CVE-2018-20986: Advancedcustomfields Advanced Custom Fields

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.

Affected products

• Advancedcustomfields Advanced Custom Fields: before 5.7.8 (fixed in 5.7.8)

Published 2019-08-22. Last modified 2026-06-17.