Unable to CC multiple people on email notifications – Basic & Advanced Form

[Phvntom Inc.]

Phvntom Inc.

April 15, 2025 at 3:43 pm

Issue opened on GitHub: [Issue] Unable to use comma-separated emails in the “Cc” field of the Form and Form (Adv) blocks as supported by wp_mail

The Kadence Form and Advanced Form blocks use the wp_mail() function to send emails triggered by the *_after_submit actions.

According the the codex, wp_mail() supports comma-separated email addresses for any of the “to:”, “cc:”, or “bcc:” values.

In both versions of the form blocks, the “cc” field is processed by WordPress’s sanitize_email() function. The sanitize_email function is only intended to sanitize a single email address.

This causes Kadence Blocks to sanitize a comma-separated list of recipients into a single, formatted email address like so:

$email_list = "[email protected], [email protected], [email protected]";

echo sanitize_email( $email_list ); // "[email protected]"

Oddly enough, the values in the “Send Email To:”, “Cc:”, and “Bcc:” fields all receive inconsistent treatment from one another in Kadence Blocks. See below:

Send Email To: accepts any trimmed value without using sanitize_email()
Cc: processes the trimmed value with sanitize_email()
Bcc: parses the trimmed value with explode(‘,’, $recipient) and processes each entry with sanitize_email()

This is a strange oversight, considering the “Cc” and “Bcc” values are processed less than 10 lines apart (on the basic form).

Here are the relevant lines:

Basic Form: kadence-blocks/includes/form-ajax.php line 275
Advanced Form: kadence-blocks/includes/advanced-form/advanced-form-submit-actions.php line 125

Here’s a temporary workaround:

/**
*
* FIX: Kadence Forms sending emails to comma-separated addresses
*
* Enhances the 'sanitize_email' function to support comma-separated
* emails. HOWEVER, should not be used on sites that enable frontend
* user registration or that rely on sanitize_email to validate if a
* value contains just one [1] email address.
*
*/
add_filter( 'sanitize_email', 'phvn_sanitize_emails', 10, 3 );
function phvn_sanitize_emails($sanitized_email, $original_email, $error_reason){

// Check for commas in the original email
if( strpos($original_email, ',') ){

// 1. Remove spaces from the original email
// 2. Separate the string by comma
// 3. Re-run the sanitization function on each email
$email_list = array_filter(
explode( ',', preg_replace('/\s+/u', '', $original_email) ),
fn($email) => sanitize_email($email)
);

// Concatenate the list by comma
$sanitized_email = implode(',', $email_list);
}
return $sanitized_email;
}

We didn’t bother checking the autoresponder after_submit action offered in Kadence Blocks Pro, but wouldn’t be surprised if a similar issue is present.

As a side note: Kadence Blocks fires the wp_mail() function multiple times – using each bcc’d email as the primary recipient, instead of just using the built-in “Bcc:” header provided by wp_mail() and firing the function once.

It’s pretty surprising that this issue hasn’t been brought up yet, given that it’s quite common to CC multiple recipients on business contact forms… we speculate that this issue is widespread – but most users assume it’s working properly since nothing else breaks, no errors are presented, and the other recipient settings work as intended. We identified the issue after a client insisted that they haven’t been receiving notifications from their contact forms, despite ruling out everything else from spam-filtering to DNS problems.

Please fix ASAP. Thank you.