Advanced Custom Fields: Phone Number WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- #8 in Content & Publishing

High-severity findings.

Audited release

1.3.1

Findings

1

Worst severity

high

Content hash

04cd1541bcf1b9626b0ed57a… Copy

Findings

• high Authenticated (Contributor+) stored XSS via unsanitized phone country attribute

  xss_stored

  render_field() interpolates $field['value']['country'], $field['value']['number'], $field['placeholder'], and $field['default_country'] into HTML attributes with sprintf and no esc_attr. update_value() persists the submitted array unchanged. validate_value() rejects empty/invalid numbers by constructing PhoneNumber and calling isValid(), which wraps libphonenumber parse(). parse() / checkRegionForParsing() accept any country string when the number starts with '+', so a valid E.164 number (the JS widget itself rewrites the input to E.164 on change) plus a crafted country such as us" onfocus="alert(document.domain)" autofocus=" is stored. Empirically PhoneNumber::isValid() returns true for that pair. When an editor or administrator opens the post/user (or an acf_form loads the value), the hidden country input is emitted as value="us" onfocus="alert(document.domain)" autofocus=" and the handler runs in that origin. Contributor+ can hit this on any post they can edit that has the field; a Subscriber can if the field is on their profile. Number-only XSS payloads fail isViablePhoneNumber, so the country attribute is the practical breakout.

  src/PhoneNumberField.php:84-96

  Recommendation

  Escape every attribute with esc_attr() in render_field. In update_value/validate_value, allow country only from PhoneNumber::getCountries() (ISO 3166-1 alpha-2) and persist strtolower of that allow-list. Do not treat isValid() as HTML-safety.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.