From b28445d791d5b75d36b19e4f235de396005d0937 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Wed, 5 Aug 2026 14:32:50 -0300
Subject: [PATCH 1/7] Issue 5886 improvements

---
 classes/helpers/FrmFormsHelper.php          |  58 +++++----
 css/_single_theme.css.php                   |  10 +-
 tests/phpunit/forms/test_FrmFormsHelper.php | 133 ++++++++++++++++++++
 3 files changed, 171 insertions(+), 30 deletions(-)

diff --git a/classes/helpers/FrmFormsHelper.php b/classes/helpers/FrmFormsHelper.php
index 0499d44384..a632b729a2 100644
--- a/classes/helpers/FrmFormsHelper.php
+++ b/classes/helpers/FrmFormsHelper.php
@@ -288,15 +288,14 @@ public static function get_invalid_error_message( $args ) {
 			$settings_args['current_form'] = $args['form']->id;
 		}
 
-		$frm_settings = FrmAppHelper::get_settings( $settings_args );
-
+		$frm_settings         = FrmAppHelper::get_settings( $settings_args );
 		$field_error_messages = self::get_clickable_field_error_messages( $args );
-
-		$invalid_msg = '<span>' . do_shortcode( $frm_settings->invalid_msg ) . '</span>';
+		$invalid_msg          = '<span>' . do_shortcode( $frm_settings->invalid_msg ) . '</span>';
 
 		if ( $field_error_messages ) {
 			$invalid_msg .= "<ul>$field_error_messages</ul>";
 		}
+
 		return apply_filters( 'frm_invalid_error_message', $invalid_msg, $args );
 	}
 
@@ -310,27 +309,17 @@ public static function get_invalid_error_message( $args ) {
 	 * @return string
 	 */
 	private static function get_clickable_field_error_messages( $args ) {
-		$field_error_messages = '';
-
 		if ( empty( $args['errors'] ) ) {
-			return $field_error_messages;
+			return '';
 		}
 
-		$field_ids  = array_map(
-			function ( $field_plus_id ) {
-				$field_id = str_replace( 'field', '', $field_plus_id );
-
-				if ( strpos( $field_id, '-' ) !== false ) {
-					$field_id = explode( '-', $field_id )[0];
-				}
-				return $field_id;
-			},
-			array_keys( $args['errors'] )
-		);
-		$field_keys = FrmDb::get_results( 'frm_fields', array( 'id' => $field_ids ), 'id,field_key,type' );
+		// Parse each error key once into its field ID and repeater row suffix, skipping
+		// non-field errors like 'form' or 'spam' that have no input to link to.
+		$parsed_errors = array();
+		$field_ids     = array();
 
 		foreach ( $args['errors'] as $field_plus_id => $error ) {
-			$field_id = str_replace( 'field', '', $field_plus_id );
+			$field_id = preg_replace( '/^field/', '', $field_plus_id );
 			$row      = '';
 
 			if ( strpos( $field_id, '-' ) !== false ) {
@@ -342,21 +331,40 @@ function ( $field_plus_id ) {
 				}
 			}
 
-			$index = array_search( $field_id, array_column( $field_keys, 'id' ), true );
+			if ( ! is_numeric( $field_id ) ) {
+				continue;
+			}
+
+			$field_ids[]     = (int) $field_id;
+			$parsed_errors[] = compact( 'field_id', 'row', 'error' );
+		}
+
+		if ( ! $field_ids ) {
+			return '';
+		}
+
+		$fields               = FrmDb::get_results( 'frm_fields', array( 'id' => $field_ids ), 'id,field_key,type' );
+		$ids                  = array_map( 'intval', array_column( $fields, 'id' ) );
+		$field_error_messages = '';
+
+		foreach ( $parsed_errors as $parsed_error ) {
+			$index = array_search( (int) $parsed_error['field_id'], $ids, true );
 
 			if ( false === $index ) {
 				continue;
 			}
 
-			$html_id = 'field_' . $field_keys[ $index ]->field_key . $row;
+			$field   = $fields[ $index ];
+			$html_id = 'field_' . $field->field_key . $parsed_error['row'];
 
-			if ( in_array( $field_keys[ $index ]->type, array( 'checkbox', 'radio' ), true ) ) {
-				// Needed to focus on the first option when error link is clicked.
+			if ( in_array( $field->type, array( 'checkbox', 'radio' ), true ) ) {
+				// Needed to focus on the first option when the error link is clicked.
 				$html_id .= '-0';
 			}
 
-			$field_error_messages .= '<li><a href="#' . $html_id . '">' . $error . '</a></li>';
+			$field_error_messages .= '<li><a href="#' . esc_attr( $html_id ) . '">' . esc_html( $parsed_error['error'] ) . '</a></li>';
 		}//end foreach
+
 		return $field_error_messages;
 	}
 
diff --git a/css/_single_theme.css.php b/css/_single_theme.css.php
index 90ed2bf442..3906dcc6b6 100644
--- a/css/_single_theme.css.php
+++ b/css/_single_theme.css.php
@@ -423,20 +423,20 @@
 }
 
 .<?php echo esc_html( $style_class ); ?> .frm_error_style span{
-	font-weight: bold<?php echo esc_html( $important ); ?>;;
+	font-weight: bold<?php echo esc_html( $important ); ?>;
 }
 
 .<?php echo esc_html( $style_class ); ?> .frm_error_style ul{
-	list-style: inside<?php echo esc_html( $important ); ?>;;
-	color: <?php echo esc_html( $error_text . $important ); ?>;
+	list-style: inside<?php echo esc_html( $important ); ?>;
+	color: var(--error-text)<?php echo esc_html( $important ); ?>;
 }
 
 .<?php echo esc_html( $style_class ); ?> .frm_error_style ul li a{
-	color: <?php echo esc_html( $error_text . $important ); ?>;
+	color: var(--error-text)<?php echo esc_html( $important ); ?>;
 }
 
 .<?php echo esc_html( $style_class ); ?> .frm_error_style ul li a:hover{
-	text-decoration: underline<?php echo esc_html( $important ); ?>;;
+	text-decoration: underline<?php echo esc_html( $important ); ?>;
 }
 
 <?php if ( $pro_is_installed ) { ?>
diff --git a/tests/phpunit/forms/test_FrmFormsHelper.php b/tests/phpunit/forms/test_FrmFormsHelper.php
index 41a294d59d..0204b3e833 100644
--- a/tests/phpunit/forms/test_FrmFormsHelper.php
+++ b/tests/phpunit/forms/test_FrmFormsHelper.php
@@ -146,4 +146,137 @@ private function create_form_with_custom_style_value( $custom_style ) {
 			)
 		);
 	}
+
+	/**
+	 * The invalid error message should include a list of links that jump to each field that failed validation.
+	 *
+	 * @covers FrmFormsHelper::get_invalid_error_message
+	 */
+	public function test_get_invalid_error_message_builds_clickable_field_links() {
+		$this->form = $this->factory->form->create_and_get();
+
+		$text_id     = $this->create_field_with_key( 'text', 'my_text' );
+		$select_id   = $this->create_field_with_key( 'select', 'my_select' );
+		$checkbox_id = $this->create_field_with_key( 'checkbox', 'my_checkbox' );
+		$radio_id    = $this->create_field_with_key( 'radio', 'my_radio' );
+
+		$message = FrmFormsHelper::get_invalid_error_message(
+			array(
+				'form'   => $this->form,
+				'errors' => array(
+					'field' . $text_id     => 'Text is required',
+					'field' . $select_id   => 'Select is required',
+					'field' . $checkbox_id => 'Checkbox is required',
+					'field' . $radio_id    => 'Radio is required',
+				),
+			)
+		);
+
+		// The base invalid message is wrapped in a span, and the links are inside a list.
+		$this->assertStringContainsString( '<ul>', $message );
+		$this->assertStringContainsString( '<li><a href="#field_my_text">Text is required</a></li>', $message );
+		$this->assertStringContainsString( '<li><a href="#field_my_select">Select is required</a></li>', $message );
+
+		// Checkbox and radio links target the first option so focus lands on a real input.
+		$this->assertStringContainsString( '<li><a href="#field_my_checkbox-0">Checkbox is required</a></li>', $message );
+		$this->assertStringContainsString( '<li><a href="#field_my_radio-0">Radio is required</a></li>', $message );
+	}
+
+	/**
+	 * Non-field errors such as 'form' or 'spam' have no input to link to and should be skipped.
+	 *
+	 * @covers FrmFormsHelper::get_invalid_error_message
+	 */
+	public function test_get_invalid_error_message_skips_non_field_errors() {
+		$this->form = $this->factory->form->create_and_get();
+		$text_id    = $this->create_field_with_key( 'text', 'linkable_text' );
+
+		$message = FrmFormsHelper::get_invalid_error_message(
+			array(
+				'form'   => $this->form,
+				'errors' => array(
+					'form'             => 'There was a problem with your submission.',
+					'spam'             => 'Your entry appears to be spam!',
+					'field' . $text_id => 'Text is required',
+				),
+			)
+		);
+
+		$this->assertStringContainsString( '<li><a href="#field_linkable_text">Text is required</a></li>', $message );
+		$this->assertStringNotContainsString( 'appears to be spam', $message );
+		$this->assertStringNotContainsString( '<a href="#field_spam', $message );
+	}
+
+	/**
+	 * With no field errors there should be no list at all, only the base message.
+	 *
+	 * @covers FrmFormsHelper::get_invalid_error_message
+	 */
+	public function test_get_invalid_error_message_without_errors_has_no_list() {
+		$this->form = $this->factory->form->create_and_get();
+
+		$message = FrmFormsHelper::get_invalid_error_message( array( 'form' => $this->form ) );
+
+		$this->assertStringNotContainsString( '<ul>', $message );
+		$this->assertStringNotContainsString( '<li>', $message );
+	}
+
+	/**
+	 * Error text and IDs must be escaped so a malicious field key or message cannot inject markup.
+	 *
+	 * @covers FrmFormsHelper::get_invalid_error_message
+	 */
+	public function test_get_invalid_error_message_escapes_output() {
+		$this->form = $this->factory->form->create_and_get();
+		$text_id    = $this->create_field_with_key( 'text', 'escape_test' );
+
+		$message = FrmFormsHelper::get_invalid_error_message(
+			array(
+				'form'   => $this->form,
+				'errors' => array(
+					'field' . $text_id => '<script>alert(1)</script>',
+				),
+			)
+		);
+
+		$this->assertStringNotContainsString( '<script>alert(1)</script>', $message );
+		$this->assertStringContainsString( '&lt;script&gt;', $message );
+	}
+
+	/**
+	 * A repeater style error key (field{id}-{row_meta}-{row}) should link to the field in the correct row.
+	 *
+	 * @covers FrmFormsHelper::get_invalid_error_message
+	 */
+	public function test_get_invalid_error_message_handles_repeater_row_keys() {
+		$this->form = $this->factory->form->create_and_get();
+		$text_id    = $this->create_field_with_key( 'text', 'repeated_text' );
+
+		$message = FrmFormsHelper::get_invalid_error_message(
+			array(
+				'form'   => $this->form,
+				'errors' => array(
+					'field' . $text_id . '-55-2' => 'Repeated text is required',
+				),
+			)
+		);
+
+		$this->assertStringContainsString( '<li><a href="#field_repeated_text-2">Repeated text is required</a></li>', $message );
+	}
+
+	/**
+	 * @param string $type
+	 * @param string $field_key
+	 *
+	 * @return int
+	 */
+	private function create_field_with_key( $type, $field_key ) {
+		return $this->factory->field->create(
+			array(
+				'form_id'   => $this->form->id,
+				'type'      => $type,
+				'field_key' => $field_key,
+			)
+		);
+	}
 }

From c24a1da81e2e47995e4d24553352f48a7638abb9 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Wed, 5 Aug 2026 15:04:43 -0300
Subject: [PATCH 2/7] Use role="alert" for AJAX errors, use kses on error
 message

---
 .../FrmEntriesAJAXSubmitController.php        |  1 +
 classes/helpers/FrmFormsHelper.php            | 25 +++++-
 tests/phpunit/forms/test_FrmFormsHelper.php   | 83 +++++++++++++++++--
 3 files changed, 101 insertions(+), 8 deletions(-)

diff --git a/classes/controllers/FrmEntriesAJAXSubmitController.php b/classes/controllers/FrmEntriesAJAXSubmitController.php
index 21286af743..3ce89a3f18 100644
--- a/classes/controllers/FrmEntriesAJAXSubmitController.php
+++ b/classes/controllers/FrmEntriesAJAXSubmitController.php
@@ -85,6 +85,7 @@ public static function ajax_create() {
 					'form'     => $form,
 					'entry_id' => 0,
 					'class'    => FrmFormsHelper::form_error_class(),
+					'role'     => 'alert',
 				)
 			);
 		} else {
diff --git a/classes/helpers/FrmFormsHelper.php b/classes/helpers/FrmFormsHelper.php
index a632b729a2..7439291d95 100644
--- a/classes/helpers/FrmFormsHelper.php
+++ b/classes/helpers/FrmFormsHelper.php
@@ -347,6 +347,11 @@ private static function get_clickable_field_error_messages( $args ) {
 		$ids                  = array_map( 'intval', array_column( $fields, 'id' ) );
 		$field_error_messages = '';
 
+		// Error messages are admin configured and may include shortcodes, so allow the same
+		// inline formatting Formidable permits elsewhere while stripping anything unsafe. Anchors
+		// are intentionally excluded so a message link cannot nest inside the summary link.
+		$allowed_tags = array( 'strong', 'b', 'em', 'i', 'u', 'span', 'code', 'br', 'sub', 'sup', 'mark', 'small' );
+
 		foreach ( $parsed_errors as $parsed_error ) {
 			$index = array_search( (int) $parsed_error['field_id'], $ids, true );
 
@@ -354,7 +359,16 @@ private static function get_clickable_field_error_messages( $args ) {
 				continue;
 			}
 
-			$field   = $fields[ $index ];
+			$field = $fields[ $index ];
+			$error = FrmAppHelper::kses( $parsed_error['error'], $allowed_tags );
+
+			if ( in_array( $field->type, array( 'hidden', 'user_id' ), true ) ) {
+				// These render as hidden inputs, which cannot receive focus, so list the
+				// error without a link that would go nowhere when clicked.
+				$field_error_messages .= '<li>' . $error . '</li>';
+				continue;
+			}
+
 			$html_id = 'field_' . $field->field_key . $parsed_error['row'];
 
 			if ( in_array( $field->type, array( 'checkbox', 'radio' ), true ) ) {
@@ -362,7 +376,7 @@ private static function get_clickable_field_error_messages( $args ) {
 				$html_id .= '-0';
 			}
 
-			$field_error_messages .= '<li><a href="#' . esc_attr( $html_id ) . '">' . esc_html( $parsed_error['error'] ) . '</a></li>';
+			$field_error_messages .= '<li><a href="#' . esc_attr( $html_id ) . '">' . $error . '</a></li>';
 		}//end foreach
 
 		return $field_error_messages;
@@ -376,6 +390,9 @@ private static function get_clickable_field_error_messages( $args ) {
 	 *     @type stdClass $form
 	 *     @type int      $entry_id
 	 *     @type string   $class
+	 *     @type string   $role  Optional. ARIA live region role for the wrapper. Defaults to 'status'.
+	 *                           Pass 'alert' when the message reports a validation error so it is
+	 *                           announced assertively, matching the non-ajax error wrapper.
 	 * }
 	 *
 	 * @return string
@@ -403,7 +420,9 @@ public static function get_success_message( $atts ) {
 		}
 
 		$message = do_shortcode( $message );
-		return '<div class="' . esc_attr( $atts['class'] ) . '" role="status">' . $message . '</div>';
+		$role    = isset( $atts['role'] ) ? $atts['role'] : 'status';
+
+		return '<div class="' . esc_attr( $atts['class'] ) . '" role="' . esc_attr( $role ) . '">' . $message . '</div>';
 	}
 
 	/**
diff --git a/tests/phpunit/forms/test_FrmFormsHelper.php b/tests/phpunit/forms/test_FrmFormsHelper.php
index 0204b3e833..f9bdb81661 100644
--- a/tests/phpunit/forms/test_FrmFormsHelper.php
+++ b/tests/phpunit/forms/test_FrmFormsHelper.php
@@ -222,11 +222,12 @@ public function test_get_invalid_error_message_without_errors_has_no_list() {
 	}
 
 	/**
-	 * Error text and IDs must be escaped so a malicious field key or message cannot inject markup.
+	 * Error messages may contain admin HTML, so unsafe markup is stripped while safe inline
+	 * formatting is kept, and anchors are removed so they cannot nest inside the summary link.
 	 *
 	 * @covers FrmFormsHelper::get_invalid_error_message
 	 */
-	public function test_get_invalid_error_message_escapes_output() {
+	public function test_get_invalid_error_message_sanitizes_error_html() {
 		$this->form = $this->factory->form->create_and_get();
 		$text_id    = $this->create_field_with_key( 'text', 'escape_test' );
 
@@ -234,13 +235,53 @@ public function test_get_invalid_error_message_escapes_output() {
 			array(
 				'form'   => $this->form,
 				'errors' => array(
-					'field' . $text_id => '<script>alert(1)</script>',
+					'field' . $text_id => '<strong>Name</strong> is required<script>alert(1)</script><a href="https://evil.test">x</a>',
 				),
 			)
 		);
 
-		$this->assertStringNotContainsString( '<script>alert(1)</script>', $message );
-		$this->assertStringContainsString( '&lt;script&gt;', $message );
+		// Scripts are removed entirely.
+		$this->assertStringNotContainsString( '<script', $message );
+		// Anchors in the message are stripped so they cannot nest inside the summary link.
+		$this->assertStringNotContainsString( 'https://evil.test', $message );
+		// The only anchor present is the summary link itself.
+		$this->assertSame( 1, substr_count( $message, '<a ' ) );
+		// Safe inline formatting from the admin message is preserved.
+		$this->assertStringContainsString( '<strong>Name</strong> is required', $message );
+	}
+
+	/**
+	 * Hidden and user ID fields render as hidden inputs that cannot receive focus, so their
+	 * errors should be listed as plain text instead of a link that would go nowhere.
+	 *
+	 * @covers FrmFormsHelper::get_invalid_error_message
+	 */
+	public function test_get_invalid_error_message_does_not_link_hidden_fields() {
+		$this->form = $this->factory->form->create_and_get();
+
+		$hidden_id = $this->create_field_with_key( 'hidden', 'my_hidden' );
+		$user_id   = $this->create_field_with_key( 'user_id', 'my_user_id' );
+		$text_id   = $this->create_field_with_key( 'text', 'visible_text' );
+
+		$message = FrmFormsHelper::get_invalid_error_message(
+			array(
+				'form'   => $this->form,
+				'errors' => array(
+					'field' . $hidden_id => 'Hidden is required',
+					'field' . $user_id   => 'User ID is required',
+					'field' . $text_id   => 'Text is required',
+				),
+			)
+		);
+
+		// Hidden and user ID errors appear as plain list items, with no anchor to a non-focusable input.
+		$this->assertStringContainsString( '<li>Hidden is required</li>', $message );
+		$this->assertStringContainsString( '<li>User ID is required</li>', $message );
+		$this->assertStringNotContainsString( '#field_my_hidden', $message );
+		$this->assertStringNotContainsString( '#field_my_user_id', $message );
+
+		// A normal field in the same summary is still a link.
+		$this->assertStringContainsString( '<li><a href="#field_visible_text">Text is required</a></li>', $message );
 	}
 
 	/**
@@ -264,6 +305,38 @@ public function test_get_invalid_error_message_handles_repeater_row_keys() {
 		$this->assertStringContainsString( '<li><a href="#field_repeated_text-2">Repeated text is required</a></li>', $message );
 	}
 
+	/**
+	 * The message wrapper defaults to role="status" but can be switched to role="alert" for errors,
+	 * so the ajax error summary is announced the same way as the non-ajax one.
+	 *
+	 * @covers FrmFormsHelper::get_success_message
+	 */
+	public function test_get_success_message_role() {
+		$form = $this->factory->form->create_and_get();
+
+		$default = FrmFormsHelper::get_success_message(
+			array(
+				'message'  => 'Saved.',
+				'form'     => $form,
+				'entry_id' => 0,
+				'class'    => 'frm_message',
+			)
+		);
+		$this->assertStringContainsString( 'role="status"', $default );
+
+		$alert = FrmFormsHelper::get_success_message(
+			array(
+				'message'  => 'Please correct the errors.',
+				'form'     => $form,
+				'entry_id' => 0,
+				'class'    => FrmFormsHelper::form_error_class(),
+				'role'     => 'alert',
+			)
+		);
+		$this->assertStringContainsString( 'role="alert"', $alert );
+		$this->assertStringNotContainsString( 'role="status"', $alert );
+	}
+
 	/**
 	 * @param string $type
 	 * @param string $field_key

From 4a6ff79edebf232800451298142fa51608e0fb51 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Wed, 5 Aug 2026 15:33:14 -0300
Subject: [PATCH 3/7] Avoid linking to a field that is not on page or visible

---
 classes/helpers/FrmFormsHelper.php | 34 ++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/classes/helpers/FrmFormsHelper.php b/classes/helpers/FrmFormsHelper.php
index 7439291d95..db39955de1 100644
--- a/classes/helpers/FrmFormsHelper.php
+++ b/classes/helpers/FrmFormsHelper.php
@@ -343,7 +343,7 @@ private static function get_clickable_field_error_messages( $args ) {
 			return '';
 		}
 
-		$fields               = FrmDb::get_results( 'frm_fields', array( 'id' => $field_ids ), 'id,field_key,type' );
+		$fields               = FrmDb::get_results( 'frm_fields', array( 'id' => $field_ids ), 'id,field_key,type,field_order,form_id' );
 		$ids                  = array_map( 'intval', array_column( $fields, 'id' ) );
 		$field_error_messages = '';
 
@@ -362,9 +362,10 @@ private static function get_clickable_field_error_messages( $args ) {
 			$field = $fields[ $index ];
 			$error = FrmAppHelper::kses( $parsed_error['error'], $allowed_tags );
 
-			if ( in_array( $field->type, array( 'hidden', 'user_id' ), true ) ) {
-				// These render as hidden inputs, which cannot receive focus, so list the
-				// error without a link that would go nowhere when clicked.
+			if ( ! self::error_field_is_linkable( $field ) ) {
+				// The field has no focusable input on the page being shown (a hidden field, or a
+				// field on another page of a multi-page form), so list the error as plain text
+				// rather than a link that would go nowhere when clicked.
 				$field_error_messages .= '<li>' . $error . '</li>';
 				continue;
 			}
@@ -382,6 +383,31 @@ private static function get_clickable_field_error_messages( $args ) {
 		return $field_error_messages;
 	}
 
+	/**
+	 * Whether an error summary should link to the field, or just list its message as plain text.
+	 *
+	 * A link is only useful when the field renders a focusable input that is actually on the page
+	 * being shown. Hidden and user ID fields render as hidden inputs that cannot receive focus, and
+	 * a field on another page of a multi-page form is not visible, so neither should be linked.
+	 *
+	 * @since x.x
+	 *
+	 * @param stdClass $field Field row with at least type, field_order and form_id.
+	 *
+	 * @return bool
+	 */
+	private static function error_field_is_linkable( $field ) {
+		if ( in_array( $field->type, array( 'hidden', 'user_id' ), true ) ) {
+			return false;
+		}
+
+		if ( is_callable( 'FrmProFieldsHelper::field_on_current_page' ) && ! FrmProFieldsHelper::field_on_current_page( $field ) ) {
+			return false;
+		}
+
+		return true;
+	}
+
 	/**
 	 * @param array $atts {
 	 *     The success message details.

From 6e92a722be5b9113dfa572e768e08478ad93ced8 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Wed, 5 Aug 2026 15:41:33 -0300
Subject: [PATCH 4/7] Fix some failing workflow issues

---
 classes/helpers/FrmFormsHelper.php | 26 +++++++++++++++++---------
 stubs.php                          |  7 +++++++
 2 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/classes/helpers/FrmFormsHelper.php b/classes/helpers/FrmFormsHelper.php
index db39955de1..9c3e8b8a53 100644
--- a/classes/helpers/FrmFormsHelper.php
+++ b/classes/helpers/FrmFormsHelper.php
@@ -322,7 +322,7 @@ private static function get_clickable_field_error_messages( $args ) {
 			$field_id = preg_replace( '/^field/', '', $field_plus_id );
 			$row      = '';
 
-			if ( strpos( $field_id, '-' ) !== false ) {
+			if ( str_contains( $field_id, '-' ) ) {
 				$field_id_parts = explode( '-', $field_id );
 
 				if ( count( $field_id_parts ) === 3 ) {
@@ -344,22 +344,27 @@ private static function get_clickable_field_error_messages( $args ) {
 		}
 
 		$fields               = FrmDb::get_results( 'frm_fields', array( 'id' => $field_ids ), 'id,field_key,type,field_order,form_id' );
-		$ids                  = array_map( 'intval', array_column( $fields, 'id' ) );
 		$field_error_messages = '';
 
+		$fields_by_id = array();
+
+		foreach ( $fields as $field ) {
+			$fields_by_id[ (int) $field->id ] = $field;
+		}
+
 		// Error messages are admin configured and may include shortcodes, so allow the same
 		// inline formatting Formidable permits elsewhere while stripping anything unsafe. Anchors
 		// are intentionally excluded so a message link cannot nest inside the summary link.
 		$allowed_tags = array( 'strong', 'b', 'em', 'i', 'u', 'span', 'code', 'br', 'sub', 'sup', 'mark', 'small' );
 
 		foreach ( $parsed_errors as $parsed_error ) {
-			$index = array_search( (int) $parsed_error['field_id'], $ids, true );
+			$field_id = (int) $parsed_error['field_id'];
 
-			if ( false === $index ) {
+			if ( ! isset( $fields_by_id[ $field_id ] ) ) {
 				continue;
 			}
 
-			$field = $fields[ $index ];
+			$field = $fields_by_id[ $field_id ];
 			$error = FrmAppHelper::kses( $parsed_error['error'], $allowed_tags );
 
 			if ( ! self::error_field_is_linkable( $field ) ) {
@@ -398,14 +403,17 @@ private static function get_clickable_field_error_messages( $args ) {
 	 */
 	private static function error_field_is_linkable( $field ) {
 		if ( in_array( $field->type, array( 'hidden', 'user_id' ), true ) ) {
+			// Hidden inputs cannot receive focus, so there is nothing to link to.
 			return false;
 		}
 
-		if ( is_callable( 'FrmProFieldsHelper::field_on_current_page' ) && ! FrmProFieldsHelper::field_on_current_page( $field ) ) {
-			return false;
+		if ( ! is_callable( 'FrmProFieldsHelper::field_on_current_page' ) ) {
+			// Multi-page forms are a Pro feature; in Lite every field is on the only page.
+			return true;
 		}
 
-		return true;
+		// On a multi-page form, do not link a field that is on a page other than the one being shown.
+		return FrmProFieldsHelper::field_on_current_page( $field );
 	}
 
 	/**
@@ -446,7 +454,7 @@ public static function get_success_message( $atts ) {
 		}
 
 		$message = do_shortcode( $message );
-		$role    = isset( $atts['role'] ) ? $atts['role'] : 'status';
+		$role    = $atts['role'] ?? 'status';
 
 		return '<div class="' . esc_attr( $atts['class'] ) . '" role="' . esc_attr( $role ) . '">' . $message . '</div>';
 	}
diff --git a/stubs.php b/stubs.php
index d2fbe140c7..68193bb05a 100644
--- a/stubs.php
+++ b/stubs.php
@@ -316,6 +316,13 @@ public static function replace_non_standard_formidable_shortcodes( $args, &$valu
 		 */
 		public static function is_field_visible_to_user( $field ) {
 		}
+		/**
+		 * @param array|object|int $field
+		 *
+		 * @return bool
+		 */
+		public static function field_on_current_page( $field ) {
+		}
 	}
 	class FrmViewsAppHelper {
 		/**

From e3d6ef9a01d46c877a05ed5e98d2b1d0d321a7d3 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Wed, 5 Aug 2026 15:51:00 -0300
Subject: [PATCH 5/7] Shift some code

---
 classes/helpers/FrmFormsHelper.php | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/classes/helpers/FrmFormsHelper.php b/classes/helpers/FrmFormsHelper.php
index 9c3e8b8a53..c6e982cda2 100644
--- a/classes/helpers/FrmFormsHelper.php
+++ b/classes/helpers/FrmFormsHelper.php
@@ -343,9 +343,7 @@ private static function get_clickable_field_error_messages( $args ) {
 			return '';
 		}
 
-		$fields               = FrmDb::get_results( 'frm_fields', array( 'id' => $field_ids ), 'id,field_key,type,field_order,form_id' );
-		$field_error_messages = '';
-
+		$fields       = FrmDb::get_results( 'frm_fields', array( 'id' => $field_ids ), 'id,field_key,type,field_order,form_id' );
 		$fields_by_id = array();
 
 		foreach ( $fields as $field ) {
@@ -355,7 +353,8 @@ private static function get_clickable_field_error_messages( $args ) {
 		// Error messages are admin configured and may include shortcodes, so allow the same
 		// inline formatting Formidable permits elsewhere while stripping anything unsafe. Anchors
 		// are intentionally excluded so a message link cannot nest inside the summary link.
-		$allowed_tags = array( 'strong', 'b', 'em', 'i', 'u', 'span', 'code', 'br', 'sub', 'sup', 'mark', 'small' );
+		$allowed_tags         = array( 'strong', 'b', 'em', 'i', 'u', 'span', 'code', 'br', 'sub', 'sup', 'mark', 'small' );
+		$field_error_messages = '';
 
 		foreach ( $parsed_errors as $parsed_error ) {
 			$field_id = (int) $parsed_error['field_id'];

From c1c2719fbebe85ab880d1d9868273263e8bc5c04 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Wed, 5 Aug 2026 15:53:21 -0300
Subject: [PATCH 6/7] Run php cs fixer on stub

---
 stubs.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stubs.php b/stubs.php
index 68193bb05a..7edadbe48d 100644
--- a/stubs.php
+++ b/stubs.php
@@ -317,7 +317,7 @@ public static function replace_non_standard_formidable_shortcodes( $args, &$valu
 		public static function is_field_visible_to_user( $field ) {
 		}
 		/**
-		 * @param array|object|int $field
+		 * @param array|int|object $field
 		 *
 		 * @return bool
 		 */

From 62490e82b7264bae1105059fcdfee76272646238 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Wed, 5 Aug 2026 16:14:51 -0300
Subject: [PATCH 7/7] Fix margin bottom issue in ul

---
 css/_single_theme.css.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/css/_single_theme.css.php b/css/_single_theme.css.php
index 3906dcc6b6..0262af134f 100644
--- a/css/_single_theme.css.php
+++ b/css/_single_theme.css.php
@@ -429,6 +429,7 @@
 .<?php echo esc_html( $style_class ); ?> .frm_error_style ul{
 	list-style: inside<?php echo esc_html( $important ); ?>;
 	color: var(--error-text)<?php echo esc_html( $important ); ?>;
+	margin-bottom: 0<?php echo esc_html( $important ); ?>;
 }
 
 .<?php echo esc_html( $style_class ); ?> .frm_error_style ul li a{