High-severity findings.

Audited release

1.6.0

Findings

1

Worst severity

high

Content hash

e3de9a19d699320e73346682… Copy

Findings

• high Stored XSS via unsanitized ACF background field values in editor HTML

  xss_stored

  The Background field type never sanitizes on save and never escapes on output. ACF5 leaves update_value unimplemented (raw array stored); ACF4 update_value() returns $value unchanged. render_field() then print/echoes attacker-controlled subfields into HTML attributes and a style attribute: background-color and background-text in <input value="..."> (including the RGBA path, which copies the original string into ext_value['rgba'] / ext_value['he-op']['hex']), background-image in input value plus <a href>, media.thumbnail in <img src>, and getCSS() which interpolates every non-media value as `key:value;` or `background-image:url('value')` into the previewer's style="...". A Contributor who can edit a post (or anyone submitting an acf_form / user profile that includes this field) can save a value such as `"><script>alert(1)</script>` or `x')"><img src=x onerror=alert(1)>`; the next administrator or editor who opens the object executes that script in wp-admin, bypassing unfiltered_html because ACF stores this as meta rather than kses'd post_content. The same sinks exist in acf-background-v4.php create_field()/getCSS() (e.g. lines 374, 549-573, 598, 607-621). The plugin has no frontend CSS printer of its own. Upstream last commit is 2014-11-26 (tag v1.6.0 dated 2014-11-19); there is no escaping helper anywhere in the three PHP files.

  acf-background-v5.php:564-583,627-660,672-680,729-744

  Recommendation

  Sanitize on save (hex/rgba for colors, esc_url_raw for image/thumbnail URLs, allowlist for repeat/size/position/clip/origin/attachment). Escape every echo: esc_attr() on input values/ids/names/classes, esc_url() on href/src, and build the preview style from allowlisted property names plus sanitized values (no raw concatenation). Implement update_value() instead of the identity/passthrough. Because this add-on has not been maintained since 2014, prefer replacing it with ACF native color/image fields or a maintained equivalent rather than running it on current WordPress.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.