Advanced Custom Fields Extensions WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.3.16

Findings

3

Worst severity

high

Content hash

efe1c36548fe9a87e1a4b7b3… Copy

Findings

• high Stored XSS in inline_editor via strip_tags allowing event-handler attributes

  xss_stored

  acf_field_inline_editor::update_value() sanitizes submitted HTML with strip_tags() allowing <a>, <b>, <i>, <strong>, <u>, etc. strip_tags() does not strip attributes, so payloads such as <a href="javascript:alert(document.cookie)">x</a> or <i onmouseover="alert(1)">x</i> are stored in ACF post meta. render_field() then concatenates $field['value'] unescaped into a contenteditable div and echoes it. WordPress does not kses ACF meta, so authors/contributors who lack unfiltered_html (and therefore cannot XSS post_content) can still plant HTML that executes when an editor/admin opens the post, and that themes typically print via get_field() on the front end. The inLine JS copies trigger.innerHTML into the hidden input on change, preserving the payload across saves.

  fields/class-acf-field-inline-editor.php:32-85,100-131

  Recommendation

  Replace strip_tags() with wp_kses() using an explicit allowed-tags/attributes map (href on <a> passed through esc_url, no event-handler attributes). Escape on output unless the value has been kses'd; never echo unsanitized HTML into the admin field UI.

• high Stored XSS in instagram_post field via unescaped thumbnail URL derived from user input

  xss_stored

  update_value() extracts an Instagram shortcode with the greedy regex /\/p\/(.+)\/.*/ and builds both a local filepath and a later <img src> from that capture. Quotes and HTML metacharacters are not sanitized. file_put_contents() is called even when curl fails (false is written as an empty file), so file_exists() succeeds and a thumbnail URL containing the payload is stored. render_field() echoes <img src="'.$thumbnail.'"> with no esc_url/esc_attr. A value such as https://www.instagram.com/p/x" onerror="alert(1)" junk="/ becomes <img src=".../instagram/x" onerror="alert(1)" junk=".jpg"> which auto-executes when anyone (typically an editor/admin) opens the ACF field. The same users who can save the post can plant this; the field is deprecated but still registered.

  fields/class-acf-field-instagram_post.php:15-58,100-114

  Recommendation

  Allow only [A-Za-z0-9_-] in the Instagram shortcode, reject path characters, and echo the thumbnail with esc_url() inside esc_attr(). Do not write files from attacker-controlled names.

• high CSRF via GET ?clean-acf=1 deletes all acf-field posts and rewrites ACF JSON

  csrf

  On acf/init the plugin treats a GET query arg as a destructive maintenance action. The only gates are is_admin() and current_user_can('administrator'); there is no nonce, no POST requirement, and no confirmation. A logged-in administrator who visits /wp-admin/?clean-acf=1 (or any wp-admin URL including admin-ajax.php with that query arg) — including via a cross-site link, SameSite=Lax top-level GET — causes: (1) glob+file_put_contents over every file in the ACF save_json directory, and (2) DELETE FROM posts WHERE post_type='acf-field', wiping every ACF field definition in the database. Changelog 1.1.8 documents this as a backend cleaning feature left in production. Observable consequence: custom fields disappear site-wide until restored from backup/JSON.

  acf-extensions.php:78-99

  Recommendation

  Remove this runtime GET footgun from production, or require a POST + wp_verify_nonce + manage_options check and a confirmation step. Never perform DELETE/file writes on a mere query-string visit.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.