CVE-2020-36172

The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS

published January 6, 2021

CVSS
—
EPSS
1%
Percentile
59.5
In the wild
Unconfirmed
What it is

The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00907 · 59.5th percentile
Published
2021-01-06T14:17Z
EPSS history
Timeline
  • 06 JAN 14:17Z
    The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS
    cvelistv5