Bugfix
- [security] Radio and toggle field option labels are now escaped instead of being rendered as raw HTML, so a form definition can no longer place a script in an option label that runs when the form is viewed (GHSA-5xv4-g337-2pg7).
- The Cap captcha now actually uses the WASM binary that ships with the plugin.
cap.min.jsstarts fetching it as soon as it runs and remembers whichever URL it resolved first, butCAP_CUSTOM_WASM_URLwas only being set onDOMContentLoaded, which happens after that fetch has begun. Every visitor was therefore downloading the binary from the jsDelivr CDN, giving the contact form a third party dependency it does not need and leaking a request to anyone running one.