Critical findings.

Audited release

0.6.4

Findings

2

Worst severity

critical

Content hash

b45dfd05c77ff8814cb680fa… Copy

Findings

• critical Unauthenticated reflected XSS in preview.php via css/font/wi query args

  xss_reflected

  preview.php is a standalone script in the plugin directory. It does not bootstrap WordPress, set a Content-Type, or check authentication/nonce/capability. It prints $_GET['font'] and $_GET['wi'] into an @import url(...) inside a <style> block (only spaces are turned into +) and prints $_GET['css'] raw into the same block. HTML parsing closes </style> regardless of CSS string context, so a URL such as preview.php?css=</style><script>alert(document.domain)</script> or preview.php?font=x&wi=400);</style><script>…</script> executes attacker JavaScript in the WordPress origin. The file is the src of the admin preview iframe (plugin_dir_url + preview.php?css=&font=&wi=) and is also hit directly by any unauthenticated visitor. js/input.js copies the preview div's style and the font-family/weight inputs into that same URL with no encoding. Because the iframe is same-origin and has no sandbox attribute, script in the preview document can reach window.parent and the wp-admin page. Upstream last commit is 2015-02-09 (v0.6.4); treat as already-disclosed/dead upstream.

  preview.php:4-11

  Recommendation

  Do not echo request parameters into HTML. If a preview document is required, allowlist CSS properties/values (or emit only numeric size/weight and a font-family from the Google Fonts catalog) and escape with esc_attr/esc_url. Prefer generating the preview entirely in JavaScript with element.style (no PHP endpoint). Until patched, delete or deny HTTP access to preview.php. This plugin has not been maintained since 2015; replacing it is safer than waiting for a vendor fix.

• high Stored XSS in the ACF typography field UI (unescaped font-family/CSS)

  xss_stored

  acf_field_typography does not implement update_value, so ACF stores the submitted array (font-family, font-weight, backupfont, text_align, font_size, line_height, letter_spacing, font_style, text-color, direction) as post/user/option meta with no plugin-side sanitization. validate_value only checks emptiness when the field is required. render_field then concatenates those values into HTML: the font-family <input value="…">, getCSS() which does $css .= $key.':'.$value.';' for arbitrary keys, a preview div style="$css", and an unsandboxed iframe src="…preview.php?css=$css&font=$font-family&wi=$font-weight". None of those sinks use esc_attr. An Author (or Contributor on a draft later opened by an editor; or a Subscriber if the field group is assigned to the user profile) can save font-family as "> <script>…</script> (or a style/src breakout). When an administrator opens the edit screen, the payload runs in wp-admin and in the same-origin preview iframe. This is independent of a crafted preview.php URL: the stored meta is the write path, render_field is the consumer.

  acf-typography-v5.php:423-548

  Recommendation

  Sanitize on save (allowlist font-family against the Google Fonts list, absint sizes, sanitize_hex_color for text-color, allowlist align/direction/style/weight). Escape every echo with esc_attr. Do not put field values into an iframe URL; apply preview styles via the DOM. Add sandbox="" on any remaining iframe.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.