ACF Phone WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.2

Findings

2

Worst severity

high

Content hash

74bd16e8ad110431559782ef… Copy

Findings

• high Stored XSS via unescaped click-to-call HTML from phone field values

  xss_stored

  acf_phone_plugin::format_value() (also invoked from acf_phone_field::format_value on every get_field/the_field) builds click-to-call markup by concatenating stored e164, national, and extension with no escaping: return '<a href="tel:' . $value['e164'] . '">' . $national . '</a>'. validate_value() only rejects an empty e164 when national is filled; update_value() only strips an 'ext.*' suffix and parentheses for CA/US. A user who can save the ACF object (Contributor+ on a post whose field group includes type=phone, or anyone a public acf_form allows) can persist e164='+1" onclick="alert(1)" x="' or national='<img src=x onerror=alert(1)>'. Client-side intl-tel-input validation is bypassed by editing the ACF POST (or submitting with JS off while leaving a previously valid hidden e164). Because clicktocall is intended to be echoed as HTML, every front-end consumer of that return format executes the payload in visitors' browsers. The same raw national/e164 strings are returned for the other formats; those are theme-escaped by ACF policy, but clicktocall is this plugin's HTML. Upstream 3.x changed this line to sprintf(..., esc_attr($value['e164']), esc_html($national)).

  acf-phone.php:47-66

  Recommendation

  Escape at the HTML sink the way upstream 3.x does: sprintf('<a href="tel:%s">%s</a>', esc_attr($value['e164']), esc_html($national)). Also constrain update_value(): allowlist country as an ISO code, restrict e164 to '+' plus digits, and strip national/extension to phone characters so crafted attributes cannot be stored. Do not treat intl-tel-input as a security boundary.

• high Stored XSS in phone field inputs from unescaped value attributes

  xss_stored

  render_field() prints $value['national'], $value['country'], $value['e164'], and $value['extension'] into HTML value attributes with the unescaped short-echo tag and no esc_attr (and $field['name'] is likewise unescaped). Those values are the same ACF meta written by update_value() with no XSS sanitization. A Contributor who can save the host post plants a breakout such as national='" autofocus onfocus="alert(1)' plus any non-empty e164 to satisfy validate_value(). When an Editor/Administrator opens the post editor (or any user is shown an acf_form that re-renders the field), the browser parses the injected attribute/event handler in that privileged session. ACF does not kses these meta values the way it kses post_content for users without unfiltered_html. acf-phone.js assigns via jQuery .val()/.text() and is not the executing consumer; the PHP-rendered markup is. Official ACF example field types use esc_attr($field['name']) and esc_attr($field['value']); this plugin does not. Upstream 3.1.2 still leaves this sink unescaped.

  fields/class-acf-phone-v5.php:345-365

  Recommendation

  Escape every attribute: name="<?php echo esc_attr( $name ); ?>[national]" value="<?php echo esc_attr( $value['national'] ); ?>" (and the same for country, e164, extension). Pair with allowlist sanitization in update_value() so stored meta cannot contain quotes or markup.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.