues without leaving wp-admin.
    • Added a support link on the pre-connection auth wall (bottom-left footer) that points to the same support portal for users who have not connected their account yet.
    • Changed
    • Refreshed the connected-state admin header layout: the connection status badge and overflow menu are aligned to a consistent 32px control height, and feedback actions are surfaced as a dedicated header button instead of burying support inside the overflow menu or dashboard copy.
    • Improved full-page admin layout on connected screens so short tabs (for example Calendar or Chat Widget) fill the viewport with a white background instead of exposing the default WordPress admin grey footer band; auth-wall scroll locking remains scoped to the login screen only.
    • Fixed
    • Custom value placeholder substitution in title and plain-text filters no longer runs esc_html() across the entire returned string. Each substituted custom value is escaped individually while surrounding content is left untouched, preventing double-encoding and restoring compatibility with multiling…

  9. LeadConnector 3.0.34

    • Fixed
    • Fixed an OAuth login redirect flaw where the connection was lost on the first page refresh after a successful “Connect with LeadConnector” handshake. AES-256-GCM ciphertext for the encrypted oauth_access_token / oauth_refresh_token options was being base64-encoded and base64-decoded exclusively thr…
    • Funnel / API base64 payload decoding hardened against the same missing-extension failure mode. leadconnector_decode_stored_json() and leadconnector_decode_api_base64_payload() in trunk/includes/leadconnector-functions.php now share a single leadconnector_decode_base64_payload() helper that uses sod…

  10. LeadConnector 3.0.33

    • Fixed
    • Fixed a compatibility issue where Custom Values could affect navigation menu item titles in Astra Theme and other WordPress themes.

  11. LeadConnector 3.0.32

    • Security
    • Auth-cookie hand-off removed. The deferred custom-values save no longer reads LOGGED_IN_COOKIE, SECURE_AUTH_COOKIE, or AUTH_COOKIE from $_COOKIE and no longer issues a plugin-generated wp_remote_post() loopback that forwards WordPress authentication cookies to its own REST endpoint. The work is now…
    • Inline funnel CSS extracted from remote LeadConnector HTML is now passed through a new LeadConnector_Admin::sanitize_extracted_inline_css() allowlist sanitizer before reaching wp_add_inline_style(). The sanitizer strips embedded HTML tag fragments (</style>, <script>, <iframe>, etc.), legacy CSS XS…
    • Funnel inline-style output (output_extracted_styles()) now early-exits when an external src is rejected by esc_url() or when an inline block sanitizes to an empty string, removing dummy wp_register_style() entries that would otherwise emit empty <style> placeholders.
    • Native-mode <script src> host allowlist. LeadConnector_Admin::output_extracted_scripts() and render_extracted_scripts_html() now validate every external <script> URL extracted from upstream funnel HTML against a host allowlist returned by the new funnel_allowed_script_hosts() method. Entries can be…
    • Native-mode Content-Security-Policy <meta> tag. Every funnel page rendered in native display mode now emits a <meta http-equiv="Content-Security-Policy" content="…"> element inside <head> (via LeadConnector_Admin::output_native_mode_csp() hooked to wp_head at priority 1 for the WordPress-headers an…
    • Native-mode admin opt-in toggle. New plugin option leadconnector_native_mode_allowed (default: enabled, sanitized to '0' / '1' through sanitize_settings_with_widget_refresh()) gates process_page_request() so that funnel posts whose leadconnector_display_method post-meta is native are silently downg…
    • README.txt now ships a dedicated “Native funnel rendering — trust boundary” section that documents the iframe vs. native rendering trade-off, the five layered controls applied to native mode (admin opt-in, host allowlist, CSP <meta>, inline CSS sanitizer, no WP-secret cross-over), and the exact fil…
    • Native-funnel index hardened against stale entries. The leadconnector_native_funnel_index option (which gates the admin trust notice) now only stores IDs of currently-published funnel posts, is kept in sync across trash / untrash / publish / unpublish transitions via a new transition_post_status ho…
    • Compliance
    • README.txt “External Services” section rewritten end-to-end with a per-host disclosure for every domain the plugin contacts (services.leadconnectorhq.com, rest.leadconnectorhq.com, api.leadconnectorhq.com, backend.leadconnectorhq.com, app.leadconnectorhq.com, widgets.leadconnectorhq.com, marketplac…

  12. LeadConnector 3.0.31

    • Security
    • Admin REST responses no longer return decrypted OAuth access tokens, OAuth refresh tokens, API keys, or the full plugin options blob to the browser. The admin UI now only receives connection-status flags. (#A1)
    • AES-256-CTR at-rest encryption replaced with AES-256-GCM (authenticated encryption). The hardcoded fallback key/salt has been removed; the plugin halts with wp_die() and a translatable error if LOGGED_IN_KEY/LOGGED_IN_SALT are missing or the OpenSSL PHP extension is unavailable, instead of silently…
    • The /leadconnector_api/v1/proxy GET route now requires a valid X-WP-Nonce for state-changing endpoints (wp_disconnect, wp_validate_oauth, wp_regenerate_token, wp_enable_email, wp_disable_email, wp_save_options, wp_insert_post, wp_delete_post). Requests without a nonce – drive-by CSRF, image preload…
    • process_page_request() validates the inbound Host header against home_url() before treating it as a routing key, blocking host-header spoof attacks. (#C13)
    • LeadConnector_Logger::__wakeup() now throws to actually prevent unserialization of the singleton. (#D6)
    • Logic bug fixed in OAuth token regeneration: missing-or-empty refresh tokens are now both detected. (#D1)
    • SEO Overrides module no longer emits <meta name="leadconnector-seo-debug-*"> tags into the front-end response on every request. The debug breadcrumb path is removed entirely and SEO override meta tags are only rendered when at least one override is configured for the current path. Resolves an infor…
    • Admin asset bundle no longer monkey-patches the global window.fetch function. The previous wrapper intercepted every admin XHR to detect a successful wp_validate_oauth response; it has been replaced with a leadconnector:purge-toolbar-refresh CustomEvent listener plus a wp.hooks action so other plug…
    • LeadConnector_Logger now redacts secret-shaped context keys (password, secret, token, api_key, apikey, authorization, auth, code, bearer, session, cookie) and secret-shaped substrings (code=…, refresh_token=…, access_token=…, api_key=…, Authorization: Bearer …, JSON pairs like "password":"…") befor…
    • leadconnector_oauth_wp_remote_get() no longer returns the decrypted OAuth access token to its caller (and therefore through the REST proxy to the browser) on the after-two-attempts error envelope. A boolean has_access_token flag replaces it so the admin UI can still detect a missing token without l…
    • Funnel CPT registration no longer references a non-existent remove_save_box method via register_meta_box_cb. The argument has been removed entirely. (#C8)
    • “Redirect to Funnel URL” display method no longer side-steps wp_safe_redirect() by adding the destination host to allowed_redirect_hosts for the duration of the call. Hosts are now validated against a fixed allowlist (canonical LeadConnector hosts + the site’s own home host + an admin-configured wh…
    • Funnel head allowlist no longer permits the <base href> tag. A <base href> rewrites every relative URL in the document, so a malicious upstream funnel could redirect form posts, asset loads, and link clicks to an attacker-controlled host without ever placing a script tag. (#M12)
    • process_page_request() now punycode-normalizes both the incoming Host: header and the canonical home_url() host before comparing them, defeating an IDN-encoding bypass where a Unicode Host header (e.g. münchen.example) would fail to match an ASCII-encoded expected host (xn--mnchen-3ya.example). (#M…
    • Compliance
    • Tested up to: 6.7 (was the non-existent 7.0); Requires at least aligned across README.txt and the plugin header. (#B2)
    • Translation files renamed from LeadConnector-* to lowercase leadconnector-* so WordPress 4.6+ auto-loads them under the declared leadconnector text domain. (#B3)
    • Tags hyphenated to single tokens (chat-widget, marketing-automation, funnels). (#B6)
    • External Services section expanded with per-host disclosures of what data is sent and when. (#B7)
    • Translations are now picked up automatically by WordPress 4.6+ just-in-time loading without calling load_plugin_textdomain() manually. The Domain Path: /languages header remains declared so the WordPress.org Translate Console and bundled .mo files are still discoverable. (#B8)
    • Custom post type leadconn_funnels registration cleaned up: invalid hide_post_row_actions argument removed (replaced with a proper post_row_actions filter), supports set to array( 'title' ) instead of array( '' ), has_archive set to false (consistent with public => false), show_in_rest => false made…
    • Removed unused /leadconnector/v1/input/site-create, /leadconnector/v1/input/site-delete, and /leadconnector/v1/input/user-update validator routes (and their DTOs) per WP.org reviewer guidance. (#C9)
    • Replaced esc_sql() table-name interpolation with $wpdb->prepare() %i identifier placeholders. (#C12)
    • Copyright headers updated to Copyright (C) 2020-2026 LeadConnector. (#B9)
    • Added “Silence is golden” index.php stubs to every shipped subdirectory. (#C17)
    • README.txt Tested up to: lowered to 6.7 (was the non-existent 7.0 claim from 3.0.31). (#C1)
    • README.txt “External Services” section now discloses that connecting the LeadConnector CDN integration (when CDN_WP_ID / CDN_SITE_ID is defined and an OAuth session exists) causes the plugin to send an authenticated remote cache-purge POST to services.leadconnectorhq.com on every public-post save_p…
    • README.txt “Available Shortcodes” section now advertises the canonical [leadconnector_*] shortcodes; the deprecated [lc_*] aliases are documented as remaining only for backward compatibility. (#M1)
    • New “Debug Logging” section in README.txt documents the relocated log directory, the LEADCONNECTOR_LOG_DIR override constant, the redaction policy, and the nginx / Caddy server-block snippets required to block direct HTTP access on stacks that do not honour .htaccess.

  13. LeadConnector 3.0.29

    • Improved
    • Reorganized plugin bootstrap and class files under LeadConnector-prefixed naming for clearer structure.
    • Shortcodes use the leadconnector_ prefix; existing lc_ shortcodes remain registered for backward compatibility.
    • Admin and include code formatting aligned with PHPCS/WPCS standards.

  14. LeadConnector 3.0.27

    • Fixed
    • Readme stable tag and Tested up to version aligned with the plugin release for WordPress.org compliance.
    • Admin menu labels use escaped strings for i18n tooling compatibility.
    • Improved
    • Added Source Code documentation for compiled admin assets.
    • Standardized the Plugin URI readme header and removed duplicate third-party service text from the Upgrade Notice.

  15. LeadConnector 3.0.26

    • Fix: Resolved chat widget breakage on some themes.

  16. LeadConnector 3.0.25

    • Feature: Added ability to regenerate images for AI Pages.

  17. LeadConnector 3.0.24

    • Feature: Added preview of color customization for AI pages.

  18. LeadConnector 3.0.23

    • Fix: Resolved chat widget issues in some cases.
    • Improved: Minor copy changes.

  19. LeadConnector 3.0.22

    • Security: Added security patches.

  20. LeadConnector 3.0.21

    • Fix: Resolved login failures when WordPress is installed in a subfolder configuration.
    • Fix: Addressed cache issues when updating settings. Cache now auto-refreshes when changes are made.

  21. LeadConnector 3.0.20

    • Fix: Resolved plugin breakage when permalink structure is set to Plain.

  22. LeadConnector 3.0.19

    • Enhancement: CDN cache purge option now has broader visibility.

  23. LeadConnector 3.0.18

    • Fix: Resolved layout shift on the left side in some themes.
    • Fix: Resolved external video embedding issues in funnels.

202530 releases

  1. LeadConnector 3.0.17

    • Feature: Introduced AI-Powered WordPress Page Builder.
    • Fix: Improved template loading and builder panel compatibility.

  2. LeadConnector 3.0.16

    • Enhancement: Added WordPress header and footer support in funnel HTML embed.

  3. LeadConnector 3.0.15

  4. LeadConnector 3.0.14

  5. LeadConnector 3.0.13.1

  6. LeadConnector 3.0.13

  7. LeadConnector 3.0.12

  8. LeadConnector 3.0.10.5

  9. LeadConnector 3.0.11

  10. LeadConnector 3.0.10.4

  11. LeadConnector 3.0.10.3

  12. LeadConnector 3.0.10.2

  13. LeadConnector 3.0.10.1

  14. LeadConnector 3.0.10

  15. LeadConnector 3.0.9

  16. LeadConnector 3.0.8

  17. LeadConnector 3.0.7

  18. LeadConnector 3.0.6

  19. LeadConnector 3.0.5

  20. LeadConnector 3.0.4

  21. LeadConnector 3.0.3

  22. LeadConnector 3.0.2

  23. LeadConnector 3.0.1

  24. LeadConnector 3.0

  25. LeadConnector 2.0.5

  26. LeadConnector 2.0.4

  27. LeadConnector 2.0.3

  28. LeadConnector 2.0.2

  29. LeadConnector 2.0.1

  30. LeadConnector 2.0

20243 releases

  1. LeadConnector 1.9

  2. LeadConnector 1.8

  3. LeadConnector 1.7

20221 release

  1. LeadConnector 1.6

20219 releases

  1. LeadConnector 1.5

  2. LeadConnector 1.4

  3. LeadConnector 1.3

  4. LeadConnector 1.2

  5. LeadConnector 1.1

  6. LeadConnector 1.0

  7. LeadConnector 0.5.0

  8. LeadConnector 0.4.0

  9. LeadConnector 0.3.0

20202 releases

  1. LeadConnector 0.2.0

  2. LeadConnector 0.1.0

Questions about LeadConnector’s releases

What is the latest version of LeadConnector?

4.0.7, released on Nov 4, 2026 (5 days ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is LeadConnector updated?

28 releases in the last year, about one every 13 days. Its first release on WordPress.org dates from December 2020.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in LeadConnector’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.