WYSIWYG editor, oEmbed and Link

This page covers three types for content that is more than plain text: the WYSIWYG editor for formatted text, oEmbed for embedded media and Link for a button with its own text and target.

WYSIWYG editor

A rich text editor (WordPress's classic editor with the Visual and Text tabs) for formatted content: bold text, lists, links and media.

Type settings

Cleaning on save

• The HTML is filtered like post content (wp_kses_post()): scripts, iframes, event attributes and other unsafe markup are removed. The text inside a removed tag stays (<script>alert(1)</script> leaves alert(1)).
• A value that is only whitespace saves an empty field.
• Users who cannot edit posts (guests and subscribers in a front-end form) cannot add shortcodes: their [ and ] characters are saved as HTML entities.

Template usage

$html = wpmcf_get_field( 'page_extras', 'intro' );
// "<p>Hello <strong>world</strong></p> [gallery]"   (as stored: no automatic paragraphs, shortcodes not run)

echo wp_kses_post( wpautop( $html ) );          // add paragraphs, no shortcodes
echo do_shortcode( wpautop( wp_kses_post( $html ) ) );   // what the field itself prints

wpmcf_the_field( 'page_extras', 'intro', null, [ 'wrap' => false ] );

[wpmcf_field group="page_extras" field="intro" wrap="false"]

The printed result is wpautop() (blank lines become <p> and <br>), kses-filtered, then shortcodes run. Because paragraphs inside the default wrapper <span class="wpmcf-field-value"> are not valid HTML, print rich text with wrap="false" (or 'wrap' => false) and put it in your own element.

Length rules (Min length, Max length) are ignored for this type: the server never cuts the HTML.

In front-end forms (Pro) the field is a plain textarea that accepts HTML.

oEmbed

Stores the address of a page that supports embedding (YouTube, Vimeo, X, Spotify and the other providers WordPress knows) and prints the provider's embed code.

Type settings

What is accepted

Only http and https addresses. ftp://… is refused. Text without a scheme is completed (example.com/video becomes http://example.com/video), and a string that is not an address at all can be turned into a meaningless http://… address, so validate in your own code if the source is untrusted.

Template usage

$url = wpmcf_get_field( 'lesson', 'video' );      // "https://www.youtube.com/watch?v=dQw4w9WgXcQ"

wpmcf_the_field( 'lesson', 'video', null, [ 'wrap' => false ] );
// <iframe title="…" width="1778" height="1000" src="https://www.youtube.com/embed/dQw4w9WgXcQ?feature=oembed" …></iframe>

[wpmcf_field group="lesson" field="video" wrap="false"]

Embeds are fetched once and cached: for one day when the provider answered, for one hour when it did not. The cache is a set of transients named wpmcf_oembed_…; changing the URL, width or height uses a new cache entry. If WordPress cannot fetch an embed, a plain link to the URL is printed instead.

Edit screen

A URL box with the placeholder https:// and a live preview of the embed below it.

Link

A URL with its link text and a "new tab" option, like the link dialog in the editor. Use it for buttons and calls to action.

Edit screen

Three controls: URL, Link text and a checkbox Open in a new tab.

Stored and returned shape

$link = wpmcf_get_field( 'hero', 'button' );
// [
//   'url'    => 'https://example.org',
//   'title'  => 'Learn more',
//   'target' => '_blank',     // or '' for the same tab
// ]

wpmcf_update_field() also accepts a plain string and treats it as the URL: wpmcf_update_field( 'hero', 'button', 'https://plain.org', $id ) saves url with an empty title and target.

JSON objects can come back with their keys in a different order. Read each part by key.

Printing

$link = wpmcf_get_field( 'hero', 'button' );
if ( $link ) {
    printf(
        '<a class="btn" href="%s"%s>%s</a>',
        esc_url( $link['url'] ),
        '_blank' === $link['target'] ? ' target="_blank" rel="noopener"' : '',
        esc_html( $link['title'] ?: $link['url'] )
    );
}

[wpmcf_field group="hero" field="button" wrap="false"]
→ <a href="https://example.org" target="_blank" rel="noopener">Learn more</a>

The automatic output adds target="_blank" rel="noopener" only for new-tab links, and uses the URL as link text when the title is empty. Passing format="url" or format="html" prints the parts joined with commas instead of a link, so keep the default auto format for links.

The WPM Field block can also print a Link field (see Blocks and block bindings). For output in code see Developer API.

Troubleshooting

• My WYSIWYG text has no paragraphs in PHP. wpmcf_get_field() returns what was stored. Use wpautop() or wpmcf_the_field().
• Shortcodes in my WYSIWYG text show as [gallery]. Raw output does not run them; wpmcf_the_field() and the shortcode do.
• The video does not embed, only a link. The provider is not on WordPress's oEmbed list, the video is private, or the request failed. Failed lookups are retried after an hour.
• My Link field is empty although I entered text. A link needs a URL. Link text alone is not saved.