WP Manifestindependent plugin directory
manifest / builders / ad-acf-builder

AD ACF Builder WP RegistryMedium-severity findings · 1 findingOpen the reportB

A WordPress Page Builder based on ACF flexible fields

by anybodesign · github.com/anybodesign/ad-acf-builder · website

★ 1stars
38release downloads
≈10active sites
1.1.1latest · 9 years ago

Install

Download ad-acf-builder.zip From the 1.1.1 release on GitHub, Jul 26, 2017

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/anybodesign/ad-acf-builder/releases/download/1.1.1/ad-acf-builder.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/anybodesign/ad-acf-builder ↗

Description

AD ACF Builder is an add-on for Advanced Custom Fields Pro 5.6 or greater. It's a page builder for your pages and posts, once the plugin is activated, you'll be able to add different types of content to your publications. Watch the demo video!

Available fields

  • Content: wysiwyg content area, columns layout.
  • Call to action: custom text, button and background image or background color.
  • Photo gallery: pictures, columns layout.
  • Content gallery: posts, pages or custom post types, columns layout.

Requirements

Advanced Custom Fields Pro 5.6 or greater has to be installed and activated.

Installation

  • Download the zip archive and upload it to your WordPress site.
  • Install and activate Advanced Custom Fields Pro 5.6 or greater.
  • Activate the plugin.
  • The builder is now available on your posts and pages!

To-do

  • CSS for ACF admin
  • Responsive options for columns
  • More fields!

Changelog

2017-07-26 - 1.1.1

  • CSS fix: CTA button z-index, figcaption margins

2017-07-26 - 1.1

  • CSS fix: gallery columns
  • Bugfix: your site won't break if the plugin is activated whereas ACF is not

2017-07-21 - 1.0

  • First release on the Entrepôt :)

2017-07-13

  • Initial Commit

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.1 latest
Jul 26, 2017 9 years ago
ad-acf-builder.zip
18
1.1
Jul 26, 2017 9 years ago
ad-acf-builder.zip
8
1.0
Jul 21, 2017 9 years ago
ad-acf-builder.zip
12

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

AD ACF Builder 1.1.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.1
Findings
1
Worst severity
medium
Content hash
3f69b547c8009e1bc7311d7a…

Findings

  • medium Unescaped ACF builder fields allow Contributor+/Author stored XSS on published posts

    xss_stored

    acfb_ouput() prints ACF flexible-content values into the public post/page body with no escaping. Non-HTML subfields are placed in HTML attributes and text nodes: CTA button/background colors and the background-image URL go into style=""; cta_block_link url/title/target go into href, link text, and target=""; gallery/content-gallery titles go into <h2>; image alt/caption/url and the columns select go into alt="", figcaption, href, and class="acfb-{cols}". Write path is the post editor (edit_post, ACF nonce) — Subscriber cannot use it; Contributor can save their own posts and Author can publish. WordPress kses post_content for users without unfiltered_html, but ACF color/link/text values are stored as strings; kses does not HTML-encode quotes, so a value such as red" onmouseover="alert(document.domain) in cta_block_btncolor becomes an event-handler attribute on the frontend <a class="acfb-cta-btn">. Gallery titles and image alt/caption similarly break out of <h2> or alt="" if tags or quotes are stored. the_content concatenation then serves that markup to every visitor of the singular post/page. WYSIWYG areas (text_block_area*, cta_block_text) are intended HTML and are out of scope for this finding. Plugin has no REST/AJAX handlers; this is purely an output-escaping bug on an otherwise capability-correct edit_post write.

    acf/acfb-output.php:94-107,132-149,182-192

    Recommendation

    Escape on output by context: esc_url() for href and CSS url(); esc_attr() for style/color/target/alt/class; esc_html() for titles, captions, and link text. Pass colors through sanitize_hex_color() (or reject non-hex). Keep WYSIWYG through wp_kses_post() rather than raw echo. Do not rely on ACF save-time kses; it does not encode attribute breakout characters.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →